Privacy Policy — How gol1x Keeps Your Data Safe

This Privacy Policy applies to all users of the gol1x platform accessible at gol1x.app. It governs the collection, use, storage, disclosure, and protection of personal data by gol1x ("we", "us", "our") in connection with the operation of our online casino and sports betting services. Please read this document carefully. If you do not agree with any part of this Privacy Policy, you should discontinue use of the gol1x platform.

This policy should be read together with our Terms & Conditions and Responsible Gaming Policy, both of which form part of the overall agreement between you and gol1x.

1. Data We Collect

gol1x collects personal data from you in three primary ways: data you provide directly during registration and account activity, data collected automatically through your use of the platform, and data obtained from third-party service providers such as payment processors and KYC verification partners.

1.1 Data You Provide Directly

The following categories of personal data are collected directly from you when you register an account, complete KYC verification, make deposits or withdrawals, or contact our support team:

Data Category	Specific Data Points	When Collected
Identity Data	Full legal name, date of birth, gender, nationality	Account registration and KYC verification
Contact Data	Email address, mobile number, residential address	Account registration
Identity Documents	National ID (NID) scan, passport, driving licence	KYC verification before first withdrawal
Financial Data	bKash / Nagad / Rocket account number, bank account details, transaction history	Deposit and withdrawal processing
Account Credentials	Username, hashed password (never stored in plain text)	Account registration
Support Communications	Email content, chat transcripts, complaint records	When you contact gol1x support

1.2 Data Collected Automatically

When you access the gol1x platform, certain technical and behavioural data is collected automatically by our systems. This data does not typically identify you personally on its own but may be combined with other data we hold. Automatically collected data includes:

• Device and browser data: IP address, device type, operating system, browser version, screen resolution, and language settings.
• Usage data: Pages visited, time spent on each page, games played, bets placed, session duration, navigation paths, and feature interactions.
• Location data: Country and approximate city-level location derived from your IP address. We do not collect precise GPS coordinates.
• Log data: Server access logs, error logs, and security event logs generated during your use of the platform.

1.3 Data from Third Parties

gol1x may receive personal data about you from the following categories of third-party sources:

• Payment processors: Transaction confirmation data, payment status, and fraud flags from bKash, Nagad, Rocket, Upay, Visa, Mastercard, and partner banks.
• KYC verification partners: Identity verification results and document authenticity assessments from third-party identity verification service providers.
• Anti-fraud services: Risk scores and suspicious activity indicators from third-party fraud prevention platforms used to protect the integrity of the gol1x platform.

2. How We Use Your Data

gol1x processes your personal data only for legitimate, defined purposes. We do not use your data for any purpose that is incompatible with the reason it was originally collected. The following table summarises our processing activities and their legal basis.

Purpose	Data Used	Legal Basis
Account creation and management	Identity data, contact data, credentials	Performance of contract
Age and identity verification (KYC)	Identity documents, identity data	Legal obligation / legitimate interest
Processing deposits and withdrawals	Financial data, identity data	Performance of contract
Fraud prevention and AML compliance	Financial data, usage data, device data	Legal obligation / legitimate interest
Responsible gaming monitoring	Usage data, account data, self-exclusion flags	Legal obligation / legitimate interest
Customer support	Contact data, support communications	Performance of contract
Platform improvement and analytics	Usage data, device data, log data	Legitimate interest
Marketing and promotions (with consent)	Contact data, account preferences	Consent

2.1 Marketing Communications

gol1x may send you promotional emails, SMS messages, or in-platform notifications about new games, bonuses, and seasonal promotions relevant to the Bangladesh market — for example, special offers tied to the BPL cricket season, Eid promotions, or Pohela Boishakh bonuses. We will only send marketing communications where you have given your explicit consent to receive them, either during registration or subsequently through your account preferences panel.

You may withdraw your consent to receive marketing communications at any time by updating your notification settings in your gol1x account or by contacting our support team. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal, and it does not affect service-related communications such as transaction confirmations, security alerts, or policy update notices.

3. Data Sharing and Disclosure

gol1x does not sell your personal data. We do not share your personal data with third parties except in the limited circumstances described in this section. In every case where data is shared, we apply appropriate contractual safeguards to ensure your data is handled with the same standard of care that gol1x itself applies.

3.1 Service Providers

We share personal data with carefully selected third-party service providers who assist in the operation of the gol1x platform. These providers are permitted to use your data only for the specific purpose for which it was shared and are contractually prohibited from using it for any other purpose. Service provider categories include:

• Payment processing partners (bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, City Bank) — to process your deposits and withdrawals.
• KYC and identity verification providers — to verify your age and identity as required before processing withdrawals.
• Anti-fraud and AML compliance platforms — to detect and prevent fraudulent transactions and money laundering activity.
• Cloud hosting and infrastructure providers — to store platform data on secure, encrypted servers.
• Customer support software providers — to manage and track support tickets and chat communications.
• Analytics platform providers — to understand aggregate platform usage patterns and improve the user experience. Analytics data is processed in anonymised or pseudonymised form wherever possible.

3.2 Legal and Regulatory Disclosure

gol1x may disclose your personal data to law enforcement agencies, regulatory authorities, or other government bodies where we are required to do so by applicable law, court order, or regulatory directive. We will notify you of any such disclosure where we are legally permitted to do so. Where notification is legally prohibited, we will limit the scope of disclosure to the minimum information required to comply with the relevant legal obligation.

