kxu8 Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how kxu8 ("we", "us", "our") collects, uses, stores, shares, and protects the personal information of individuals ("you", "your", "player") who access or use the kxu8 platform at kxu8.io, including all associated pages, services, and features (collectively, the "Platform").

kxu8 is committed to protecting your privacy and handling your personal data with transparency, integrity, and security. We operate primarily in Bangladesh and serve players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, and Cox's Bazar. Our data practices are designed to align with internationally recognised data protection standards.

By registering an account, making a deposit, or otherwise using the kxu8 Platform, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any part of this Policy, you must cease using the Platform.

02 Data We Collect

kxu8 collects personal data through several means: information you provide directly during registration and account management, data generated automatically through your use of the Platform, and information received from trusted third parties involved in service delivery. The categories of personal data we collect include:

2.1 Identity & Registration Data

• Full legal name as it appears on your government-issued identification document
• Date of birth (used to verify that you meet the 21+ minimum age requirement)
• Nationality and country of residence
• Username chosen at registration
• Copies of identity documents submitted for KYC verification (e.g., National ID Card, passport, driver's licence)
• Proof of address documents (e.g., utility bill, bank statement dated within 90 days)

2.2 Contact Data

• Email address (primary communication channel)
• Mobile phone number (used for account security and payment verification)
• City and district of residence within Bangladesh

2.3 Financial & Transaction Data

• Mobile Financial Service (MFS) account numbers (bKash, Nagad, Rocket, Upay) linked to your kxu8 account
• Bank account details (where bank transfer is used as a payment method)
• Transaction history: deposit amounts, withdrawal amounts, dates, and reference numbers
• Bonus and promotional credit history
• Account balance snapshots (retained for audit purposes)

2.4 Gaming & Behavioural Data

• Game session history: titles played, session duration, bet sizes, outcomes
• Sports betting history: markets wagered on, stake amounts, odds accepted, settlements
• Responsible gaming tool usage: deposit limits set, self-exclusion periods, session reminders activated
• Login timestamps and session activity logs
• Customer support interactions and complaint records

2.5 Technical & Device Data

• IP address and approximate geolocation (country and city-level)
• Device type, operating system, and browser version
• Cookies, session tokens, and similar tracking identifiers (see Section 06)
• Referring URL and on-site navigation path
• Performance metrics: page load times, error logs, crash reports

2.6 Data from Third Parties

We may receive supplementary personal data from identity verification providers, fraud detection services, and payment processors. This data is used solely to verify your identity, assess transaction risk, and comply with anti-money laundering (AML) obligations.

03 How We Use Your Data

kxu8 uses the personal data collected for the following specific and legitimate purposes:

04 Legal Basis for Processing

kxu8 processes your personal data under one or more of the following legal bases, depending on the specific purpose:

• Contractual Necessity: Processing required to perform the contract between you and kxu8 — including account creation, payment processing, game provision, and customer support.
• Legal Obligation: Processing required to comply with applicable laws — including identity verification, AML screening, and record-keeping obligations.
• Legitimate Interests: Processing based on kxu8's legitimate business interests — including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided such interests are not overridden by your rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting prior processing.

Where kxu8 relies on legitimate interests as the legal basis for processing, we conduct a balancing test to ensure that our interests do not disproportionately override your privacy rights. You may request details of this assessment by contacting [email protected].

05 Data Sharing & Disclosure

kxu8 does not sell, rent, or commercially trade your personal data to any third party. We share your data only in the circumstances described below, and only to the minimum extent necessary for each purpose:

5.1 Payment Processors

To process your deposits and withdrawals, kxu8 shares relevant account and transaction details with authorised payment partners, including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, and Sonali Bank. These partners process your data solely to facilitate your transactions and are bound by their own data protection obligations.

5.2 Game Providers

To deliver live casino games, slots, and sports betting services, kxu8 shares pseudonymised player session data (player ID, session token, bet history) with certified game providers including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe. These providers do not receive your full personal identity data and may not use session data for any purpose other than game delivery.

5.3 Identity Verification & Fraud Prevention Services

kxu8 uses third-party KYC and AML service providers to verify player identities and screen transactions for suspicious activity. These providers receive the minimum identity data necessary to conduct their checks and are contractually prohibited from using that data for any other purpose.

5.4 Legal & Regulatory Authorities

kxu8 may disclose your personal data to law enforcement agencies, regulatory bodies, financial intelligence units, or courts where we are legally required to do so, where disclosure is necessary to protect the rights, property, or safety of kxu8, our players, or the public, or where required to cooperate with an official investigation.

5.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving kxu8, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified via your registered email address in advance of any such transfer that materially affects your privacy rights.

06 Cookies & Tracking Technologies

kxu8 uses cookies, web beacons, pixel tags, local storage, and similar tracking technologies to operate the Platform effectively and improve your experience. The categories of cookies we use are as follows:

Most web browsers allow you to control cookies through their settings. You may set your browser to refuse cookies, alert you when cookies are being sent, or delete cookies already stored on your device. Note that disabling strictly necessary cookies will prevent you from accessing core Platform features including login and payment processing.

kxu8 does not use cookies to collect sensitive personal data such as financial information or identity document details outside of secure, encrypted transaction flows.

