gto9 Privacy Policy
At gto9, your privacy is a fundamental part of how we operate. This Privacy Policy explains exactly what personal data we collect when you use our platform, how that data is used, who it may be shared with, and the rights you hold over your own information.
Privacy at a Glance
How gto9 Protects Your Personal Data
These cards summarise the core commitments gto9 makes to every player regarding personal data. They do not replace the full Privacy Policy set out below — all clauses in the full document are legally binding.
We Collect Only What We Need
gto9 collects only the personal data that is strictly necessary to operate your account, process transactions, verify your identity, and comply with legal obligations. We do not collect data speculatively or sell it to third-party advertisers.
Industry-Standard Encryption
All data transmitted between your device and the gto9 platform is protected by 256-bit SSL/TLS encryption. Your account password is stored as a one-way cryptographic hash — gto9 staff cannot read your password, and it is never transmitted in plain text.
No Unauthorised Third-Party Sharing
gto9 does not sell, rent, or trade your personal data to unaffiliated marketers. Data is shared only with our payment processing partners (bKash, Nagad, Rocket, Upay), game providers, and legal or regulatory authorities where required by law.
Your Right to Access and Correct
You have the right to request a copy of the personal data gto9 holds about you, to correct inaccurate data, and to request deletion of data that is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.
Transparent Cookie Use
gto9 uses essential cookies to operate the platform and analytical cookies to improve performance. We do not use third-party advertising cookies or tracking pixels that share your browsing behaviour with external advertising networks.
Defined Data Retention Periods
gto9 retains your account data for as long as your account remains active and for a defined period thereafter as required by our legal obligations. Transaction records are retained for a minimum of five years in accordance with applicable financial record-keeping requirements.
Important Notice: By registering an account or continuing to use the gto9 platform, you confirm that you have read and understood this Privacy Policy in full. If you do not agree with any part of this Policy, please discontinue use of the platform and contact support to request account closure. Your privacy matters to us — this document is written in plain, accessible English so that every player understands exactly how their data is handled.
1 Introduction
gto9 ("we", "us", "our") operates the online betting and casino platform accessible at gto9.io and is committed to protecting the personal data of all registered players and site visitors in Bangladesh and elsewhere. This Privacy Policy describes our practices in connection with the collection, use, storage, disclosure, and protection of personal information you provide to us or that we collect automatically when you access or use the gto9 platform.
This Policy applies to all gto9 services, including sports betting (cricket BPL, Bangladesh Tigers internationals, IPL, T20 World Cup, football, kabaddi), live casino, slot games, crash games, fishing games, and any promotional programmes operated by gto9. It applies whether you access the platform via a desktop browser, mobile browser, or any other device.
We encourage you to read this Privacy Policy carefully and to revisit it periodically, as we may update it from time to time. The most current version is always available at gto9.io/privacy-policy. The effective date at the top of this document indicates when the current version came into force.
Data Controller: For the purposes of applicable data protection law, gto9 acts as the data controller in respect of personal data collected through the gto9.io platform. Questions about this Policy or requests to exercise your data rights should be directed to [email protected] (plain text — not a clickable link).
2 Data We Collect
gto9 collects personal data from you in three principal ways: data you provide directly during registration and account use, data we collect automatically as you interact with the platform, and data we receive from third-party service providers such as payment processors and identity verification services.
Data you provide directly:
- Full legal name, date of birth, and gender, as provided during the registration process.
- Mobile phone number used for account registration and SMS verification.
- Email address (where provided as a secondary contact or for account notifications).
- Residential address and city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or other), where requested for KYC verification.
- Government-issued identity document details (National Identity Card number, passport number, or birth certificate reference) submitted during KYC verification for withdrawals above ৳10,000.
- Payment account details (bKash account number, Nagad account number, Rocket account number, Upay account number, or bank account details for Dutch-Bangla Bank, City Bank, BRAC Bank, or other supported institutions) used to process deposits and withdrawals.
- Communications you send to gto9 support via live chat, email, or WhatsApp, including support request content and any attachments.
- Responsible gaming preferences, including deposit limits, loss limits, cooling-off periods, and self-exclusion requests.
