kbx8 Privacy
Policy & Data Rights

kbx8 is an online casino and sports betting platform operated for the Bangladesh market. We are committed to handling all personal data we collect with transparency, integrity, and respect for your privacy. This Policy applies to all personal information processed in connection with your use of kbx8.io and any associated applications or services.

Personal data means any information that identifies or can reasonably identify a living natural person. This includes direct identifiers such as your full name, mobile number, and national ID number, as well as indirect identifiers such as your device identifier, IP address, and account username when these can be linked to your identity.

kbx8 acts as the data controller in respect of personal data collected directly from you through the platform. Where kbx8 engages third-party service providers to process data on its behalf — such as payment processors, identity verification services, and analytics providers — those parties act as data processors under kbx8's instruction and are bound by contractual data protection obligations.

kbx8 collects personal data through several channels: directly from you when you register and use the platform, automatically through your use of the platform via cookies and technical logging, and from third-party sources such as identity verification services and payment providers.

The following table summarises the categories of personal data we collect and the primary source of each category:

kbx8 uses personal data only for defined, legitimate purposes. We do not use personal data for purposes that are incompatible with the original reason for collection without first obtaining your explicit consent or establishing a separate legal basis.

• Account creation and management: Processing your registration, maintaining your account profile, authenticating your identity at login, and managing account settings including responsible gaming preferences.
• Transaction processing: Handling deposits and withdrawal requests via bKash, Nagad, Rocket, and Upay; verifying transaction amounts; preventing payment fraud; and maintaining accurate financial records in BDT.
• Identity verification (KYC): Verifying that you meet the minimum age requirement of 21 years, confirming your identity to prevent fraud, and complying with anti-money laundering and counter-terrorism financing obligations.
• Game and betting services: Providing access to casino games, sports betting markets including BPL cricket and esports, processing wager outcomes, and awarding bonus credits in accordance with applicable promotion terms.
• Customer support: Responding to your queries, complaints, and account requests submitted via live chat, email, or support ticket; maintaining records of support interactions for quality assurance.
• Security and fraud prevention: Monitoring account activity for unusual patterns, detecting bot usage, identifying multi-account abuse, and investigating suspected fraudulent or prohibited conduct as defined in our Terms & Conditions.
• Platform improvement: Using anonymised and aggregated usage data to understand how players interact with the platform, identify popular game categories, and improve the overall user experience for Bangladeshi players.
• Marketing communications (opt-in only): Sending promotional emails, SMS notifications, and bonus alerts to players who have opted in to receive marketing communications during registration or subsequently. You may opt out at any time.
• Responsible gaming compliance: Monitoring player behaviour for signs of problem gambling, enforcing self-exclusion requests, applying deposit limits, and complying with responsible gaming obligations.

kbx8 processes your personal data under the following legal bases, depending on the purpose and nature of the processing activity:

• Contractual necessity: Processing required to fulfil our obligations to you under the Terms & Conditions — including running your account, processing deposits and withdrawals, and delivering gaming services.
• Legal obligation: Processing required to comply with applicable laws, including identity verification, age verification (21+ minimum), financial crime prevention, and record-keeping obligations.
• Legitimate interests: Processing necessary for kbx8's legitimate interests in fraud prevention, platform security, abuse detection, and product improvement, where such interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — including sending marketing communications and placing non-essential cookies on your device. You may withdraw consent at any time without affecting the lawfulness of prior processing.

kbx8 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your personal data only in the following limited circumstances, and always in a manner consistent with this Policy:

• Payment processors: bKash, Nagad, Rocket, and Upay receive the minimum personal and transactional data necessary to process your deposit or withdrawal requests. These providers operate under their own privacy policies and are required to handle data securely.
• Identity verification providers: Third-party KYC and age verification services receive copies of identity documents and related data when you are required to complete identity verification. These providers are contractually bound to use the data solely for verification purposes.
• Game studio providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive anonymised session identifiers and game round data necessary to deliver their game content. These providers do not receive your personal identity data.
• Fraud and security services: We may share technical data including IP addresses and device fingerprints with specialist fraud prevention and cybersecurity partners to protect the integrity of the platform.
• Legal and regulatory authorities: kbx8 will disclose personal data to law enforcement agencies, regulatory bodies, or other authorities where required to do so by applicable law, court order, or regulatory directive. We will notify you of any such disclosure where legally permitted to do so.
• Business transfers: In the event that kbx8 undergoes a merger, acquisition, restructuring, or sale of assets, personal data held by kbx8 may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations.

kbx8 uses cookies and similar tracking technologies to operate the platform, enhance your experience, and gather analytics that help us improve our services. A cookie is a small text file placed on your device when you visit kbx8.io. Cookies are not used to access any other data on your device.

The following categories of cookies are used on kbx8.io:

• Strictly necessary cookies: These cookies are essential for the platform to function. They maintain your authenticated session, remember your language and currency preference, and ensure secure access to your account. These cookies cannot be disabled without disrupting platform functionality.
• Functional cookies: These cookies remember your preferences and personalisation settings, such as your preferred game category, display settings, and responsible gaming limits, so that you do not need to re-enter them on every visit.
• Analytics cookies: We use anonymised analytics cookies to understand aggregate user behaviour on the platform — for example, which game categories are most visited, average session durations, and the most common deposit methods. No individual player is identified through analytics data.
• Security cookies: These cookies support fraud detection and bot prevention by recording technical signals such as mouse movement patterns, click behaviour, and device fingerprint consistency across sessions. They are essential to maintaining platform integrity.

