kx98 Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how kx98 ("kx98", "we", "us", "our") collects, uses, stores, shares, and protects personal information relating to individuals who access or use the kx98 website at https://kx98.io, its associated subdomains, the kx98 mobile progressive web application, and any other products or services offered under the kx98 brand (collectively, the "Platform").

kx98 is an online gaming and sports betting platform operating for players based in Bangladesh. All transactions on the Platform are conducted in Bangladeshi Taka (৳). This Policy is written in English and applies to all users of the kx98 Platform regardless of the device or method used to access it.

This Policy should be read alongside the kx98 Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference. This Policy was last updated on 01 January 2026 and supersedes all prior privacy notices published by kx98.

Data We Collect

kx98 collects personal data in several categories depending on how you interact with the Platform. The categories of data we collect are described in the table below.

kx98 does not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, health information, or political opinions. If any such data is incidentally provided (for example, in a free-text support message), it will not be used for any profiling purpose and will be deleted promptly.

How We Collect Your Data

kx98 collects personal data through the following channels and mechanisms:

• Direct Submission: Information you provide when registering a kx98 account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or responding to a survey or promotion.
• Automated Technical Collection: Data gathered automatically when you access the Platform, including device identifiers, IP addresses, browser fingerprints, session data, and cookie-derived analytics. This data is collected whether or not you are logged into a kx98 account.
• Payment Processing Partners: Transaction confirmation data from mobile financial service providers (bKash, Nagad, Rocket, Upay) and card networks (Visa, Mastercard). kx98 receives only the minimum data required to confirm, record, and reconcile payments — full card numbers are never transmitted to or stored by kx98.
• Identity Verification Providers: Where kx98 uses a third-party identity verification service to confirm document authenticity or conduct liveness checks, that service returns a verification result and a confidence score to kx98. The raw biometric data processed during liveness checks is handled by the verification provider under their own data processing agreement and is not stored by kx98.
• Game Providers: Licensed game studios including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi may pass session metadata back to kx98 for purposes of responsible gaming monitoring, dispute resolution, and platform analytics. This data does not include payment details.
• Publicly Available Sources: In limited circumstances related to fraud prevention or AML compliance, kx98 may cross-reference information against publicly available databases or commercially licensed data services.

How We Use Your Data

kx98 processes your personal data only for specific, defined purposes. The primary purposes for which we use your data are set out below:

• Account Management: Creating, maintaining, and securing your kx98 account; authenticating your identity at login; processing password resets and two-factor authentication events.
• Service Delivery: Processing deposits and withdrawals in BDT via bKash, Nagad, Rocket, Upay, Visa, Mastercard, and bank transfer; settling bets; crediting casino game winnings; applying bonus funds.
• KYC and Age Verification: Verifying that you are at least 21 years of age; confirming your identity and residential address as required by responsible gaming and AML obligations.
• Fraud Prevention and Security: Detecting and preventing unauthorised access to your account; identifying unusual betting patterns, bonus abuse, or financial crime; protecting the integrity of sports markets (including BPL and T20 cricket markets).
• Responsible Gaming: Monitoring account behaviour against responsible gaming indicators; proactively contacting players where patterns suggest potential harm; enforcing deposit limits, cooling-off periods, and self-exclusion requests.
• Customer Support: Responding to queries and complaints; resolving disputes over bet outcomes or account balances; maintaining records of support interactions for quality and training purposes.
• Legal and Regulatory Compliance: Fulfilling AML reporting obligations; responding to lawful requests from Bangladeshi regulatory or law enforcement authorities; maintaining financial records for the required retention periods.
• Marketing Communications (with consent only): Sending promotional offers, seasonal bonus announcements (Eid, Pohela Boishakh, BPL season), and Platform news to users who have explicitly opted in to marketing communications. You may withdraw marketing consent at any time via your account settings.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the kx98 user interface, optimise game loading performance, and develop new features.

kx98 does not use your personal data to build profiles for sale to advertisers, and we do not use automated decision-making that produces legal or similarly significant effects without human review.

Legal Basis for Processing

kx98 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the agreement between you and kx98, including account creation, payment processing, bet settlement, and customer support.
• Legal Obligation: Processing required to comply with applicable laws, including KYC identity verification, AML transaction monitoring, age verification (21+), and responses to lawful authority requests.
• Legitimate Interests: Processing carried out in kx98's legitimate interests where those interests are not overridden by your rights — specifically, fraud detection, security monitoring, platform analytics, and responsible gaming monitoring. kx98 conducts proportionality assessments before relying on this basis.
• Consent: Processing based on your freely given, specific, informed consent — in particular, sending marketing communications and setting non-essential analytics cookies. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

kx98 does not sell, rent, or trade your personal data. We share data with third parties only in the following defined circumstances:

• Licensed Game Providers: Studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Ezugi receive the minimum session data necessary to operate their games within the kx98 Platform. These providers are bound by data processing agreements that prohibit use of your data for any purpose outside of service delivery.
• Payment Processors: Mobile financial service providers (bKash, Nagad, Rocket, Upay) and card processors (Visa, Mastercard) receive only the transaction data required to execute your deposit or withdrawal. kx98 does not pass your gaming history or personal profile to payment processors.
• Identity Verification Services: Third-party KYC and liveness verification providers receive identity document images and, where applicable, facial scan data solely for the purpose of verifying your identity. These providers operate under contractual data processing terms.
• Banking Partners: Where bank transfer deposits or withdrawals are processed via Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, or Sonali Bank, the relevant financial institution receives the minimum data required to process the transaction under applicable banking regulations.
• Legal and Regulatory Authorities: kx98 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by applicable law, or where kx98 believes in good faith that disclosure is necessary to prevent fraud, protect the safety of players, or comply with a legal obligation.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of kx98's assets, user data may be transferred to the acquiring entity as part of the transaction. Users will be notified of any such transfer and of any material change to the applicable privacy policy.

