Privacy Policy — goya9 Betting & Casino
At goya9, your privacy is not an afterthought — it is a foundational commitment. This Privacy Policy explains exactly what personal data we collect, why we collect it, how we use it, and the rights you hold as a registered player on Bangladesh's most trusted online betting and casino platform.
Our Commitment to You
Six Ways goya9 Protects Your Privacy
These principles guide every data decision we make at goya9, from the moment you register your account to each transaction you complete.
Minimal Data Collection
goya9 collects only the personal data that is strictly necessary for delivering our services, complying with legal obligations, and maintaining account security. We do not collect data for the sake of it — every data point has a defined purpose.
Bank-Grade Encryption
All data transmitted between your device and goya9 servers is protected with 256-bit SSL/TLS encryption — the same standard used by leading international financial institutions and mobile banking platforms including bKash and Nagad.
No Data Selling
goya9 does not sell, rent, or commercially trade your personal data to any third party under any circumstances. Your information is shared only with trusted service partners who are contractually bound to handle it with the same level of care we apply.
Transparent Data Use
This Privacy Policy provides a complete and plain-English account of how your data is used. There are no hidden purposes, no vague catch-all clauses, and no undisclosed data-sharing arrangements. What you read here is the full picture.
Your Rights Respected
As a goya9 player, you have clear rights over your personal data — including the right to access a copy of it, to request corrections, and to request deletion under applicable circumstances. We honour these rights promptly and without unnecessary friction.
Defined Retention Periods
goya9 does not hold your data indefinitely. Retention periods are tied to specific legal and operational requirements. Once data is no longer needed for the purpose for which it was collected, it is securely deleted or anonymised in accordance with our retention schedule.
1 Who We Are
goya9 ("we", "us", "our", "the Platform") is an online betting and casino platform operated under the domain goya9.io, providing sports betting, live casino, slot games, crash games, and fishing arcade games to players located in Bangladesh. goya9 is designed specifically for the Bangladeshi market and operates with Bangladeshi Taka (৳) as its primary transaction currency, supporting local payment methods including bKash, Nagad, Rocket, and Upay.
For the purposes of this Privacy Policy, goya9 acts as the data controller in respect of the personal information collected from registered players and website visitors. As data controller, goya9 determines the purposes and means of processing your personal data and is responsible for ensuring that your data is handled lawfully, fairly, and transparently.
If you have any questions about how goya9 handles your personal data, you may contact our support team at any time using the details set out in Section 13 of this policy. Our dedicated data privacy support team responds to all privacy-related enquiries in English within 24 hours.
2 Data We Collect
goya9 collects personal data through several channels: directly from you when you register or use the platform, automatically as you interact with the platform, and from third-party service providers involved in payment processing and identity verification. The following table summarises the categories of personal data goya9 collects and the primary source of each category.
| Data Category | Examples | Primary Source |
|---|---|---|
| Identity Data | Full legal name, date of birth, gender, National Identity Card (NID) number, passport number | Provided directly by you during registration and KYC verification |
| Contact Data | Mobile phone number, email address, residential address, city (Dhaka, Chittagong, Sylhet, etc.) | Provided directly by you during registration or account updates |
| Financial Data | bKash/Nagad/Rocket account numbers, transaction reference IDs, deposit and withdrawal amounts in ৳ Taka, payment method type | Provided by you and received from payment processors |
| Account Data | Username, encrypted password hash, account balance, bonus balances, wagering history, preferred games, session history | Generated automatically when you create and use your account |
| Technical Data | IP address, device type, operating system, browser type and version, screen resolution, device identifiers | Collected automatically via server logs and browser APIs |
| Usage Data | Pages visited, games played, time spent on platform, clickstream data, search queries within the platform, feature interactions | Collected automatically via analytics systems |
| Communications Data | Records of live chat conversations, email correspondence, support ticket content, complaint records | Generated when you contact the goya9 support team |
| Verification Documents | Scanned copies or photographs of NID cards, passports, utility bills, or other KYC documents | Submitted by you during the KYC verification process |
3 How We Use Your Data
goya9 uses the personal data it collects for the following specific and clearly defined purposes. We do not use your data for any purpose that is incompatible with those listed below without first obtaining your explicit consent.