Data collected automatically:
- IP address and approximate geographic location derived from that IP address.
- Device type, operating system version, and browser type and version.
- Session data including login timestamps, session duration, pages visited, and features accessed.
- Betting and gaming activity, including markets wagered on, stake amounts, game sessions played, and outcomes.
- Transaction history, including all deposits, withdrawals, bonus credits, and balance adjustments.
- Cookie data and similar tracking technologies as described in Clause 7.
Data received from third parties:
- Identity verification results from KYC service providers confirming whether submitted documents are valid.
- Transaction confirmation data from payment gateways (bKash, Nagad, Rocket, Upay) confirming deposit receipt and withdrawal disbursement.
- Fraud risk scores or alerts generated by our payment security partners in respect of specific transactions.
3 How We Use Your Data
gto9 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose that is incompatible with the purposes described here without first obtaining your consent or establishing a separate legal basis.
| Purpose | Data Used |
|---|---|
| Account registration and management | Name, date of birth, mobile number, email address |
| Processing deposits and withdrawals | Payment account details, transaction records |
| Identity verification (KYC) | Government ID details, address, date of birth |
| Fraud prevention and security monitoring | IP address, device data, session data, transaction history |
| Providing customer support | Support communications, account data, transaction data |
| Responsible gaming management | Betting activity, responsible gaming preferences, loss data |
| Platform improvement and analytics | Session data, device data, feature usage data (anonymised where possible) |
| Sending account notifications | Mobile number, email address |
| Compliance with legal obligations | All data categories as required by applicable law |
gto9 does not use your personal data to build advertising profiles, does not share data with social media advertising platforms, and does not engage in automated profiling that produces legal or similarly significant effects without human oversight.
4 Legal Basis for Processing
gto9 processes personal data only where a valid legal basis exists for doing so. The legal bases we rely on are as follows:
- Contract performance: Processing your name, contact details, payment information, and gaming activity is necessary to perform our contractual obligations to you under the gto9 Terms & Conditions — specifically, to operate your account, process transactions, and provide access to games and betting markets.
- Legal obligation: Certain data processing activities — in particular KYC identity verification, transaction record-keeping, and fraud reporting — are required by applicable financial regulations and legal obligations. We cannot waive these requirements at your request.
- Legitimate interests: gto9 processes IP addresses, device data, and session data on the basis of our legitimate interests in maintaining platform security, preventing fraud, and improving platform performance. We have assessed that these legitimate interests are not overridden by your privacy interests.
- Consent: Where we send you promotional communications (e.g., SMS notifications about new bonuses, seasonal offers such as BPL promotions, Eid offers, or Pohela Boishakh specials), we do so only where you have expressly consented to receive such communications. You may withdraw your consent at any time by contacting gto9 support.
5 Data Sharing
gto9 does not sell, rent, or trade your personal data. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose.
- Payment processors: We share payment account details and transaction amounts with bKash, Nagad, Rocket, Upay, and other approved payment partners solely to process deposits and withdrawals. These partners act as independent data controllers in respect of their own payment processing activities and are bound by their own privacy policies.
- Game providers: Your player identifier (an anonymised reference, not your full name or contact details) is shared with game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi for the purpose of enabling game sessions and recording game outcomes.
- Identity verification providers: For KYC verification, we share the identity document details and personal information you submit with our identity verification service provider, who checks the information against official records.
- Legal and regulatory authorities: gto9 will disclose personal data to law enforcement, regulatory authorities, or courts where required to do so by applicable law, a valid court order, or in connection with the investigation of financial crime, fraud, or money laundering.
- Business transfers: In the event that gto9's business or assets are acquired by or merged with another entity, personal data held by gto9 may be transferred to the acquiring entity as part of that transaction. We will notify affected players of any such transfer in advance where practicable.
No Marketing Data Sales: gto9 categorically does not sell player data to advertising networks, data brokers, or marketing companies. If you ever receive unsolicited marketing from a third party claiming to have obtained your data from gto9, please report it to us immediately at [email protected].