All third parties with whom kx98 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the purposes for which it was shared. kx98 does not knowingly share data with parties located in jurisdictions that do not offer an adequate level of data protection without implementing appropriate safeguards.

Data Retention

kx98 retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. The following retention schedule applies to the main categories of data we hold:

When personal data reaches the end of its defined retention period, kx98 will securely delete or irreversibly anonymise it. Where data is anonymised rather than deleted, the resulting data set cannot be used to re-identify any individual and is used solely for statistical and analytical purposes.

Cookies & Tracking Technologies

kx98 uses cookies and similar technologies (including local storage and session tokens) to operate the Platform and improve your experience. The categories of cookies used by kx98 are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function. These include your authenticated session token, CSRF protection tokens, and language preference storage. These cookies cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised, aggregated information about how players use the kx98 Platform — for example, which game categories are most visited, average session length, and page load performance across devices commonly used in Bangladesh (including budget Android handsets typical in Dhaka and Chittagong markets). No individually identifiable data is extracted from analytics cookies.
• Functional Cookies: Used to remember your preferences such as display settings, previously selected payment methods, and responsible gaming reminder intervals. These cookies persist between sessions to provide a more personalised experience.
• Marketing Cookies (consent required): Used only where you have explicitly consented to receive targeted promotional communications. These cookies help kx98 measure the effectiveness of promotional campaigns such as BPL season offers and Eid bonuses. You may withdraw marketing cookie consent at any time via your account privacy settings.

kx98 does not use cross-site tracking cookies, fingerprinting scripts designed to track users across unrelated websites, or any tracking technology that is not described in this Policy.

Your Data Rights

As a kx98 player, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, contact our data team at [email protected] with the subject line "Data Rights Request".

kx98 will respond to all verified data rights requests within 30 calendar days. Where a request is complex or where kx98 receives a large volume of requests simultaneously, this period may be extended by a further 60 days with notice to you. Identity verification may be required before kx98 can action any data rights request to ensure we do not disclose personal data to an unauthorised party.

Children & Minors

The kx98 Platform is strictly for adults aged 21 years and over. kx98 does not knowingly collect personal data from individuals under the age of 21. The Platform uses age verification controls at the point of registration and during KYC review to prevent underage access.

If kx98 becomes aware that personal data has been collected from an individual who is under 21 years of age, we will take the following steps without delay:

• Immediately suspend the relevant account and freeze any associated balance
• Delete or return any deposits made, net of any platform processing costs incurred
• Delete all personal data associated with the account to the extent permitted by law
• Report the matter to relevant authorities where required under applicable child protection obligations

If you are a parent or guardian and believe that a minor under your care has created a kx98 account, please contact us immediately at [email protected] with the subject line "Minor Account Report". We take all such reports seriously and will investigate and act on them as a priority matter.

Security Measures

kx98 applies a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include but are not limited to:

• Transport Layer Security: All data transmitted between your device and kx98 servers is encrypted using TLS 1.3. Connections over older, less secure TLS versions are rejected. The kx98 Platform enforces HTTPS across all pages and API endpoints.
• Data-at-Rest Encryption: Personal data stored in kx98 databases is encrypted at rest using AES-256. Encryption keys are managed through a dedicated key management service with strict access controls and regular key rotation schedules.
• Access Controls: Access to systems holding personal data is restricted to authorised kx98 personnel on a need-to-know basis. All internal access is authenticated, logged, and subject to periodic access reviews. Privileged access requires multi-factor authentication.
• Penetration Testing: kx98 commissions periodic independent security assessments and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: kx98 maintains a documented security incident response plan. In the event of a data breach that is likely to result in a risk to affected individuals, kx98 will notify relevant authorities and affected users within the timeframes required by applicable law.
• Employee Training: All kx98 staff who handle personal data receive regular data protection training. Contractual confidentiality obligations apply to all employees and contractors with access to personal data.
• Third-Party Security Assessments: Before engaging any new data processor, kx98 conducts a due diligence review of that party's security practices. Ongoing processor relationships are subject to periodic reassessment.

Despite these measures, no online platform can guarantee absolute security. If you suspect that your kx98 account has been compromised, you should change your password immediately and contact our support team at [email protected].

Changes to This Policy

kx98 may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, the technology we use, or applicable legal requirements. When we make material changes to this Policy, we will take the following steps to ensure you are informed:

• Post the revised Policy on this page with an updated "Last Updated" date visible at the top of the document
• Display a notice on the kx98 Platform homepage for a minimum of 14 days following the effective date of any material change
• Where the change materially affects how we use data for which you have provided consent, send a direct notification to your registered email address requesting re-confirmation of consent before the change takes effect

We encourage you to review this Policy periodically. Non-material changes — such as corrections of typographical errors, clarifications that do not alter the substance of our practices, or updates to contact details — may be made without specific advance notice beyond the updated "Last Updated" date on this page.

Contact & Data Rights Requests

If you have any questions about this Privacy Policy, wish to exercise any of your data rights described in Section 09, or wish to raise a concern about how kx98 has handled your personal data, please contact our data protection team using the details below:

When submitting a data rights request, please include your registered kx98 username or registered email address, the nature of your request, and any relevant context that will help us locate your records and respond accurately. kx98 may request identity verification before actioning your request to prevent unauthorised access to personal data.

If you are not satisfied with kx98's response to a privacy concern or data rights request, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction. kx98 will cooperate fully with any investigation conducted by a competent supervisory authority.

This Privacy Policy is effective as of 01 January 2026 and governs all personal data processed by kx98 from that date forward.