3.1 Account Management and Service Delivery
Your identity, contact, and account data are used to create and maintain your goya9 player account, authenticate your login sessions, process your bets and casino gameplay, administer your bonus balances, and communicate important account information such as deposit confirmations, withdrawal notifications, and security alerts.
3.2 Payment Processing
Financial data is used to process deposits and withdrawals via your chosen payment method (bKash, Nagad, Rocket, Upay, Visa, Mastercard, or supported bank transfer). goya9 does not store full card numbers or mobile banking PINs. Transaction data is retained for reconciliation, financial reporting, and audit trail purposes in accordance with our data retention schedule.
3.3 Identity Verification and KYC Compliance
goya9 is required to verify the identity of players before processing withdrawals above specified thresholds and to comply with anti-money laundering (AML) obligations. Your identity documents and personal details are used to conduct KYC checks, which may involve sharing your data with accredited third-party identity verification service providers operating under strict data processing agreements.
3.4 Fraud Prevention and Security
Technical and usage data, together with financial and identity data, are used to detect and prevent fraudulent activity, money laundering, multi-accounting, and other prohibited conduct as defined in the goya9 Terms and Conditions. Automated and manual monitoring systems analyse account behaviour to identify anomalous patterns. Accounts flagged for review may have withdrawals paused pending investigation.
3.5 Responsible Gaming Monitoring
goya9 uses account and usage data to identify players who may be exhibiting signs of problem gambling behaviour — such as unusual increases in deposit frequency, significant increases in session duration, or repeated attempts to withdraw self-exclusion requests. This data use is in the player's interest and forms part of goya9's responsible gaming obligations. Players identified as potentially at risk may be contacted by our responsible gaming support team.
3.6 Platform Improvement and Analytics
Anonymised and aggregated usage and technical data are used to analyse platform performance, improve user experience, test new features, and optimise our game portfolio. Where analytics involve personal data rather than purely anonymised data, this is done on the basis of legitimate interest and the data is subject to the same security and retention standards as all other personal data.
3.7 Marketing and Promotions
With your consent, goya9 may use your contact data to send you promotional communications about new games, deposit bonuses, cricket betting specials (BPL, IPL, T20 World Cup), and seasonal offers relevant to the Bangladesh market. You may withdraw your marketing consent at any time by contacting our support team or updating your account communication preferences. Withdrawal of marketing consent does not affect your ability to use the platform.
3.8 Legal Compliance
goya9 processes and retains personal data to the extent required to comply with applicable legal and regulatory obligations, including financial record-keeping requirements, responses to lawful requests from competent authorities, and the enforcement of the goya9 Terms and Conditions.
4 Legal Basis for Processing
Every instance of personal data processing carried out by goya9 is grounded in one of the following legal bases:
- Contractual Necessity: Processing is necessary to perform the contract between you and goya9 — i.e., to deliver the betting and casino services you have registered to use. This covers account management, payment processing, and game delivery.
- Legal Obligation: Processing is required for goya9 to comply with applicable legal obligations, including AML regulations, KYC requirements, and financial record-keeping obligations.
- Legitimate Interests: Processing serves goya9's legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring, and platform analytics — provided those interests are not overridden by your fundamental rights and freedoms.
- Consent: Processing is based on your freely given, specific, informed, and unambiguous consent — primarily in the context of direct marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
5 Data Sharing & Disclosure
goya9 does not sell or commercially license your personal data to any third party. Personal data is shared only in the circumstances described below, and only to the extent necessary for the stated purpose.
5.1 Payment Service Providers
To process deposits and withdrawals, goya9 shares necessary transaction data with payment service providers including bKash, Nagad, Rocket, Upay, Visa, and Mastercard payment networks, and participating banks (BRAC Bank, Dutch-Bangla Bank, City Bank, Islami Bank, Sonali Bank). These providers act as data processors under agreements that prohibit them from using your data for any purpose beyond completing the authorised transaction.
5.2 Identity Verification Providers
For KYC compliance, goya9 may share your identity documents and personal details with accredited third-party identity verification services. These providers are contractually required to process your data solely for the purpose of identity verification and to apply security standards equivalent to those maintained by goya9.
5.3 Game Content Providers
Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session data (e.g., game round IDs, bet amounts) necessary for game delivery, RNG auditing, and player dispute resolution. These providers do not receive your personally identifiable information beyond what is technically necessary for game delivery.