6 Payment Data
gto9 treats payment data with the highest level of care. Your bKash, Nagad, Rocket, or Upay account numbers, and any bank account details you provide, are used exclusively to process the specific deposit or withdrawal transaction for which they were submitted. Payment credentials are transmitted directly to the relevant payment gateway over an encrypted connection and are not stored in full on gto9's own servers after transaction completion.
gto9 retains a record of the payment method type (e.g., "bKash") and a masked reference (e.g., the last four digits of a mobile number) associated with each transaction for account management, fraud prevention, and customer support purposes. Full payment account numbers are not retained in our transaction database beyond the period required for transaction processing.
gto9 does not accept or store credit card numbers. All transactions are conducted through mobile financial services (bKash, Nagad, Rocket, Upay) or approved bank transfer methods. This design choice eliminates a significant category of payment data risk for our players.
7 Cookies and Tracking Technologies
gto9 uses cookies and similar browser-based storage technologies on the gto9.io platform. Cookies are small text files stored on your device that allow the platform to recognise your browser across sessions and to remember your preferences and login state.
The categories of cookies gto9 uses are as follows:
- Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in, security tokens that protect against cross-site request forgery, and cookies that maintain your language and currency preferences. These cookies cannot be disabled without breaking core platform functionality.
- Analytical cookies: Used to understand how players interact with the platform — for example, which pages are visited most frequently, how long sessions last, and where players encounter errors. This data is collected in aggregated, anonymised form and is used solely to improve platform performance. No individual player is identified in our analytics data.
- Responsible gaming cookies: Used to store your session timing data locally so that session time reminders function correctly even if our servers experience a brief interruption.
gto9 does not use advertising cookies, retargeting cookies, social media tracking pixels, or any cookie that shares your browsing data with third-party advertising platforms. You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will prevent you from logging in to your gto9 account.
8 Data Security
gto9 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:
- 256-bit SSL/TLS encryption on all data transmitted between your device and the gto9 platform.
- Encrypted storage of sensitive data fields, including identity document references and payment method identifiers, at rest on secured servers.
- One-way cryptographic hashing of account passwords using industry-standard algorithms. gto9 staff cannot read or retrieve your password.
- Role-based access controls ensuring that gto9 staff access personal data only on a need-to-know basis, consistent with their specific job responsibilities.
- Automated real-time monitoring for anomalous login activity, including detection of credential-stuffing attacks, impossible-travel events, and unusual transaction patterns.
- Regular internal security reviews and vulnerability assessments of the platform infrastructure.
- Incident response procedures that ensure players are notified in the event of a data breach that is likely to affect their rights or interests, within a reasonable period of discovery.
Your Role in Security: gto9's security measures are most effective when complemented by your own account hygiene. Use a strong, unique password for your gto9 account. Enable SMS two-factor authentication. Never share your login credentials. Log out on shared devices. Report suspicious account activity to gto9 support immediately at [email protected].
9 Data Retention
gto9 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal retention obligations. The following retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account registration data (name, contact details, date of birth) | Duration of account plus 5 years after account closure |
| Transaction records (deposits, withdrawals, bet history) | Minimum 5 years from the date of the transaction |
| KYC identity verification documents | Duration of account plus 5 years after account closure |
| Support communications (live chat, email, WhatsApp logs) | 3 years from the date of the communication |
| Session and device logs | 12 months on a rolling basis |
| Responsible gaming records (limits set, self-exclusion history) | Duration of account plus 7 years after account closure |
| Analytical (anonymised) data | Indefinitely (no personal identifiers retained) |
When the applicable retention period expires, personal data is securely deleted or irreversibly anonymised. Where data is retained solely to comply with a legal obligation, it is stored in a restricted-access archive and is not used for any operational purpose during that period.
10 Your Privacy Rights
As a gto9 player, you hold the following rights in respect of the personal data we hold about you. To exercise any of these rights, contact gto9 support via live chat or at [email protected]. We will respond to all valid requests within 30 days.
Data Rights
Rights You Hold Over Your Personal Data
These rights are available to all gto9 account holders. Some rights are subject to limitations where legal retention obligations apply. Contact gto9 support to submit a request.
