Privacy Policy — How xkx8 Collects, Uses, and Protects Your Data

This Privacy Policy ("Policy") describes how xkx8 ("xkx8", "we", "us", "our"), the operator of the online casino and sports betting platform at https://xkx8.io ("Platform"), collects, processes, stores, and protects personal data relating to individuals who visit, register on, or otherwise interact with the Platform ("you", "your", "Player"). This Policy is incorporated by reference into the xkx8 Terms & Conditions and should be read alongside that document.

By creating an account on xkx8 or by continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

1 Introduction

xkx8 is committed to handling your personal information with transparency, care, and respect. We recognise that players in Bangladesh place considerable trust in us when they share their personal details, payment information, and account activity with our Platform. This Policy is our formal commitment to explaining how that trust is maintained.

xkx8 acts as the data controller for all personal data collected through the Platform. This means we are responsible for determining why and how your personal data is processed. In cases where we engage third-party service providers to assist with payment processing, fraud detection, identity verification, or game delivery, those parties act as data processors operating under contractual obligations to handle your data only as instructed by xkx8 and only to the extent necessary for the specific service they provide.

This Policy applies to all data collected through the xkx8 website (https://xkx8.io), any associated mobile-optimised interfaces, and all communications between you and the xkx8 support team. It does not apply to third-party websites linked from the xkx8 Platform — those websites operate under their own independent privacy policies.

2 Data We Collect

2.1 Registration Data

When you create an account on xkx8, we collect the following personal data:

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (to verify you are 21 years of age or older)
• Current residential address, including city (e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or Cox's Bazar) and postal code
• Email address (used for account communications and security alerts)
• Mobile phone number registered in your own name (used for SMS OTP two-factor authentication)
• Username and hashed password (we never store your password in plain text)

2.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) programme, we may collect and store copies of the following documents:

• National Identity Card (NID) — front and back
• Passport (biographical data page)
• Driving licence (where applicable)
• Proof of payment method ownership — for example, a screenshot of your registered bKash or Nagad account showing your name, mobile number, and account status
• Selfie or live photo for facial comparison with identity document (where required for enhanced verification)

2.3 Financial Transaction Data

We collect records of all financial transactions processed through your xkx8 account, including:

• Deposit amounts, timestamps, and payment method references (bKash transaction IDs, Nagad references, Rocket references, Upay references, Visa/Mastercard last-four digits)
• Withdrawal requests, amounts, destination payment account references, and processing status
• Bonus credits claimed, wagering activity, and bonus balance history
• Account balance history and running transaction ledger

xkx8 does not store full card numbers, CVV codes, or mobile banking PINs. Payment credentials are transmitted directly to our payment processing partners via encrypted connections and are not retained on xkx8 servers.

2.4 Gaming and Betting Activity Data

We maintain detailed records of your gaming and betting activity on the Platform, including game session logs, bet amounts, game round IDs, outcomes, and session duration. This data is retained for fair play auditing, dispute resolution, and responsible gaming monitoring purposes.

2.5 Technical and Device Data

When you access the Platform, we automatically collect certain technical data, including:

• IP address and approximate geographic location derived from IP
• Device type, operating system, and browser version
• Session timestamps and page navigation paths
• Referral source (the URL or channel through which you arrived at xkx8)

2.6 Communications Data

We retain records of all communications between you and the xkx8 support team, including email correspondence, live chat transcripts, and any documents or screenshots you submit as part of a support or dispute resolution request.

3 How We Use Your Data

xkx8 uses the personal data we collect for the following purposes:

Purpose	Data Categories Used
Creating and managing your xkx8 account	Registration data, KYC data
Processing deposits and withdrawals	Financial transaction data, KYC data
Verifying your identity and age (21+)	KYC data, registration data
Detecting and preventing fraud, money laundering, and account abuse	All categories, including technical and device data
Providing customer support and resolving disputes	Registration data, gaming activity, communications data
Delivering and personalising promotions and bonuses	Registration data, gaming activity, transaction data
Responsible gaming monitoring and intervention	Gaming activity, session data, transaction data
Sending account security alerts and service notifications	Registration data (email, phone)
Improving Platform performance and user experience	Technical data, session navigation data
Complying with applicable legal and regulatory obligations	All categories as required

xkx8 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review. Where automated tools are used in fraud detection or responsible gaming monitoring, a member of our compliance team reviews flagged cases before any material action (such as account suspension) is taken.

