kx18 Privacy Policy — How We Collect, Use & Protect Your Personal Data

1 Introduction

kx18 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of every individual who registers and plays on the kx18 online betting and casino platform. This Privacy Policy ("Policy") describes in detail how we collect, use, store, share, and protect personal information in connection with your use of kx18.io and any associated mobile or web applications.

This Policy is intended to be read alongside the kx18 Terms & Conditions and Responsible Gaming Policy. Together, these documents form the complete framework governing your relationship with the kx18 platform. Where there is any conflict between this Policy and another document, this Policy shall govern with respect to personal data matters.

We take a privacy-first approach to platform design and operations. We collect only the personal data that is genuinely necessary for the purposes described in this Policy, and we do not engage in the sale or unauthorised sharing of player data under any circumstances.

2 Data Controller

kx18 acts as the data controller for all personal information collected through the kx18 platform. As data controller, we are responsible for determining the purposes for which personal data is collected and the means by which it is processed. All requests relating to your personal data — including access requests, correction requests, deletion requests, and objections to processing — should be directed to the kx18 support team using the contact details provided in Section 14 of this Policy.

Where kx18 engages third-party service providers to process personal data on its behalf (for example, payment processors and KYC verification partners), those providers act as data processors under a formal data processing agreement that requires them to process data only as instructed by kx18 and to maintain appropriate security standards.

3 Personal Data We Collect

kx18 collects personal data in the following categories:

3.1 Registration & Account Data. When you create a kx18 account, we collect your full legal name, date of birth, residential address (including district and division within Bangladesh, e.g., Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh), email address, and mobile phone number. This information is required to create and manage your account and to verify your eligibility to use the platform.

3.2 Identity Verification (KYC) Data. To comply with applicable anti-money laundering and fraud prevention obligations, we may collect copies of identity documents including your Bangladesh National ID Card (NID), passport, or other government-issued identification. We may also collect proof of address documents such as utility bills or bank statements. This data is processed for verification purposes only and is stored securely in accordance with Section 7 of this Policy.

3.3 Payment & Transaction Data. We collect details relating to all financial transactions conducted through your kx18 account, including deposit amounts, withdrawal requests, transaction timestamps, payment method identifiers (such as registered bKash or Nagad account numbers), and transaction reference numbers. We do not store full card numbers; card payments are handled by PCI-DSS compliant payment processors.

3.4 Usage & Technical Data. We automatically collect technical information when you access the kx18 platform, including your IP address, device type, operating system, browser type and version, screen resolution, referring URL, pages visited, session duration, and in-platform behavioural data such as games played, betting history, and feature interactions. This data is used for platform operation, analytics, fraud detection, and service improvement.

3.5 Communications Data. When you contact kx18 support via live chat, email, or any other channel, we retain records of that correspondence including the content of messages, timestamps, and any supporting files or screenshots you provide. This data is used to resolve your enquiry and to maintain a history of customer interactions for quality assurance purposes.

3.6 Marketing Preference Data. Where you have opted in to receive promotional communications from kx18, we record your marketing preferences and consent status. You may withdraw this consent at any time by updating your account notification settings or contacting support.

4 How We Use Your Personal Data

kx18 uses the personal data described in Section 3 for the following purposes:

• Account Creation & Management: To register your account, verify your identity, maintain your account settings, and provide you with access to the platform's full range of features including cricket betting, slots, and live casino games.
• Payment Processing: To process your deposits and withdrawal requests via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and other supported payment methods. All transactions are denominated in Bangladeshi Taka (BDT).
• Identity Verification & Compliance: To fulfil our legal obligations under applicable anti-money laundering regulations, to verify that all account holders are aged 21 or above, and to comply with any lawful request from a regulatory or law enforcement authority.
• Fraud Detection & Platform Security: To monitor account activity for signs of fraudulent behaviour, multi-accounting, bonus abuse, match-fixing involvement, or other prohibited conduct as defined in the kx18 Terms & Conditions.
• Personalisation: To tailor the platform experience to your preferences, including displaying relevant games, promotions, and content based on your activity history and stated preferences.
• Customer Support: To respond to your enquiries, resolve disputes, investigate complaints, and maintain records of support interactions for quality assurance purposes.
• Marketing Communications: Where you have provided consent, to send you information about kx18 promotions, bonuses, seasonal offers (such as Eid or Pohela Boishakh specials), new game launches, and other relevant updates by email or SMS.
• Analytics & Service Improvement: To analyse aggregated usage data, identify platform performance issues, improve user experience, and develop new features and services.
• Responsible Gaming: To monitor for indicators of problem gambling behaviour, enforce deposit and loss limits set by the player, manage cooling-off and self-exclusion requests, and fulfil our duty of care obligations.