Right of Access
You have the right to request a copy of the personal data gto9 holds about you, including your account registration data, transaction history, KYC records, and support communications. We will provide this in a readable electronic format.
Right to Rectification
You have the right to request correction of any inaccurate personal data gto9 holds about you. For corrections to your registered name or date of birth, identity document verification will be required before the correction is applied.
Right to Erasure
You have the right to request deletion of personal data that is no longer necessary for the purposes for which it was collected. This right does not apply to data we are legally required to retain, such as transaction records held for regulatory compliance purposes.
Right to Restrict Processing
You have the right to request that gto9 restrict the processing of your personal data in certain circumstances — for example, where you contest the accuracy of the data or where you have objected to processing and a decision is pending.
Right to Data Portability
Where processing is based on your consent or on contract performance and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON).
Right to Object
You have the right to object to processing of your personal data where that processing is based on our legitimate interests. You also have the right to withdraw consent at any time where processing is based on consent, such as promotional SMS communications.
11 Minors
The gto9 platform is strictly for adults aged 21 years and above. gto9 does not knowingly collect personal data from any person under the age of 21. If you are under 21, you are not permitted to register an account or use the gto9 platform in any capacity.
If gto9 becomes aware that personal data has been collected from a person under the age of 21, we will immediately suspend the associated account, delete the personal data in question (subject to any legal retention obligations that may apply), and return any deposited funds to the originating payment source where technically possible.
Parents and guardians are encouraged to install parental control or content filtering software on shared devices to prevent minors from accessing online gambling platforms. If you believe a minor has created a gto9 account, please contact gto9 support immediately via live chat or at [email protected].
12 Third-Party Links
The gto9 platform may contain references to third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) whose game interfaces are embedded within the platform. While gto9 takes reasonable steps to ensure that its game providers maintain appropriate data protection standards, gto9 is not responsible for the privacy practices of these third parties in respect of any data they independently collect through their game interfaces.
The game providers listed above are independent data controllers in respect of the anonymised game session data they process. If you have questions about how a specific game provider handles data, you should refer to that provider's own privacy documentation.
gto9 does not link to external websites other than those of its payment partners (bKash, Nagad, Rocket, Upay) and game providers. gto9 accepts no responsibility for the privacy practices or content of any external website that may reference gto9 without our authorisation.
13 Changes to This Privacy Policy
gto9 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to the gto9 platform. When material changes are made to this Policy, we will notify registered players via SMS to the mobile number held on their account at least 7 days before the changes take effect, except where immediate changes are required by law or to address a security incident.
The updated Privacy Policy will be published at gto9.io/privacy-policy and the "Last Updated" date at the top of the document will be revised accordingly. Your continued use of the gto9 platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not accept the updated Privacy Policy, you must cease using the platform and may request account closure by contacting gto9 support.
We strongly encourage you to review this Privacy Policy periodically. Previous versions of the Privacy Policy are available on request by contacting gto9 support.
14 Contact Us
If you have questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a potential data protection concern, please contact the gto9 data protection team through any of the following channels:
- Live Chat: Available 24/7 via the gto9 platform. Mention "Privacy Request" or "Data Rights" at the start of your chat and your request will be escalated to the appropriate team. Average response time under 5 minutes.
- Email: [email protected] — use the subject line "Privacy Policy Enquiry" or "Data Rights Request" (plain text address — not a clickable link).
- WhatsApp: +880 1700 000000 (plain text — not a clickable link). Available during Bangladesh Standard Time (BST, UTC+6) business hours.
gto9 commits to acknowledging all data rights requests within 5 business days and completing the request within 30 days of acknowledgement. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days with prior notice.
This Privacy Policy was last reviewed and updated on 1 January 2026. It supersedes all prior versions. The effective version is always accessible at gto9.io/privacy-policy. For responsible gaming tools including self-exclusion and deposit limits, please visit our Responsible Gaming page. 21+ only. Please gamble responsibly.
Questions About Your Privacy? We Are Here
Contact gto9 support any time via live chat, explore our FAQ for quick answers, or visit our Responsible Gaming page to manage your account safety settings.
21+ only. Please gamble responsibly. Visit our Responsible Gaming page for support tools.