4 Legal Basis for Processing

xkx8 processes your personal data on one or more of the following recognised legal bases:

• Contractual necessity: Processing required to perform the contract between you and xkx8 (your account agreement and these Terms), including account creation, payment processing, and game delivery.
• Legitimate interests: Processing necessary for xkx8's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided those interests are not overridden by your privacy rights.
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and KYC obligations.
• Consent: For non-essential communications such as promotional newsletters or marketing messages — where we rely on consent, you may withdraw it at any time by contacting [email protected].

5 Sharing Your Data

5.1 Payment Processing Partners

To process deposits and withdrawals through bKash, Nagad, Rocket, Upay, Visa, and Mastercard, xkx8 shares the minimum necessary payment and identity data with those payment networks and their technical intermediaries. These partners are contractually bound to process your data solely for the purpose of completing the transaction and are prohibited from using it for any other purpose.

5.2 Identity Verification Providers

Where xkx8 engages a third-party KYC verification provider to assist with document authentication or facial comparison, your KYC documents and associated data are shared with that provider under a data processing agreement that restricts their use of the data exclusively to the verification task.

5.3 Game Technology Providers

Game studios and RNG platform providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — may receive session-level identifiers to manage game round integrity and RTP auditing. These providers do not receive your full personal profile; they receive only the data strictly necessary to operate the game session.

5.4 Legal and Regulatory Disclosures

xkx8 may disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities where we are compelled to do so by applicable law, court order, or regulatory direction. We will disclose only the minimum data required to satisfy the legal obligation and, where permitted, will notify you of such a disclosure.

5.5 No Sale of Personal Data

xkx8 does not sell, rent, lease, or otherwise commercially transfer your personal data to any third party for their own independent use. This prohibition applies without exception — including to advertising networks, data brokers, and affiliate marketing networks.

6 Data Retention

xkx8 retains personal data for as long as it is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law. The following general retention periods apply:

• Active account data (registration, KYC, transaction records): Retained for the full duration of your account relationship with xkx8, plus a minimum of 5 years following account closure.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, in compliance with standard financial record-keeping obligations.
• Gaming and betting session logs: Retained for a minimum of 3 years from the date of each session, for fair play audit and dispute resolution purposes.
• Support and communications data: Retained for 3 years from the date of the most recent communication in a support thread.
• Marketing consent records: Retained for 3 years from the date of consent or withdrawal of consent, whichever is later.
• Technical and device logs: Retained for 12 months on a rolling basis, unless a specific session is flagged for security or fraud review, in which case the relevant log is retained for the duration of the investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

7 Data Security

xkx8 implements a multi-layered approach to data security designed to protect your personal information from unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security measures include, but are not limited to:

• Encryption in transit: All data transmitted between your browser or device and xkx8 servers is protected using TLS 1.2 or higher (256-bit SSL encryption). This applies to all pages of the Platform, including account registration, login, cashier, and game pages.
• Encryption at rest: Sensitive personal data stored in xkx8 databases — including identity documents and payment references — is encrypted at rest using industry-standard encryption algorithms.
• Password hashing: Account passwords are stored exclusively as one-way cryptographic hashes using bcrypt or equivalent. xkx8 staff cannot retrieve your plain-text password under any circumstances.
• Two-factor authentication (2FA): xkx8 supports SMS OTP-based two-factor authentication for account login, which we strongly encourage all players to enable.
• Access controls: Internal access to player personal data is restricted on a strict need-to-know basis. xkx8 staff access to production data is logged, monitored, and subject to regular access review.
• Vulnerability management: xkx8 conducts regular security assessments of the Platform infrastructure and applies security patches on a documented schedule.

Despite these measures, no internet-based system can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, xkx8 will notify affected players by email to the registered address as promptly as practicable, and will take all reasonable steps to contain and remediate the breach.

8 Cookies & Tracking Technologies

xkx8 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device by a website you visit. Cookies serve a variety of functions on the xkx8 Platform, which are described below.

8.1 Types of Cookies We Use

• Essential Strictly necessary cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged in during a game session, security tokens that prevent cross-site request forgery (CSRF), and load-balancing cookies. These cookies cannot be disabled without breaking core Platform functionality.
• Functional Functional cookies: Enable enhanced features such as remembering your preferred language, game lobby display settings, and responsible gaming tool preferences. Disabling these cookies will not break the Platform but may reduce your experience quality.
• Analytics Analytics cookies: Used to collect anonymised data about how players navigate and use the Platform, including page visit counts, time on page, and error rates. This data is used solely to improve Platform performance and is not linked to your personal profile.