5.4 Legal and Regulatory Authorities
goya9 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, valid legal process, or court order. In such cases, goya9 will disclose only the minimum data required to comply with the lawful request and will, where legally permitted, notify you of the disclosure.
5.5 Business Transfers
In the event of a merger, acquisition, or sale of substantially all of goya9's assets, personal data held about registered players may be transferred to the acquiring entity as part of that transaction. In such circumstances, goya9 will publish a notice on the platform and, where feasible, notify affected players directly before their data is transferred to a new data controller.
6 Cookies & Tracking
The goya9 platform uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your authenticated session, and to collect anonymised analytics data that helps us understand how the platform is used and where improvements can be made.
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Session authentication, security tokens, load balancing, CSRF protection. Required for the platform to function. | No — disabling these cookies will prevent the platform from working correctly. |
| Functional | Remembering your language preference, display settings, and recently played games. | Yes — disabling these cookies means your preferences will not be saved between sessions. |
| Analytics | Collecting anonymised data on page visits, feature usage, and navigation paths to improve the platform experience. | Yes — you may opt out of analytics cookies without affecting your ability to use the platform. |
| Responsible Gaming | Tracking session duration to support configurable session time reminders and detecting unusual activity patterns for player protection purposes. | No — these cookies support player safety obligations and cannot be disabled. |
Most web browsers allow you to control cookie settings through their privacy or settings menus. Please be aware that disabling certain categories of cookies may affect the functionality of the goya9 platform. goya9 does not use advertising cookies or third-party behavioural tracking cookies for targeted advertising purposes.
7 Data Retention
goya9 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply to the main categories of personal data processed by goya9:
- Account and Identity Data: Retained for the lifetime of your active goya9 account plus a minimum of five years following account closure, to comply with financial record-keeping and AML regulatory requirements.
- KYC and Verification Documents: Retained for a minimum of five years from the date of submission or the date of account closure, whichever is later, in accordance with anti-money laundering compliance obligations.
- Transaction and Financial Data: Retained for a minimum of five years from the date of each transaction for financial audit and reconciliation purposes.
- Betting and Game History: Retained for the lifetime of your active account plus three years following account closure, to support dispute resolution and responsible gaming monitoring.
- Support and Communications Data: Retained for three years from the date of each communication, to support the resolution of any subsequent complaints or disputes.
- Technical and Usage Data (anonymised): Anonymised analytics data may be retained indefinitely as it no longer constitutes personal data once it has been fully anonymised.
- Marketing Consent Records: Retained for the duration of your active account and for two years following any withdrawal of marketing consent, as evidence of consent management.
At the end of the applicable retention period, personal data is securely and permanently deleted from goya9 systems or, where deletion is technically impractical due to backup architecture, rendered inaccessible and scheduled for deletion at the next available opportunity.
8 Data Security
goya9 maintains a comprehensive information security programme designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. The key technical and organisational security measures in place include:
- Encryption in Transit: TLS 1.3 / 256-bit SSL encryption on all data transmissions between player devices and goya9 servers.
- Encryption at Rest: Sensitive data fields (including identity document images and financial reference data) are encrypted at the database level using AES-256.
- Access Controls: Role-based access controls (RBAC) ensure that goya9 staff can only access personal data that is relevant to their specific job function. All access to player data by staff is logged and periodically audited.
- Password Security: Player passwords are never stored in plain text. goya9 uses industry-standard one-way cryptographic hashing with salting to store password credentials securely.
- Two-Factor Authentication: Two-factor authentication (2FA) is available for player accounts and is mandatory for all goya9 internal staff accounts with access to production systems.
- Intrusion Detection: Automated intrusion detection and prevention systems (IDS/IPS) monitor goya9 infrastructure 24/7 for anomalous activity and potential security threats.
- Data Breach Response: goya9 maintains a documented data breach response plan. In the event of a data breach that is likely to result in a high risk to affected players, goya9 will notify affected individuals promptly and take all reasonable steps to contain and remediate the breach.
While goya9 takes every reasonable precaution to protect your personal data, no method of electronic transmission or storage is 100% secure. You play an important role in keeping your data safe by maintaining the confidentiality of your goya9 account credentials and notifying us immediately at [email protected] if you suspect any unauthorised access to your account.
