Your Privacy Matters at gf77 — Here Is How We Protect It

1 Introduction

gf77 operates as an online casino and sports betting platform serving adult players in Bangladesh and other eligible markets. As a platform that processes financial transactions, verifies player identities, and maintains gaming records, we necessarily handle certain categories of personal data. We take this responsibility seriously.

This Policy applies to all personal data collected through the gf77 website at gf77.io, including data collected during account registration, KYC verification, deposits and withdrawals, gameplay activity, customer support interactions, and any other interaction you have with the gf77 Platform.

This Policy does not apply to third-party websites, applications, or services that may be linked from the gf77 Platform. Those third parties maintain their own privacy policies, for which gf77 accepts no responsibility. Please review the privacy policy of any third-party service before providing them with your personal data.

If you have any questions about this Policy or about how gf77 handles your personal data, you are welcome to contact our dedicated data protection team at any time via the contact details provided in Section 14 of this document.

2 Personal Data We Collect

gf77 collects personal data across several categories depending on the nature of your interaction with the Platform. The table below summarises the categories of data collected and the purpose for which each category is used:

Where gf77 requests that you provide personal data and you decline to do so, we may be unable to create your account, process transactions, or provide certain services. Where data provision is mandatory for a specific purpose, this will be clearly indicated at the point of collection.

3 How We Collect Personal Data

gf77 collects personal data through the following channels:

• Direct Submission: Data you provide voluntarily when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, contacting customer support, or filling out any form on the Platform.
• Automated Technical Collection: Data collected automatically as you browse and interact with the Platform, including your IP address, browser fingerprint, session duration, pages visited, and in-game activity. This data is collected via server logs, session tracking, and first-party analytics tools.
• Payment Processors: When you make a deposit or initiate a withdrawal via bKash, Nagad, Rocket, Upay, or any other supported payment method, the relevant payment processor shares transaction confirmation data with gf77 for the purpose of crediting or debiting your account balance.
• Identity Verification Partners: gf77 may engage licensed KYC and identity verification service providers to assist with the verification of the documents you submit. These partners process data strictly under instruction from gf77 and are bound by confidentiality obligations.
• Fraud Prevention Services: gf77 may receive data from third-party fraud detection and AML screening services where there is a legitimate reason to verify the legitimacy of an account or transaction.

4 How We Use Your Personal Data

gf77 uses personal data only for lawful, specific, and legitimate purposes. The following table sets out the primary uses of personal data processed by gf77:

1. Account Registration and Management: To create and maintain your player account, verify your identity and age, and manage your account preferences and communication settings.
2. Payment Processing: To process deposits and withdrawals in Bangladeshi Taka (৳) via your chosen payment method, including bKash, Nagad, Rocket, Upay, Visa, and Mastercard. Financial data is processed solely to complete the transaction and maintain accurate records.
3. KYC and AML Compliance: To satisfy our Know Your Customer obligations and anti-money laundering screening requirements. This includes verifying your identity, age, source of funds (where required), and transaction patterns.
4. Responsible Gaming: To monitor gameplay patterns for signs of problem gambling, enforce self-imposed deposit limits and session time limits, and reach out proactively if our responsible gaming algorithms identify a player at risk.
5. Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance. Support interactions may be recorded for quality assurance purposes.
6. Platform Security and Fraud Prevention: To detect and prevent unauthorised account access, fraudulent transactions, bonus abuse, multi-accounting, and other prohibited conduct as defined in the Terms & Conditions.
7. Service Improvement: To analyse aggregated, anonymised usage data to improve the performance, usability, and content of the gf77 Platform. No individually identifiable data is used for this purpose without your consent.
8. Legal and Regulatory Obligations: To comply with any legal obligation, court order, or regulatory instruction that requires gf77 to process, retain, or disclose personal data.

5 Legal Basis for Processing

gf77 processes personal data on the following legal bases, which are consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing that is necessary for the performance of the contract between you and gf77 — i.e., the Terms & Conditions you accepted at registration. This includes account creation, payment processing, and game provision.
• Legal Obligation: Processing that gf77 is required to perform in order to comply with applicable legal requirements, including AML regulations, KYC obligations, and any lawful instructions from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out for the legitimate interests of gf77 or third parties, provided those interests are not overridden by your fundamental rights. This includes fraud prevention, platform security, responsible gaming monitoring, and service improvement through anonymised analytics.
• Consent: Where gf77 relies on your consent as the legal basis for processing — for example, for marketing communications or optional analytics tracking — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

6 Data Sharing and Disclosure

gf77 does not sell or rent your personal data to any third party. We share personal data only in the following strictly defined circumstances:

• Payment Service Providers: We share the minimum necessary financial data with our payment partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, BRAC Bank) solely to process your deposit and withdrawal transactions.
• KYC and Verification Partners: Licensed identity verification service providers process your KYC documents on our behalf under strict data processing agreements. They may not use your data for any purpose other than verification.
• Game Content Providers: Third-party game studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) receive a pseudonymised player identifier and session token to facilitate game play. They do not receive your full personal profile.
• Fraud and AML Screening Services: gf77 may share transaction data and account identifiers with specialist fraud detection and AML screening providers where there is a legitimate need to assess the risk associated with a transaction or account.
• Legal and Regulatory Authorities: gf77 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by law, court order, or binding regulatory instruction. We will notify affected players of such disclosures where we are legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of gf77's business, personal data may be transferred to the acquiring entity. Players will be notified of any such transfer and of any resulting changes to this Privacy Policy at least 30 days in advance.