8.2 What We Do Not Use

xkx8 does not use advertising cookies, tracking pixels from third-party ad networks, or any technology designed to track your browsing behaviour across other websites for the purpose of serving targeted advertisements. We do not share cookie-derived behavioural data with data brokers or marketing platforms.

8.3 Managing Cookies

You can manage, restrict, or delete cookies at any time through your browser's privacy settings. Instructions for managing cookies in common browsers (Chrome, Firefox, Safari, Edge) are available in those browsers' respective help centres. Please note that disabling strictly necessary cookies will prevent you from logging in to your xkx8 account and will disrupt game session functionality.

9 Your Privacy Rights

As a player on the xkx8 Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request" and include your registered account email and full name for verification. xkx8 will respond within 7 business days.

• Right of Access: You have the right to request a copy of all personal data that xkx8 holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any personal data that is inaccurate or incomplete. Some data fields (such as your legal name or date of birth) may require submission of updated identity documents for correction.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data. This right is subject to exceptions where retention is required by applicable law (for example, financial transaction records held for AML compliance). Where erasure is not possible in full, we will inform you of which data must be retained and why.
• Right to Restriction of Processing: You may request that xkx8 restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: You may request an export of the personal data you have provided to xkx8 in a structured, commonly used, machine-readable format (such as JSON or CSV), so that you may transfer it to another service if you choose.
• Right to Object: You may object to the processing of your personal data where that processing is based on xkx8's legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

10 Minors & Age Restriction

The xkx8 Platform is strictly restricted to individuals who are 21 years of age or older. xkx8 does not knowingly collect personal data from any individual under the age of 21. We apply age verification checks at registration and, where our KYC review identifies that an account holder is under 21, we immediately close that account and securely delete the associated personal data, with the exception of a minimal record retained solely for compliance documentation purposes.

If you have reason to believe that a person under the age of 21 has registered an account on xkx8 using false information, please notify us immediately at [email protected]. We take underage gambling extremely seriously and will investigate all such reports promptly.

11 Third-Party Services

The xkx8 Platform integrates with a number of third-party service providers to deliver a fully functional online casino and sports betting experience. These include game content providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi), payment network processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard), and technical infrastructure providers (hosting, CDN, and security services).

Each third-party service provider that processes personal data on behalf of xkx8 does so under a written data processing agreement that obliges them to: process data only on xkx8's documented instructions; implement appropriate technical and organisational security measures; not engage sub-processors without xkx8's prior authorisation; and delete or return data upon termination of the service relationship.

xkx8 conducts due diligence on third-party processors prior to engagement and reviews these relationships periodically to ensure continued compliance with this Policy.

12 International Data Transfers

xkx8 is a platform designed for and primarily serving the Bangladesh market. The majority of data processing takes place on servers located within the Asia-Pacific region. In some cases, technical service providers (such as CDN providers or cloud infrastructure partners) may process data on servers located in other regions, including Europe or North America.

Where personal data is transferred to a jurisdiction outside Bangladesh, xkx8 ensures that appropriate safeguards are in place to protect that data, including contractual clauses that require the receiving party to process the data in a manner consistent with the standards set out in this Policy. xkx8 does not transfer personal data to jurisdictions known to have inadequate data protection standards without appropriate contractual protections in place.

13 Changes to This Policy

xkx8 reserves the right to update or replace this Privacy Policy at any time. When material changes are made, we will notify registered players by sending an email to the registered account address and by displaying a prominent notice on the Platform for a minimum of 7 days prior to the updated Policy taking effect.

The "Last Updated" date at the top of this document will always reflect the date of the most recent revision. We recommend reviewing this Policy periodically. Continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree to the revised Policy, you should close your account before the effective date.

Archived versions of previous Privacy Policies are available upon request by contacting [email protected] with the subject line "Previous Privacy Policy Request".

14 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way xkx8 handles your personal data, please contact our support team:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line: "Privacy Policy Enquiry" or "Privacy Rights Request"
• Support Hours: 24/7, Bangladesh Standard Time (UTC+6)
• Response Time: Within 2 business days for acknowledgement; within 7 business days for substantive response
• Language: English

xkx8 takes all privacy complaints seriously. Upon receiving a formal complaint, we will acknowledge receipt, investigate thoroughly, and provide a written response outlining the outcome and any remedial action taken. If you are not satisfied with our response to your complaint, you may escalate the matter through any dispute resolution mechanism available under applicable law in your jurisdiction.