9 Your Rights
As a goya9 player whose personal data is processed by the platform, you hold the following rights in relation to that data. goya9 is committed to facilitating the exercise of these rights promptly and without unnecessary procedural barriers.
- Right of Access: You have the right to request a copy of the personal data goya9 holds about you. Access requests will be fulfilled within 30 days of receipt. The first copy is provided free of charge; additional copies may be subject to a reasonable administrative fee.
- Right to Rectification: If any of the personal data goya9 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update certain account details (such as your contact number or address) directly through your account settings; other corrections should be requested via the support team.
- Right to Erasure: In certain circumstances, you have the right to request that goya9 delete your personal data. This right is subject to goya9's legal obligations to retain data (e.g., for AML compliance and financial record-keeping), which may take precedence over an erasure request in specific cases.
- Right to Restriction: You have the right to request that goya9 restrict the processing of your personal data in certain circumstances — for example, if you contest the accuracy of the data or if you have objected to processing and we are assessing whether our legitimate interests override your objection.
- Right to Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to request its transfer to another data controller where technically feasible.
- Right to Object: You have the right to object to the processing of your personal data where that processing is based on goya9's legitimate interests, including automated profiling. goya9 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
- Right to Withdraw Consent: Where processing is based on your consent (e.g., for marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of the above rights, please contact the goya9 support team at [email protected] with a description of your request. We may ask you to provide identity verification before processing certain requests to ensure the security of your personal data. goya9 will respond to all rights requests within 30 days and will not charge a fee for requests made in good faith.
10 Children & Minors
The goya9 platform is strictly intended for individuals who are at least 21 years of age. goya9 does not knowingly collect, process, or retain personal data from any person under the age of 21. Registration on the goya9 platform requires confirmation that the registering individual meets the minimum age requirement.
If goya9 becomes aware that it has inadvertently collected personal data from an individual who is under the age of 21, it will immediately suspend the associated account, permanently delete all personal data associated with that account, and refund any real-money balance to the payment source used for deposit. If you believe that a person under the age of 21 has registered on goya9, please notify us immediately at [email protected] so that we can take appropriate action without delay.
11 Third-Party Services
The goya9 platform may contain functionality powered by third-party service providers, including game streaming technology from Evolution Gaming and Ezugi, slot game engines from Pragmatic Play, NetEnt, and Microgaming, and crash game technology from Spribe. While goya9 carefully selects its service partners and requires them to adhere to data protection standards consistent with this Privacy Policy, goya9 is not responsible for the privacy practices of third-party providers in relation to data collected directly by those providers through their own platforms or websites.
All third-party providers engaged by goya9 who process personal data on goya9's behalf do so under data processing agreements that restrict them to processing such data only on goya9's documented instructions and for no other purpose. goya9 conducts due diligence on prospective service partners' data security and privacy practices before engagement and reviews those practices periodically throughout the relationship.
goya9 does not embed third-party social media widgets, advertising trackers, or analytics pixels that would allow third parties to collect your personal data from the goya9 platform without your knowledge.
12 Policy Updates
goya9 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or changes to the services we provide. The effective date at the top of this page will be updated whenever a material change is made to this policy.
Where changes are material — meaning they affect the basis on which we process your personal data or the rights available to you — goya9 will notify registered players via the email address associated with their account and will display a prominent notice on the platform for a minimum of 30 days following the change. Your continued use of the goya9 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.
We encourage you to review this Privacy Policy periodically to stay informed about how goya9 is protecting your personal data. Archived versions of previous Privacy Policy versions are available upon request by contacting our support team.
13 Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way goya9 handles your personal data, please reach out to our dedicated privacy support team using the contact details below. All privacy-related enquiries are handled in strict confidence and responded to in English.
- Email: [email protected]
- Subject Line (recommended): Privacy Enquiry — [Your Username]
- Support Hours: 24 hours a day, 7 days a week, 365 days a year
- Response Time: Privacy-related email enquiries are responded to within 24 hours; urgent data security concerns (e.g., suspected unauthorised access) are escalated for response within 4 hours
- Rights Requests: Fulfilled within 30 days of verified receipt
Your Data Is Safe — Now Enjoy the Platform
With your privacy fully protected by 256-bit encryption and a strict no-data-selling policy, you can enjoy everything goya9 has to offer — cricket betting, live casino, slots, and more — with complete peace of mind.