gw40 Privacy Policy

1 Who We Are

gw40 operates the online casino and sports betting platform accessible at gw40.im. In this Privacy Policy, references to "gw40", "we", "us", or "our" refer to the entity responsible for operating the gw40 platform and for the processing of your personal data in connection with that operation.

gw40 is committed to processing personal data responsibly, transparently, and in accordance with internationally recognised data protection principles. This Privacy Policy sets out the legal and operational framework under which we handle your information as a registered player or visitor to the gw40 platform.

If you have any questions about your data or this Policy, you may reach our dedicated data support team at any time by emailing [email protected]. Our support team operates on Bangladesh Standard Time (BST, UTC+6) and is available around the clock.

2 Data We Collect

gw40 collects personal data through several channels: directly from you during account registration and use of the platform; automatically through your device and browser as you interact with the site; and, where required, from authorised third-party verification and payment service providers. The categories of data we may collect are described below.

2.1 Registration & Identity Data

• Full legal name
• Date of birth (used to verify you are aged 21 or above)
• Email address
• Mobile phone number
• Residential address
• Username and encrypted password

2.2 Identity Verification (KYC) Data

• Government-issued photo ID (National ID card, passport, or driving licence)
• Proof of address documentation (utility bill, bank statement)
• Payment method ownership documentation (e.g., screenshot of bKash or Nagad account registered in your name)
• Source of funds documentation where required under our AML compliance obligations

2.3 Financial & Transaction Data

• Deposit and withdrawal amounts and timestamps
• Payment method identifiers (e.g., bKash wallet number, Nagad number, Rocket number, partial card numbers for Visa/Mastercard)
• Transaction history and account balance records
• Bonus and promotional credit records

2.4 Gaming & Betting Activity Data

• Game sessions played, bet amounts, and outcomes
• Sports betting market selections and wager history
• Session duration and login timestamps
• Responsible gaming tool settings (deposit limits, self-exclusion status)

2.5 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Browser type and version
• Device type, operating system, and screen resolution
• Referral URL and pages visited on the gw40 platform
• Cookie identifiers and session tokens (see Section 6)

2.6 Communications Data

• Live chat transcripts and email correspondence with our support team
• Feedback, complaints, and dispute records
• Records of your marketing communication preferences

3 How We Use Your Data

gw40 uses the personal data it collects for the following specific purposes. We do not use your data for any purpose that is incompatible with the purposes described below without first obtaining your explicit consent or establishing a separate lawful basis.

3.1 Marketing Communications

With your consent, gw40 may send you promotional emails or SMS messages about bonuses, new games, seasonal promotions (such as Eid special offers, Pohela Boishakh promotions, or BPL cricket betting events), and platform updates. You may withdraw this consent at any time by updating your notification preferences in your account settings or by contacting support at [email protected]. Withdrawal of marketing consent does not affect your ability to use the platform.

3.2 Responsible Gaming Monitoring

gw40 uses data about your gaming and betting activity to monitor for indicators of problem gambling. This includes analysis of deposit frequency, session duration, and betting pattern changes. Where our systems or support staff identify potential concerns, we may proactively reach out to offer responsible gaming resources or apply protective measures to your account. This processing is conducted in your best interest and in fulfilment of our duty of care obligations.

4 Legal Basis for Processing

gw40 processes your personal data on the following legal bases, depending on the specific purpose for which the data is used:

• Contractual necessity: Processing that is necessary to perform our contract with you — specifically, to create and maintain your account, process transactions, and deliver the gaming and betting services you have requested.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, KYC verification requirements, and cooperation with law enforcement or regulatory authorities.
• Legitimate interests: Processing carried out on the basis of gw40's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and internal analytics — provided these interests are not overridden by your privacy rights.
• Consent: Processing that depends on your explicit, freely given, informed, and revocable consent — primarily the sending of marketing communications. You may withdraw consent for any consent-based processing at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5 Sharing Your Data

gw40 does not sell your personal data to any third party. We share your data with third parties only in the circumstances described below, and always subject to contractual obligations that require those third parties to maintain appropriate data protection standards.

5.1 Payment Service Providers

To process deposits and withdrawals, gw40 shares the minimum necessary payment-related information with our authorised payment partners, including bKash, Nagad, Rocket, Upay, and card processing networks (Visa, Mastercard). These providers are contractually bound to use your data solely for the purpose of processing the relevant transaction.

5.2 Identity Verification Providers

To fulfil our KYC obligations, gw40 may share identity and address documentation with authorised third-party identity verification services. These providers are subject to strict data handling agreements and use your information solely for the purpose of completing the verification process.

5.3 Game Content Providers

Game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi deliver their game content via secure integrations with the gw40 platform. Depending on the technical architecture, minimal session data (such as a session token or stake amount) may pass through these providers' servers during active gameplay. These studios do not receive your full personal profile and are bound by data processing agreements.

5.4 Legal and Regulatory Disclosure

gw40 may disclose your personal data to competent authorities, law enforcement bodies, or regulatory agencies where required by applicable law, court order, or regulatory direction. gw40 will, where legally permitted, notify you of any such disclosure request before complying.