5 Legal Basis for Processing

kx18 processes your personal data on the following legal bases:

5.1 Contractual Necessity. The majority of data processing described in this Policy is necessary for the performance of our contract with you — specifically, to operate your account, process transactions, and provide the services you have registered to use. Without this processing, we would be unable to deliver the kx18 platform service.

5.2 Legal Obligation. Certain processing activities — particularly identity verification (KYC), transaction monitoring, and record-keeping — are required by applicable laws and regulations. We are obligated to process this data regardless of individual consent.

5.3 Legitimate Interests. We process technical and usage data on the basis of our legitimate interest in operating a secure, functional, and commercially viable platform. This includes fraud detection, security monitoring, and aggregate analytics. We carefully balance our legitimate interests against your privacy rights, and we do not rely on this basis where our interests are overridden by your fundamental rights.

5.4 Consent. Where processing is based on consent — primarily in relation to marketing communications and non-essential analytics cookies — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place before the withdrawal. Withdrawing marketing consent will not affect your ability to use any feature of the kx18 platform.

6 Sharing Your Personal Data

kx18 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data in the following limited circumstances:

6.1 Service Providers. We engage trusted third-party service providers to support the operation of the kx18 platform. These may include payment processing partners (such as bKash, Nagad, and Rocket gateway operators), KYC and identity verification services, fraud detection and risk management providers, cloud hosting and infrastructure providers, and customer support platform operators. All service providers are bound by data processing agreements and are permitted to use your data only for the specific purpose for which it was shared.

6.2 Legal & Regulatory Disclosure. We may disclose personal data to law enforcement agencies, regulatory bodies, or other governmental authorities where we are legally required to do so, where disclosure is necessary to protect the rights or safety of kx18, its employees, or its users, or where disclosure is required as part of a formal legal proceeding.

6.3 Business Transfers. In the event that kx18 undergoes a merger, acquisition, restructuring, or sale of all or part of its business, personal data held by kx18 may be transferred to the successor entity. You will be notified of any such transfer and any resulting material changes to this Policy before the transfer takes effect.

6.4 Aggregated & Anonymised Data. We may share aggregated, anonymised data that does not identify any individual player with analytics partners, industry research bodies, or in publicly available reports. This data cannot be used to identify you personally.

7 Data Retention

kx18 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes or enforce agreements. The following general retention periods apply:

• Account & Registration Data: Retained for the duration of your account relationship with kx18 and for a minimum of 5 years following account closure, in accordance with applicable financial record-keeping requirements.
• KYC & Identity Documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later, in compliance with anti-money laundering regulations.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction.
• Customer Support Correspondence: Retained for a period of 3 years from the date of the interaction.
• Marketing Consent Records: Retained for the duration of your consent and for 2 years following withdrawal of consent, to demonstrate compliance.
• Technical & Usage Logs: Retained for a rolling period of 12 months, after which they are anonymised or deleted.

Where data is no longer required for any legitimate purpose and no legal obligation requires its continued retention, kx18 will securely delete or anonymise that data.

8 Data Security

kx18 takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect your information against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• SSL/TLS encryption for all data transmitted between your device and the kx18 platform.
• Encryption at rest for sensitive personal and financial data stored on our servers.
• Role-based access controls that restrict internal access to personal data to authorised personnel only, on a strict need-to-know basis.
• Multi-factor authentication requirements for administrative access to data systems.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Continuous monitoring of platform systems for anomalous activity, attempted intrusions, and data exfiltration attempts.
• Formal incident response procedures to ensure that any data security breach is identified, contained, and reported promptly.

While kx18 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying kx18 immediately if you believe your account has been compromised.