07 Data Retention

kxu8 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal, regulatory, and operational requirements. Our standard retention periods are as follows:

• Active player accounts: Personal data is retained for the duration of the account relationship plus a minimum of 5 years following account closure, to satisfy AML record-keeping obligations.
• KYC and identity documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later.
• Transaction records: Financial transaction logs are retained for a minimum of 7 years to comply with financial record-keeping requirements.
• Customer support records: Interaction logs and complaint records are retained for 3 years from the date of the last interaction.
• Marketing consent records: Consent records and opt-out logs are retained for 3 years from the date of the consent action.
• Technical logs (IP, device, session): Retained for 12 months from the date of collection for security and fraud investigation purposes.

When personal data is no longer required for any applicable retention purpose, kxu8 will securely delete or anonymise it such that it can no longer be linked to an individual player.

08 Data Security

kxu8 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• Transport Layer Security (TLS 1.3): All data transmitted between your device and the kxu8 Platform is encrypted using industry-standard TLS 1.3 protocol, ensuring that data in transit cannot be intercepted or read by third parties.
• At-Rest Encryption: Personal data stored on kxu8 servers is encrypted at rest using AES-256 encryption standards.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All kxu8 staff and contractors with access to personal data are required to undergo background screening and regular data protection training.
• Multi-Factor Authentication: Administrative access to systems containing personal data requires multi-factor authentication (MFA). Players are also encouraged to enable any available account security features.
• Penetration Testing: kxu8 conducts regular third-party security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response Plan: kxu8 maintains a documented data breach response procedure. In the event of a confirmed breach affecting player data, impacted players will be notified within 72 hours of our becoming aware of the incident.

09 Your Rights

As a kxu8 player, you have the following rights in relation to your personal data. These rights may be subject to certain legal limitations, which we will explain if they apply to your specific request:

• Right of Access: You have the right to request a copy of the personal data kxu8 holds about you, along with information about how it is processed. We will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Contact support with the specific inaccuracy and supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request that kxu8 delete your personal data where it is no longer necessary for the purposes it was collected, where you withdraw consent, or where processing is unlawful. This right does not apply where retention is required by law (e.g., AML records).
• Right to Restrict Processing: You have the right to request that kxu8 restricts the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request your personal data in a structured, machine-readable format suitable for transfer to another provider.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling for marketing purposes. Where you object to marketing, we will cease that processing immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". Please include your registered username and a description of the specific right you wish to exercise. We may need to verify your identity before processing the request. We aim to respond within 30 days; complex requests may take up to 90 days, in which case we will notify you of the extension.

10 Children & Minors

The kxu8 Platform is strictly intended for adults aged 21 and above. kxu8 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in the account registration process, and kxu8 reserves the right to request supporting documentation to confirm a player's age at any time.

If kxu8 discovers or is notified that an account has been registered by a person under 21, we will:

• Immediately suspend and permanently close the account.
• Void all gaming activity and forfeit any balance associated with the account.
• Delete all personal data associated with the underage account as soon as practicable, subject to any legal retention obligations.

11 International Data Transfers

kxu8 primarily stores and processes player data on servers located in secure data centres within the Asia-Pacific region. However, some of our trusted service providers — including game providers such as Pragmatic Play, Evolution Gaming, and NetEnt, as well as identity verification and fraud prevention partners — may process your data in jurisdictions outside Bangladesh.

Where personal data is transferred internationally, kxu8 takes appropriate safeguards to ensure that your data receives a level of protection consistent with this Privacy Policy, including:

• Entering into contractual agreements with receiving parties that include standard data protection clauses.
• Ensuring that recipient organisations maintain security standards equivalent to or exceeding those applied by kxu8.
• Transferring only the minimum data necessary for the specific service being provided by the international partner.

By using the kxu8 Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Bangladesh as described in this section, subject to the safeguards outlined above.

12 Third-Party Links

The kxu8 Platform may contain references to third-party services, game providers, and payment partners. While kxu8 takes care to work only with reputable partners, we are not responsible for the privacy practices or content of any third-party website, application, or service that is not directly operated by kxu8.

If you navigate to a third-party platform — for example, a game provider's own website or your bKash mobile app — that platform's own privacy policy will govern how your data is handled. We encourage you to review the privacy policies of any third-party service you interact with.

13 Policy Updates

kxu8 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or business operations. When we make material changes to this Policy, we will:

• Update the "Last Updated" date displayed at the top of this page.
• Send an email notification to all registered players at their registered email address, summarising the key changes and providing a link to the revised Policy.
• Display a prominent notice on the kxu8 Platform for a period of at least 30 days following the update.

Your continued use of the kxu8 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you must stop using the Platform and may request account closure by contacting our support team.

We recommend reviewing this Privacy Policy periodically to stay informed about how kxu8 protects your personal data. The version number and effective date at the top of this document indicate the most current version.

14 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or kxu8's handling of your personal data, please contact our Data Protection team using the details below:

We take all privacy complaints seriously. Upon receiving your complaint, we will:

• Acknowledge receipt of your complaint within 3 business days.
• Investigate the matter thoroughly and in good faith.
• Provide a written response detailing our findings and any remedial action taken within 30 days (extendable to 90 days for complex cases).

If you are dissatisfied with kxu8's response to your privacy complaint, you retain the right to escalate the matter to the relevant data protection authority or seek independent legal advice. kxu8 cooperates fully with legitimate regulatory enquiries.