krx8 Privacy Policy — How We Collect, Use and Protect Your Data

This Privacy Policy ("Policy") applies to the krx8 website, mobile platform, and all related services (collectively, the "Platform") operated by krx8. This Policy describes how krx8 collects, uses, stores, discloses and protects personal information provided by users of the Platform ("you" or "your"). By accessing or using the Platform you confirm that you have read, understood and agreed to the terms of this Policy. If you do not agree with this Policy you must not use the Platform.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform. Capitalised terms not defined in this Policy have the meaning given to them in the Terms & Conditions. This Policy was last updated and is effective as of 1 January 2026.

The categories of personal information we may collect include, but are not limited to, the following:

• Identity data: full legal name, date of birth, and a copy of a government-issued identity document where required for KYC verification.
• Contact data: mobile phone number, email address, and any other contact details you provide when registering or communicating with support.
• Financial data: mobile wallet identifiers (e.g. the bKash or Nagad number used for deposits and withdrawals), transaction records, and account balance history. krx8 does not store full card numbers or bank account credentials.
• Technical data: IP address, device type, operating system version, browser type, session duration, pages visited, and referral source. This data is collected automatically when you access the Platform.
• Usage and gaming data: gaming history, bet amounts, game preferences, bonus utilisation records, and session activity logs. This data is used to operate the Platform, detect fraud and comply with responsible gaming obligations.

You are not obligated to provide all personal information to us, but please be aware that failure to provide mandatory information at the time of registration or during the KYC process will prevent krx8 from opening or maintaining your account.

krx8 uses the personal information we collect for the following purposes:

• Account management: to register and manage your krx8 account, process your deposits and withdrawals, verify your identity, and provide access to the Platform's games and features.
• Service delivery: to operate, maintain and improve the Platform, personalise your gaming experience, process bonus credits and promotions, and deliver customer support.
• Legal and regulatory compliance: to meet our obligations under applicable anti-money laundering (AML) regulations, KYC requirements, responsible gaming obligations, and any other legal or regulatory requirements that apply to online gaming operators.
• Fraud prevention and security: to detect, investigate and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, and any other activity that violates our Terms & Conditions or applicable law.
• Communications: to send you service-related notices (such as account verification messages, transaction confirmations, and security alerts) and, where you have opted in, promotional communications about bonuses, new games and special events.
• Analytics and platform improvement: to analyse aggregate usage patterns, identify technical issues, test new features, and make improvements to the Platform's design, performance and content offering.

krx8 will not use your personal information for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

krx8 processes your personal data on the following legal grounds:

• Contractual necessity: processing is required to perform our contract with you — specifically, to operate your account, process transactions and deliver the gaming services you have requested.
• Legal obligation: processing is necessary for krx8 to comply with its legal and regulatory obligations, including AML checks, KYC verification and responsible gaming record-keeping.
• Legitimate interests: processing is necessary for the legitimate interests of krx8, including fraud prevention, platform security, analytics to improve our services, and direct marketing to existing customers (where you have not opted out).
• Consent: where krx8 relies on your consent as the legal basis for processing (for example, for optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

krx8 does not sell, rent or trade your personal information to any third party. We may share your information with third parties only in the following limited circumstances:

• Service providers: companies that provide services on our behalf, such as payment processing partners (e.g. bKash, Nagad), identity verification providers, cloud hosting services, and customer support platforms. These providers are contractually bound to process your data only on our instructions and to apply appropriate security measures.
• Game providers: licensed game studios whose titles appear on the krx8 Platform (such as Pragmatic Play, Evolution Gaming, Spribe and Ezugi) may receive session and wagering data necessary to operate their games, subject to their own privacy policies.
• Legal and regulatory authorities: where krx8 is legally required or permitted to disclose your information to law enforcement agencies, regulatory bodies, courts, or other government authorities, we will do so in accordance with applicable law.
• Business transfers: in the event of a merger, acquisition, restructuring or sale of assets involving krx8, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such change via the contact details registered to your account.

All third parties with whom krx8 shares personal data are required to implement appropriate technical and organisational measures to protect that data and to use it only for the purposes for which it was shared.

