cricbex Privacy Policy
Your Data, Your Rights

Data We Collect

cricbex collects personal data that is necessary to provide a safe, verified, and legally compliant online gaming and sports betting service to players in Bangladesh. We collect data in three principal ways: information you provide directly, information collected automatically during platform use, and information received from authorised third parties such as payment providers and identity verification services.

Information You Provide Directly

• Identity data: Full legal name, date of birth, gender (where provided), and government-issued identification details (Bangladesh National Identity Card number, passport number, or driver's licence number) submitted during account registration or KYC verification.
• Contact data: Email address, mobile phone number, and residential address in Bangladesh, including district, division, and postal code.
• Financial data: Payment method details such as bKash account number, Nagad account number, Rocket number, Upay number, or bank account details (Dutch-Bangla Bank, BRAC Bank) required to process deposits and withdrawals in BDT. We do not store full card numbers; card payment processing is handled by PCI DSS-compliant third-party processors.
• Account credentials: Username and hashed password. Passwords are never stored in plain text.
• Communication records: Any correspondence you submit to support@cricbex, live chat transcripts, and feedback form submissions.

Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and time-zone settings.
• Usage data: Pages visited, game sessions initiated, bet amounts, session duration, click-stream data, and feature interactions within the platform.
• Transaction data: Records of all deposits, withdrawals, bets placed, bonuses claimed, and account balance changes.
• Geolocation data: Approximate location data derived from IP address for fraud prevention, regulatory compliance, and responsible gaming purposes. Precise GPS-level location is not collected.

Information Received from Third Parties

• Identity verification outcomes from KYC/AML service providers engaged to verify player identity documents.
• Payment transaction status confirmations from bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank.
• Fraud risk signals from anti-fraud screening partners used to protect the integrity of the platform.

How We Use Your Data

cricbex processes your personal data on the basis of contractual necessity (to deliver the platform services you have registered for), legal obligation (to comply with anti-money laundering, fraud prevention, and age verification requirements), legitimate interest (to operate, secure, and improve the platform), and — where applicable — your explicit consent (for certain marketing communications).

The following table summarises the primary purposes for which your data is processed and the legal basis for each:

cricbex will not use your personal data for any purpose that is incompatible with the purposes described in this Policy without first obtaining your consent or establishing a new lawful basis for processing. We do not sell your personal data to any third party under any circumstances.

Data Sharing & Third Parties

cricbex does not share your personal data with third parties except in the limited circumstances described below. In all cases where data is shared with a third-party service provider, we require that provider to maintain appropriate technical and organisational security measures and to process your data only on our instructions and for the specific purpose for which it was disclosed.

Categories of third parties with whom data may be shared:

• Payment processors: bKash, Nagad, Rocket, Upay, Visa/Mastercard processing partners, Dutch-Bangla Bank, and BRAC Bank receive transaction-level financial data strictly as necessary to execute and confirm deposit and withdrawal instructions. Each of these partners operates under its own published privacy and data security framework.
• Identity verification providers: KYC and AML screening services receive identity document data (name, date of birth, ID number) to verify that account holders meet the platform's age and identity requirements. These providers are bound by strict data processing agreements and are prohibited from retaining or using your data beyond the scope of the verification service.
• Game providers: Where technically necessary to deliver game content, game session data (such as bet amounts, game round IDs, and win/loss outcomes) may be transmitted to certified game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers do not receive personally identifying information beyond what is strictly required for game delivery.
• Anti-fraud and security services: Device fingerprinting, IP reputation, and behavioural analytics partners may receive device and usage data to assist in detecting and preventing fraudulent activity on the platform.
• Legal and regulatory authorities: cricbex may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies when required to do so by applicable law, court order, or lawful request. Such disclosures are made only to the extent strictly required by the relevant legal obligation.
• Corporate transactions: In the event of a merger, acquisition, or sale of all or part of the cricbex business, personal data held by the platform may be transferred to the acquiring entity, subject to equivalent privacy protections and advance notice to affected users.

Cookies & Tracking Technologies

cricbex uses cookies and similar tracking technologies to operate the platform, maintain session integrity, analyse usage patterns, and — where you have provided consent — deliver personalised content and promotional offers. A cookie is a small text file stored on your device by your web browser when you visit the cricbex platform. Cookies do not execute code and cannot carry viruses or malware.

The following categories of cookies are used on the cricbex platform:

You may manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to view, block, or delete cookies stored by specific websites. Please note that disabling strictly necessary cookies will impair your ability to log in to and use the cricbex platform. Disabling analytics, functional, or marketing cookies will not affect core platform access.