All third parties with whom gf77 shares personal data are required to handle that data in a manner consistent with this Privacy Policy and applicable data protection standards. gf77 does not permit third-party service providers to use your data for their own marketing or commercial purposes.

7 Cookies and Tracking Technologies

gf77 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used on gf77.io:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They manage your login session, maintain your account security state, and remember your language and currency preferences. These cookies cannot be disabled without breaking core Platform functionality.
• Performance and Analytics Cookies: These cookies collect anonymised data about how visitors use the Platform — such as which pages are visited most frequently and whether users encounter error messages. This data is used solely to improve Platform performance and is never linked to your personal identity.
• Functionality Cookies: These cookies remember your preferences and personalisation choices — such as your preferred game lobby view or notification settings — to provide a more tailored experience on subsequent visits.
• Security Cookies: These cookies are used by gf77's fraud prevention and security systems to identify suspicious access patterns, detect automated bot activity, and protect against account takeover attacks.

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the gf77 Platform, including logging in and making transactions. gf77 does not use third-party advertising or cross-site tracking cookies.

8 Data Security

gf77 employs a multi-layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• TLS/SSL Encryption: All data transmitted between your browser or device and gf77 servers is encrypted using Transport Layer Security (TLS 1.2 or higher). The padlock icon displayed in your browser confirms this encryption is active during every session.
• AES-256 Encryption at Rest: Sensitive personal data and payment records stored on gf77 servers are encrypted using AES-256 encryption, the same standard used by major international financial institutions.
• Access Controls: Access to personal data is restricted to gf77 personnel who have a legitimate business need to access it. All staff with access to personal data are subject to strict confidentiality obligations and undergo regular data protection training.
• Two-Factor Authentication: gf77 supports and encourages the use of two-factor authentication (2FA) for all player accounts to provide an additional layer of security beyond the standard username and password combination.
• Penetration Testing: gf77 commissions regular independent security audits and penetration tests to identify and remediate vulnerabilities in the Platform's infrastructure before they can be exploited.
• Incident Response: In the event of a data breach that poses a risk to player data, gf77 will notify affected players and relevant authorities within 72 hours of becoming aware of the breach, in accordance with applicable data breach notification requirements.

9 Data Retention

gf77 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention period required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Data that has been anonymised — meaning it can no longer be linked to any identifiable individual — may be retained indefinitely for statistical and platform improvement purposes.

10 Your Data Rights

As a registered player on the gf77 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] from your registered email address. gf77 will respond within 14 calendar days of receiving a valid, verified request.

11 Children's Privacy and Age Restriction

The gf77 Platform is strictly intended for adults aged 21 years and over. gf77 does not knowingly collect personal data from any person under the age of 21. Our registration process includes mandatory age verification steps, and all accounts are subject to KYC review which includes confirmation of date of birth.

If gf77 discovers or is notified that a player account has been created by or on behalf of a person under the age of 21, the account will be immediately suspended, all funds will be frozen pending investigation, and the account will be permanently closed. Any personal data collected from an underage individual will be deleted as soon as it is safe and lawful to do so.

If you have reason to believe that a minor has registered an account on the gf77 Platform using false information, please report this immediately to [email protected]. gf77 takes underage gambling extremely seriously and cooperates fully with any investigation relating to minors accessing the Platform.

21+ Only. Please play responsibly and ensure that your account credentials are never accessible to anyone under the age of 21 in your household.

12 Third-Party Links and Services

The gf77 Platform may contain links to third-party game providers, payment processing interfaces, or informational resources. gf77 has no control over the privacy practices of these third-party services and accepts no responsibility for their content or data handling practices.

When you access a third-party service through the gf77 Platform — for example, by launching a game powered by Pragmatic Play or Evolution Gaming — that third party may independently collect technical and usage data as described in their own privacy policy. gf77 recommends that you review the privacy policies of any third-party services you interact with.

The presence of a third-party game studio or payment provider on the gf77 Platform does not constitute an endorsement of that party's privacy practices. gf77 requires all contracted third-party providers to maintain data protection standards consistent with this Policy, but cannot guarantee compliance beyond our contractual controls.

13 Changes to This Privacy Policy

gf77 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of the Platform. The "Last Updated" date at the top of this document will be revised whenever a material change is made.

Where a change to this Policy is material — meaning it meaningfully alters your rights, gf77's obligations, or the way we process your personal data — gf77 will notify all registered players by email to their registered address at least 14 days before the change takes effect. Continued use of the Platform after the effective date of any revised Policy constitutes acceptance of the updated terms.

Where a change is non-material — for example, a correction of a typographical error, a clarification of existing language, or an update to contact details — gf77 may make the change without prior notice, though the "Last Updated" date will still be revised. We encourage you to review this Policy periodically to stay informed of how gf77 protects your data.

All previous versions of this Privacy Policy are available upon written request to [email protected]. gf77 retains archived versions of all previous policies for a period of at least 5 years.

14 Contact and Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gf77 handles your personal data, please contact our support and data protection team using the details below. All enquiries must be submitted in English and must include your registered username or email address for verification purposes.

• Email: [email protected]
• Response Time: Within 4 hours during standard operating hours; within 24 hours during peak periods.
• Support Hours: 24 hours a day, 7 days a week, 365 days a year.
• Subject Line for Data Requests: Please use the subject line "Data Rights Request — [Your Username]" so that your enquiry is routed directly to the appropriate team.
• Subject Line for Privacy Concerns: Please use the subject line "Privacy Policy Enquiry — [Your Username]" for general questions about this Policy.