3.3 Business Transfers

In the event that gol1x undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the acquiring entity as part of that transaction. In such circumstances, you will be notified of the transfer and the identity of the new data controller via the email address registered to your account, and the acquiring entity will be required to honour the terms of this Privacy Policy.

4. Cookies and Tracking Technologies

gol1x uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain your login session, and gather aggregate analytics data. This section explains what cookies we use and how you can manage them.

4.1 Types of Cookies Used

• Strictly Necessary Cookies: These cookies are essential for the gol1x platform to function. They maintain your login session, remember your language and currency preferences, and enable core security features. These cookies cannot be disabled without affecting platform functionality.
• Performance and Analytics Cookies: These cookies collect anonymised data about how players use the gol1x platform — which pages are visited most frequently, how long sessions last, and where errors occur. This data is used to improve platform performance and user experience. We do not use this data to identify individual users.
• Functional Cookies: These cookies remember choices you make on the platform — such as your preferred game category, notification settings, and display preferences — to provide a more personalised experience on subsequent visits.
• Security Cookies: These cookies help gol1x detect and prevent fraudulent account activity, including session hijacking, credential stuffing, and suspicious login attempts from unrecognised devices.

4.2 Managing Cookies

You can manage cookie preferences through your web browser settings. Most modern browsers allow you to view, delete, and block cookies on a per-site basis. Please be aware that disabling strictly necessary cookies will impair your ability to use the gol1x platform — in particular, you may be unable to maintain a logged-in session or access certain features. Instructions for managing cookies in the most commonly used browsers are available in each browser's help documentation.

gol1x does not use cross-site tracking cookies, fingerprinting scripts, or any tracking technology designed to follow your activity across websites and platforms other than gol1x.app itself.

5. Data Security Measures

gol1x implements a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our security framework includes the following measures:

• Transport Layer Security (TLS): All data transmitted between your device and the gol1x platform is encrypted in transit using TLS 1.2 or higher. You can verify this via the padlock icon in your browser's address bar when visiting gol1x.app.
• Data encryption at rest: Personal data stored on gol1x servers — including identity documents, payment details, and account credentials — is encrypted using AES-256 encryption.
• Password hashing: Account passwords are never stored in plain text. They are processed through an industry-standard cryptographic hashing algorithm with a unique salt applied per account before storage.
• Access controls: Internal access to personal data systems is governed by role-based access control (RBAC). Only staff members with a specific operational need are granted access to personal data, and all access events are logged and auditable.
• Network security: The gol1x platform is hosted behind enterprise-grade firewalls and intrusion detection systems. Regular penetration testing and vulnerability assessments are conducted to identify and remediate security risks.
• Incident response: gol1x maintains a data breach response procedure. In the event of a confirmed personal data breach that poses a risk to affected individuals, gol1x will notify affected players without undue delay and will take all technically feasible steps to contain and remediate the breach.

6. Data Retention and Deletion

gol1x retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected, to comply with applicable legal and regulatory obligations, and to resolve any disputes that may arise. The following retention periods apply to the main categories of personal data held by gol1x:

Data Category	Retention Period	Reason
Account and identity data	Duration of account + 5 years after closure	AML and regulatory compliance
KYC identity documents	Duration of account + 5 years after closure	Legal obligation and fraud prevention
Transaction and financial records	7 years from transaction date	Financial record-keeping requirements
Support communications	3 years from last interaction	Dispute resolution and service improvement
Marketing preferences and consent records	Until consent is withdrawn + 1 year	Evidence of lawful processing
Analytics and usage data	Up to 24 months (in anonymised form)	Platform performance analysis

6.1 Account Deletion Requests

You may request the deletion of your gol1x account and associated personal data at any time by contacting support. Upon receiving a deletion request, gol1x will close your account and delete or anonymise personal data that is no longer required for legal or regulatory purposes. Please note that data subject to mandatory retention periods — particularly KYC documents and financial transaction records — cannot be deleted before the applicable retention period expires, even at your request. gol1x will inform you of which data has been deleted and which data is being retained under a legal obligation at the time your request is processed.

7. Your Privacy Rights

As a gol1x player, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request. gol1x will acknowledge your request within 48 hours and aim to provide a substantive response within 30 days.

• Right of Access: You have the right to request a copy of the personal data that gol1x holds about you, along with information about how that data is being used.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account details (such as your email address or contact number) directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to mandatory legal retention periods as described in Section 6.
• Right to Restriction of Processing: In certain circumstances, you have the right to request that gol1x restrict the processing of your personal data — for example, while a dispute about the accuracy of that data is being resolved.
• Right to Data Portability: Where your data is processed on the basis of consent or contract and by automated means, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where that processing is based on legitimate interests — including profiling for responsible gaming monitoring purposes. gol1x will review and respond to all objections on a case-by-case basis.
• Right to Withdraw Consent: Where gol1x processes your data on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

8. Contact and Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way gol1x handles your personal data, please contact our support team:

• Email: [email protected] (plain text — not a clickable link)
• Response time: We aim to acknowledge all privacy-related enquiries within 48 hours and provide a full response within 30 days.
• Language: All support communications are handled in English.

8.1 Policy Updates

gol1x reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or platform features. When material changes are made, we will notify registered players by email and display a prominent notice on the gol1x platform. The "Last updated" date at the top of this document indicates when the most recent revision was made. We encourage you to review this Privacy Policy each time you visit gol1x.app to stay informed about how we protect your data.

Your continued use of the gol1x platform after any update to this Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any change, you should cease using the platform and contact support to request account closure and data deletion in accordance with Section 6.