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies from specific websites. Please note that disabling functional or analytics cookies may affect your experience on kbx8.io. Strictly necessary and security cookies cannot be disabled while using the platform. kbx8 does not use third-party advertising cookies or retargeting pixels.

kbx8 implements a comprehensive, layered security architecture to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures are reviewed and updated regularly in line with evolving industry standards and threat intelligence.

• Encryption in transit: All data transmitted between your device and kbx8 servers is protected by TLS 1.3, the current gold standard for transport-layer security. Connections are enforced via HTTP Strict Transport Security (HSTS) headers.
• Encryption at rest: All personal data stored on kbx8 servers — including identity documents, contact information, and transaction records — is encrypted at rest using AES-256 encryption. Database encryption keys are managed under a strict key management policy.
• Password security: User passwords are never stored in plaintext. kbx8 uses industry-standard cryptographic hashing with salting to store password credentials, ensuring that even in the event of an unauthorised data access incident, original passwords cannot be recovered.
• Access controls: Access to personal data within kbx8 is restricted on a strict need-to-know basis. Staff members are granted the minimum level of data access required to perform their role. All internal data access is logged and subject to periodic audit review.
• Infrastructure security: kbx8 servers are hosted in ISO 27001-certified data centres with physical access controls, 24/7 surveillance, and redundant power and connectivity. Firewalls, intrusion detection systems, and DDoS mitigation technologies are in place at the network layer.
• Incident response: In the event of a confirmed personal data breach that poses a risk to your rights, kbx8 will notify affected account holders via the email address registered to their account as promptly as practicable, and no later than 72 hours after becoming aware of the breach.

kbx8 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, to maintain an active account relationship with you, or to comply with applicable legal and regulatory retention requirements. When personal data is no longer required, it is securely deleted or anonymised.

The following retention periods apply to the main categories of personal data held by kbx8:

Where you request deletion of your personal data and no legal retention obligation prevents us from complying, kbx8 will action the deletion request within 30 calendar days of receipt and will confirm completion to you in writing via your registered email address.

As a kbx8 account holder or platform user, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Privacy Rights Request — [Your Username] — [Right Being Exercised]". We will respond within 30 calendar days of receiving a valid request.

• Right of access: You have the right to request a copy of all personal data kbx8 holds about you, together with information about how it is processed, the categories of data held, and any third parties with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For account details such as mobile number or email address, you may also update these directly within your account settings.
• Right to erasure: You have the right to request that kbx8 delete your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing was unlawful. This right is subject to legal retention obligations which may prevent full erasure.
• Right to restrict processing: You may request that kbx8 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested or while a legitimate interests objection is being assessed.
• Right to object: You have the right to object to the processing of your personal data where kbx8 relies on legitimate interests as the legal basis, and where you believe your fundamental rights and freedoms override those interests. You also have an unconditional right to object to direct marketing at any time.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that kbx8 provide your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where kbx8 processes your data on the basis of consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

The kbx8 platform is strictly intended for adults aged 21 years and above. kbx8 does not knowingly collect, process, or store personal data from individuals under the age of 21. The minimum age requirement is enforced through our mandatory identity verification (KYC) process, which all account holders must complete before a withdrawal can be processed or a bonus claimed.

If kbx8 becomes aware or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, void any associated transactions, and securely delete the data in question without undue delay. Any funds deposited by an underage user will be returned via the original payment method after identity verification.

Parents and guardians are strongly encouraged to use internet filtering and parental control software to prevent minors from accessing online gambling websites including kbx8.io. If you believe a minor in your household has created a kbx8 account, please contact our support team immediately at [email protected]. We will treat all such reports with the highest priority and full confidentiality.

kbx8 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform functionality. The effective date at the top of this Policy will always indicate when the most recent revision was made.

Where a material change is made to this Policy — meaning a change that substantively affects your rights or the way we use your personal data — kbx8 will notify registered account holders via email to the address registered to their account at least 14 days before the change takes effect. Non-material changes such as typographical corrections or structural reformatting may be made without individual notification.

Continued use of the kbx8 platform after the effective date of any Policy update constitutes your acceptance of the revised Policy. If you do not agree with any material change, you should close your account before the effective date by contacting [email protected]. Account closure instructions are also available within your account settings.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, want to report a suspected privacy breach, or wish to make a formal privacy complaint, please contact our dedicated privacy support team using the details below.

Our support team is available 24 hours a day, 7 days a week, in English, and will respond to all privacy-related queries as a matter of priority. For formal privacy rights requests or complaints, please allow up to 30 calendar days for a full response, though we aim to resolve most matters well within this timeframe.

For formal written complaints regarding our handling of your personal data, please include your full account username, a clear description of your concern, the specific data processing activity you are questioning, and any supporting evidence you wish to provide. kbx8 will acknowledge formal complaints within 24 hours and provide a substantive response within 14 business days, extendable to 30 days for complex matters.