5.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of gw40's business, your personal data may be transferred to the successor entity. You will be notified of any such transfer via the email address associated with your account, and your data protection rights will be preserved under the new entity.

6 Cookies & Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. gw40 uses cookies and similar tracking technologies (such as local storage tokens and session identifiers) to operate the platform, maintain your logged-in session, remember your preferences, and gather anonymised analytics data about platform usage.

6.2 Categories of Cookies Used

6.3 Managing Cookies

You can manage cookie preferences through your browser settings, which allow you to block or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent you from logging into your gw40 account and using core platform features. For marketing and analytical cookies, you may update your preferences directly in your gw40 account settings or by contacting support.

7 Data Security

gw40 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes the following measures:

• TLS/SSL Encryption: All data in transit between your device and gw40's servers is protected by Transport Layer Security (TLS) encryption, the same standard used by leading financial institutions.
• Encryption at Rest: Sensitive personal data stored on gw40's servers — including identity documents and payment records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All staff with data access undergo background checks and regular security training. Access logs are maintained and reviewed periodically.
• Two-Factor Authentication: gw40 supports and strongly recommends two-factor authentication (2FA) for all player accounts to reduce the risk of unauthorised access.
• Security Monitoring: gw40 employs continuous monitoring for anomalous access patterns, intrusion attempts, and data exfiltration indicators across its infrastructure.
• Penetration Testing: Regular third-party security assessments and penetration tests are conducted to identify and remediate vulnerabilities before they can be exploited.

8 Data Retention

gw40 retains your personal data for the periods set out below. These periods reflect the legitimate operational and legal purposes for which each category of data is collected. Data that is no longer required is securely deleted or irreversibly anonymised.

Following the expiry of the applicable retention period, personal data is either permanently deleted from active systems and backups or rendered permanently anonymous such that it can no longer be linked to any identifiable individual.

9 Your Data Rights

As a gw40 player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with your full name, registered email address, and a description of your request. We will acknowledge all requests within 5 business days and aim to fulfil them within 30 days.

• Right of Access: You may request a copy of all personal data held about you by gw40, along with information about how and why it is processed.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated promptly.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations (such as AML and financial record-keeping requirements).
• Right to Restrict Processing: In certain circumstances, you may request that gw40 restrict the processing of your personal data — for example, while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request your personal data in a structured, commonly used, machine-readable format for transfer to another service provider.
• Right to Object: You have the right to object to processing carried out on the basis of gw40's legitimate interests, and to opt out of direct marketing at any time without providing a reason.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

10 Children & Minors

The gw40 platform is strictly restricted to individuals who are 21 years of age or older. gw40 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in our registration and KYC process, and any account found to belong to a minor will be immediately closed with all data and balances handled in accordance with applicable law.

If you are a parent or guardian and you believe that a person under your care has registered on the gw40 platform or provided personal data to gw40 without your knowledge or consent, please contact us immediately at [email protected]. We will investigate and take appropriate action, including the deletion of the minor's personal data, as a matter of priority.

11 International Data Transfers

gw40 operates a platform that serves players primarily in Bangladesh. Some of the third-party service providers we use — including game content studios, payment processors, and KYC verification providers — may process personal data in countries outside Bangladesh. Where such international transfers occur, gw40 ensures that appropriate safeguards are in place to protect your data, including contractual data protection clauses with the relevant third-party processors that impose obligations consistent with internationally recognised data protection standards.

gw40 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate additional safeguards. If you require further information about the safeguards applied to any specific international data transfer, please contact us at [email protected].

12 Third-Party Links

The gw40 platform may contain references or links to third-party content, including game provider interfaces and payment gateway redirects. While gw40 takes care to work only with reputable third-party partners, we do not control and are not responsible for the privacy practices of any third-party website or service that operates outside the gw40 platform. We encourage you to review the privacy policies of any third-party service you use in connection with your gw40 experience.

This Privacy Policy applies solely to personal data processed by gw40 through the gw40.im platform. It does not extend to data collected independently by third-party game studios, payment providers, or any other external services.

13 Updates to This Privacy Policy

gw40 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform features. When material changes are made, we will notify registered players via the email address associated with their account at least 7 days before the updated Policy takes effect. The "Last Updated" date at the top of this page will be revised accordingly.

If the changes are non-material — for example, corrections of typographical errors or minor clarifications that do not affect your rights — we may update the Policy without individual notification, though the "Last Updated" date will always reflect the most recent revision. We encourage you to review this Policy periodically to stay informed about how your data is protected.

Your continued use of the gw40 platform following the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you disagree with any changes, you may request account closure by contacting [email protected].

14 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way gw40 handles your personal data, please contact our dedicated support team through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 directly within your gw40 account after logging in
• Subject Line Guidance: For data rights requests, please use the subject line "Data Rights Request – [Your Registered Email]" to ensure prompt routing to our data team.
• Response Time: All privacy-related enquiries are acknowledged within 5 business days. Complex data rights requests are fulfilled within 30 days of receipt.

Our support team operates on Bangladesh Standard Time (BST, UTC+6) and provides continuous cover through a rotating shift schedule. All privacy communications are handled in strict confidence.