good22 Privacy Policy

good22 collects personal data through the following channels:

• Direct interactions: Data you voluntarily provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or submitting feedback.
• Automated technologies: As you navigate the good22 platform, we automatically collect Technical Data and Usage Data via cookies, server logs, and similar tracking technologies.
• Third-party sources: We may receive data about you from payment processors (bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank), identity verification providers, and fraud prevention agencies where permitted by applicable law.
• Publicly available sources: In certain cases, we may verify information against publicly available records for KYC or fraud prevention purposes.

We collect only the minimum amount of personal data necessary for each stated purpose and do not retain data for longer than is required.

good22 processes your personal data for the following purposes, each grounded in a lawful basis:

• Account management: To create, maintain, and administer your good22 player account, including password resets and account security notifications.
• Transaction processing: To handle deposits, withdrawals, and bonus crediting accurately and securely through bKash, Nagad, Rocket, and other supported payment methods.
• KYC and age verification: To confirm that all players are at least 21 years of age and are who they claim to be, as part of our responsible gaming obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, money laundering, and unauthorised account access.
• Customer support: To respond to your enquiries, resolve disputes, and improve our support processes based on interaction history.
• Responsible gaming: To monitor gaming behaviour for signs of problem gambling and to enforce deposit limits, cool-off periods, and self-exclusion requests.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates where you have provided explicit consent. You may withdraw this consent at any time.
• Legal compliance: To fulfil our obligations under applicable laws, regulations, and lawful requests from government or regulatory bodies.
• Platform improvement: To analyse usage patterns and player feedback in order to enhance the functionality, performance, and content of the good22 platform.

good22 does not sell, rent, or trade your personal data to any third party for marketing purposes. We may share your data with the following categories of recipients only where strictly necessary:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank receive the minimum financial data necessary to process your transactions.
• Game providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) may receive anonymised session data for game integrity and technical purposes. They do not receive your full identity or financial data.
• Identity verification providers: Specialist KYC and anti-money-laundering service providers may receive identity documents and personal data solely to verify your identity and comply with applicable regulations.
• Legal and regulatory authorities: We will disclose personal data to law enforcement, courts, or regulatory authorities where required to do so by law, or where we reasonably believe disclosure is necessary to protect the rights or safety of any person.
• IT and security service providers: Trusted technology partners who support the operation of our platform infrastructure under strict data processing agreements.

All third parties with whom we share data are required to implement appropriate technical and organisational security measures and are prohibited from using your data for any purpose beyond that for which it was shared.

good22 uses cookies and similar tracking technologies to enhance your experience, maintain session security, and gather aggregate analytics data. The types of cookies we use are as follows:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, security identifiers, and load-balancing cookies. They cannot be disabled.
• Functional cookies: Remember your preferences such as language selection and last visited game category to provide a more personalised experience.
• Analytics cookies: Collect anonymised data about how users interact with the platform — pages visited, session duration, and error events — to help us improve performance. We use only privacy-respecting analytics tools that do not share data with advertising networks.

You may adjust cookie preferences through your browser settings at any time. Disabling certain cookies may affect the functionality of the good22 platform.

good22 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention guidelines are as follows:

• Active account data: Retained for the duration of your account relationship with good22.
• Transaction records: Retained for a minimum of 5 years from the date of the transaction to comply with financial record-keeping obligations.
• KYC and identity documents: Retained for a minimum of 5 years following account closure, in line with anti-money-laundering requirements.
• Support communications: Retained for up to 3 years after the resolution of the relevant enquiry or dispute.
• Marketing consent records: Retained for 3 years from the date of consent, or until consent is withdrawn, whichever is earlier.
• Technical and usage logs: Typically anonymised or deleted within 12 months of collection, unless retained for active security investigations.

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to an individual.

As a good22 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact us at [email protected] with your account details and a clear description of your request.

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of any inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restrict processing: Request that we limit the processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Right to data portability: Request a machine-readable copy of the personal data you have provided to us, where technically feasible.
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to object: Object to processing of your data for direct marketing purposes or where processing is based on our legitimate interests.

We will respond to all data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

good22 operates servers and infrastructure in jurisdictions that may differ from Bangladesh. Where your personal data is transferred outside Bangladesh, we ensure that appropriate safeguards are in place to protect your data to at least the same standard as required under applicable Bangladeshi data protection principles. These safeguards include contractual protections with all data processors and transfers only to jurisdictions with recognised data protection frameworks.

Transfers to third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi) are limited to anonymised or pseudonymised technical data where possible, minimising the exposure of personally identifiable information.

good22 implements robust technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data at rest, including financial information and identity documents.
• Role-based access controls ensuring that only authorised personnel with a legitimate need can access specific categories of personal data.
• Regular penetration testing and security audits conducted by independent third-party specialists.
• Automated anomaly detection systems that flag unusual account activity or access patterns in real time.
• Two-factor authentication (2FA) available to all players via SMS for an additional layer of account security.

Despite these measures, no internet-based service can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, good22 will notify affected players within a reasonable timeframe and take immediate remediation steps.

good22 reserves the right to amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify registered players via email or in-platform notification.

Your continued use of the good22 platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed of how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or the personal data good22 holds about you, please contact our data support team. All privacy-related correspondence should be directed to:

• Email: [email protected] (plain text — not a clickable link)
• Response time: Within 5 business days for general enquiries; within 30 calendar days for formal data rights requests (Bangladesh Standard Time, UTC+6).

We treat all privacy enquiries with the strictest confidence and will only discuss account-specific information with the verified account holder.