All financial transactions on the krx8 Platform are processed through our approved payment partners. When you make a deposit or request a withdrawal via bKash, Nagad, Rocket or Upay, the transaction is handled by the relevant mobile wallet provider subject to that provider's own terms and privacy policy. krx8 retains a record of transaction amounts, dates, and the mobile wallet identifier associated with the transaction for the purposes of account management, fraud prevention and regulatory compliance. krx8 does not store full card numbers, banking credentials, or complete wallet PIN or password details.

Transaction records are retained for a minimum of five years following the date of the transaction to meet our obligations under applicable financial crime regulations. These records will not be used for any purpose other than those set out in this Policy and our Terms & Conditions.

krx8 uses cookies and similar tracking technologies to operate the Platform and improve your experience. Cookies are small text files stored on your device when you visit the Platform. We use the following types of cookies:

• Strictly necessary cookies: these are essential for the Platform to function. They include session cookies that keep you logged in during your visit and security tokens that protect against cross-site request forgery. These cookies cannot be disabled.
• Performance and analytics cookies: these collect anonymised information about how visitors use the Platform, such as which pages are visited most frequently and whether users experience errors. We use this data to improve the Platform's performance and content.
• Preference cookies: these remember your settings and preferences (such as your selected language version) so that you do not need to re-enter them on subsequent visits.

You can manage your cookie preferences through your device's browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. Continued use of the Platform following your acknowledgement of this Policy constitutes acceptance of our use of cookies as described above.

krx8 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting or reporting obligations. As a general guide: account data is retained for the duration of your account relationship with krx8 and for a period of five years following account closure; transaction records are retained for a minimum of five years; communications records are retained for two years; and technical and usage logs are retained for twelve months unless a longer retention period is required for fraud investigation or legal proceedings.

When your personal data is no longer required, krx8 will securely delete or anonymise it in accordance with our data disposal procedures. Where anonymisation is not technically feasible, the data will be securely archived and access restricted to authorised personnel only.

Subject to applicable law, you have the following rights with respect to the personal data krx8 holds about you:

• Right of access: you have the right to request a copy of the personal data krx8 holds about you, together with information about how it is used and with whom it is shared.
• Right of rectification: you have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may also update many of your account details directly through your account settings.
• Right of erasure: you have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to krx8's overriding legal obligations to retain certain categories of data.
• Right to restrict processing: you have the right to request that krx8 restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing based on legitimate interests.
• Right to object to marketing: you have the right to object at any time to the processing of your personal data for direct marketing purposes. You may opt out of marketing communications by contacting krx8 support or by following the unsubscribe instructions in any marketing message we send you.

To exercise any of the rights listed above, please contact the krx8 support team using the email address displayed in the footer of this page. krx8 will respond to all verified requests within 30 days. In some circumstances krx8 may need to verify your identity before processing your request.

krx8 implements appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration or destruction. These measures include 256-bit SSL encryption for all data transmissions between your device and our servers, firewalls and intrusion detection systems, access controls that restrict data access to authorised personnel only, regular security assessments and penetration testing, and secure data storage on servers located in restricted-access data centres.

Despite our security measures, no data transmission over the internet or method of electronic storage is 100% secure. While krx8 takes commercially reasonable steps to protect your personal data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, krx8 will notify affected users without undue delay.

The krx8 Platform is strictly intended for adults aged 21 and above. krx8 does not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a person under 21, we will immediately close the associated account, delete all collected data, and return any deposited funds to the payment method from which they originated. If you believe that a minor has registered on the Platform, please notify us immediately using the contact details in the footer of this page.

krx8 reserves the right to update or amend this Privacy Policy at any time. When we make material changes to this Policy, we will update the effective date at the top of the document and, where appropriate, notify registered users via their registered email address or via an in-platform notification. The most current version of this Policy will always be available on the Platform.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically to stay informed about how krx8 collects, uses and protects your personal information.

If you have any questions, concerns or complaints regarding this Privacy Policy or the way in which krx8 processes your personal data, please contact our support team. Our privacy team aims to acknowledge all inquiries within 24 hours and to provide a substantive response within 14 days of receipt. Contact details are displayed as plain text in the footer of this page.

krx8 is committed to resolving privacy-related concerns in a fair, timely and transparent manner. If you are not satisfied with our response, you may escalate your concern to the relevant data protection authority or regulatory body in your jurisdiction.