9 Your Data Rights

Subject to applicable law, you have the following rights with respect to your personal data held by kx18:

9.1 Right of Access. You have the right to request a copy of the personal data we hold about you, including information about how it is used and with whom it has been shared. We will respond to access requests within 30 days of receipt.

9.2 Right to Rectification. If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. You may update basic account information directly from your account settings dashboard at any time.

9.3 Right to Erasure. You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, or where the data has been unlawfully processed. Please note that certain data may be subject to mandatory retention requirements that override this right.

9.4 Right to Restrict Processing. In certain circumstances — for example, while the accuracy of your data is being contested — you may request that we restrict the processing of your personal data rather than delete it.

9.5 Right to Object. You have the right to object to the processing of your personal data where that processing is based on our legitimate interests. You also have an absolute right to object to the use of your data for direct marketing purposes, which can be exercised at any time.

9.6 Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of these rights, please contact the kx18 support team. We may require you to verify your identity before fulfilling a request. We will not charge a fee for the exercise of these rights in ordinary circumstances.

10 Cookies & Tracking Technologies

kx18 uses cookies and similar tracking technologies to operate the platform, analyse usage patterns, and deliver a personalised experience. The categories of cookies we use are described below:

10.1 Essential Cookies. These cookies are strictly necessary for the platform to function and cannot be disabled without affecting core functionality. They include session cookies that keep you logged in while navigating the platform, security tokens that protect against cross-site request forgery, and cookies that store your account preferences such as language and notification settings.

10.2 Analytics Cookies. We use analytics cookies to collect aggregated information about how players use the kx18 platform, including which pages are visited most frequently, how long sessions last, and where users encounter difficulties. This data is used to improve platform performance and user experience. Analytics cookies are not used to track your activity across third-party websites.

10.3 Functional Cookies. Functional cookies enable the platform to remember choices you have made — such as your preferred game view, sidebar settings, or notification preferences — to provide a more personalised experience on your next visit.

10.4 Managing Cookies. You can manage or disable non-essential cookies through your browser's cookie settings at any time. Please note that disabling certain cookies may affect the functionality of the kx18 platform. Essential cookies cannot be disabled through browser settings as they are required for the platform to operate.

11 Minors & Under-Age Protection

The kx18 platform is strictly for adults aged 21 and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor without verifiable parental or guardian consent, we will take immediate steps to delete that data and close the associated account.

Parents and guardians are encouraged to use parental control software to prevent minors from accessing online gambling and betting platforms. If you believe a minor has registered an account on kx18 or has accessed the platform using your credentials, please contact our support team immediately so that appropriate action can be taken.

12 International Data Transfers

kx18 operates primarily to serve players in Bangladesh. Some of our service providers and infrastructure partners may process personal data in countries outside Bangladesh. Where such transfers occur, kx18 takes steps to ensure that appropriate safeguards are in place to protect your personal data, including requiring contractual data protection obligations on all international service providers equivalent to those we maintain domestically.

By using the kx18 platform and providing personal data to us, you acknowledge and consent to the transfer of your personal data to third-party service providers in other countries where necessary for the operation of the platform, subject always to the protections described in this Policy.

13 Changes to This Privacy Policy

kx18 reserves the right to update or modify this Privacy Policy at any time. When we make material changes — meaning changes that significantly affect how we collect or use your personal data — we will notify registered players by posting an update notice within the platform dashboard and, where possible, by email to your registered address. The date of the most recent revision is displayed at the top of this document.

We encourage you to review this Policy periodically to stay informed about how kx18 protects your personal data. Your continued use of the platform following the posting of any revised Policy constitutes your acceptance of the changes. If you do not agree to any modification, you may close your account as described in the kx18 Terms & Conditions.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data kx18 holds about you, please contact our support team through the 24/7 live chat feature within your account dashboard, available in Bangladesh Standard Time (BST, UTC+6).

You may also reach our data protection team by email at: [email protected]

Please note that the email address displayed above is provided for informational purposes only and is not a clickable link. Do not send sensitive personal data, passwords, payment information, or identity documents via unsolicited email. Our team will guide you through secure channels for the submission of any sensitive documents.

Effective Date: 1 January 2026  |  Version: 1.0  |  Platform: kx18.io