Data Retention & Storage

cricbex retains personal data for as long as is necessary to fulfil the purposes set out in this Policy and to comply with applicable legal obligations. The following retention periods apply under standard operating conditions:

• Account and identity data: Retained for the duration of your active account relationship with cricbex, plus a minimum of five (5) years following account closure. This retention period reflects anti-money laundering record-keeping obligations.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with financial record-keeping requirements applicable to the platform.
• Customer support records: Email correspondence, live chat transcripts, and complaint records are retained for three (3) years from the date of last interaction, to facilitate dispute resolution and quality assurance.
• Marketing preference data: Retained until you withdraw your consent to receive marketing communications or until your account is closed, whichever is earlier. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Analytics and usage data: Aggregated and anonymised usage data may be retained indefinitely for platform analytics purposes, as it can no longer be attributed to any individual user once anonymised.
• Self-exclusion records: Where a player has applied a self-exclusion, the record of that exclusion is retained permanently to prevent circumvention through re-registration.

All personal data held by cricbex is stored on servers that maintain industry-standard physical and logical security controls. Access to personal data is restricted to authorised personnel on a strict need-to-know basis, and all internal access events are logged for audit purposes.

Your Privacy Rights

As a user of the cricbex platform, you hold the following rights with respect to your personal data. To exercise any of these rights, submit a written request to support@cricbex. We will acknowledge your request within 72 hours and respond substantively within 30 calendar days. In cases of particular complexity, we may extend the response period by a further 30 days with advance notice to you.

• Right of access: You may request a copy of the personal data that cricbex holds about you, along with information about how it is processed, where it is stored, and with whom it has been shared.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected. For identity data, updated documentation may be required to process the correction.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other lawful basis applies, or where the data has been unlawfully processed. Note that this right is subject to overriding legal obligations — transaction records and AML data cannot be deleted while mandatory retention periods are in force.
• Right to restrict processing: You may request that processing of your personal data be restricted in certain circumstances, such as when the accuracy of the data is contested or when you have objected to processing pending a determination of legitimate interests.
• Right to data portability: Where processing is based on your consent or on contractual necessity, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to object: You may object at any time to processing of your personal data carried out on the basis of legitimate interest, including profiling for direct marketing purposes. Where you object to marketing processing, cricbex will cease such processing immediately.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time by updating your communication preferences in your account settings or by contacting support@cricbex. Withdrawal of consent does not affect the lawfulness of prior processing.

Data Security Measures

cricbex implements a layered security architecture to protect the personal and financial data of all platform users. The following technical and organisational security measures are in place across the cricbex infrastructure:

• 256-bit SSL/TLS encryption: All data transmitted between your device and the cricbex platform is encrypted using Transport Layer Security (TLS 1.2 or higher). This ensures that your login credentials, payment details, and personal information cannot be intercepted in transit.
• Password hashing: User passwords are hashed using a modern, salted cryptographic algorithm (bcrypt or equivalent). Plain-text passwords are never stored on cricbex systems.
• Two-factor authentication (2FA): Players are strongly encouraged to enable 2FA on their cricbex accounts via the security settings panel. 2FA adds a secondary verification step — typically a one-time code delivered to your registered mobile number — that must be completed in addition to your password on each login.
• Intrusion detection and monitoring: The platform operates real-time network monitoring, intrusion detection systems (IDS), and automated anomaly alerting to identify and respond to suspicious activity rapidly.
• Access controls: Internal access to personal data is governed by role-based access control (RBAC). Only authorised personnel with a documented operational need may access player records, and all such access is logged and subject to periodic audit.
• Regular security assessments: The cricbex platform undergoes periodic security reviews, including vulnerability assessments, to identify and remediate security weaknesses before they can be exploited.

Notwithstanding these measures, no online platform can guarantee absolute security against all possible threats. In the event of a data breach that poses a material risk to your rights or interests, cricbex will notify affected users promptly and take immediate steps to contain the breach, assess its scope, and implement remediation measures.

Policy Updates & Contact

cricbex reserves the right to update or amend this Privacy Policy at any time. Updates may be required to reflect changes in applicable law, changes in our data processing practices, or platform improvements. When material changes are made to this Policy, we will notify registered users by email to the address on file or by a prominent in-platform notice at least 14 calendar days before the changes take effect.

The most current version of this Privacy Policy is always accessible at cricbex/privacy-policy. The date of the most recent revision is displayed at the top of the Policy document. Continued use of the cricbex platform after the effective date of any amendment constitutes acceptance of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by cricbex, please contact our Privacy team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

• Privacy Contact: support@cricbex
• Subject Line: "Privacy Policy Enquiry" or "Data Subject Request"
• Response Time: Acknowledgement within 72 hours; full response within 30 calendar days
• Platform Language: All correspondence conducted in English