criikex Privacy Policy — Your Data, Your Rights

criikex collects personal information from you in several ways: directly when you register an account, when you use our services, and automatically through the technical operation of our platform. The categories of data we collect are described below.

1.1 Information You Provide Directly

When you register an account with criikex or update your profile, we collect the following information:

• Identity data: Full legal name, date of birth, gender (optional)
• Contact data: Email address, mobile telephone number registered to a Bangladeshi network
• Address data: Residential address including city (Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, Mymensingh, or elsewhere in Bangladesh)
• Account credentials: Username and hashed password (we do not store your raw password)
• KYC documents: Copies of your Bangladesh National Identity Card (NID), passport, or other government-issued identification submitted for age and identity verification
• Payment data: bKash account number, Nagad account number, Rocket number, bank account details, or Visa/Mastercard details used for deposits and withdrawals. Full card numbers are never stored by criikex — card transactions are processed via PCI-compliant payment partners who tokenise card details
• Support communications: The content of messages you send to criikex via live chat, including timestamps and any attachments you provide

1.2 Information Collected Automatically

When you access the criikex platform, certain technical data is collected automatically by our servers and analytics systems:

• Device data: Device type, operating system, browser type and version, screen resolution, and device identifiers
• Network data: IP address, approximate geolocation derived from IP (country and city level only), internet service provider name
• Usage data: Pages visited, games launched, bet history, session duration, click-path data, features used, and timestamps of all account activity
• Cookie and tracking data: Session cookies, preference cookies, and anonymised analytics identifiers as described in Section 4 of this policy

1.3 Information from Third Parties

In limited circumstances, criikex may receive information about you from third-party sources:

• Identity verification partners: Where our KYC provider cross-references your submitted documents against official databases to confirm authenticity
• Payment processors: Transaction confirmation data (reference numbers, timestamps, amounts) returned by bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Visa, and Mastercard networks following deposit or withdrawal processing
• Fraud and risk screening services: Risk signals or flags from industry fraud-prevention tools used to protect the platform and its players from financial crime

criikex uses your personal data only for clearly defined purposes. The table below sets out each processing purpose, the category of data involved, and the legal basis on which criikex relies for that processing.

2.1 Automated Decision-Making

criikex uses automated systems for certain processes, including fraud risk scoring at account registration, duplicate account detection, and responsible gaming alert triggers based on patterns in your betting activity. Where an automated process produces a decision that significantly affects your account — such as a temporary suspension — you have the right to request human review of that decision by contacting criikex support via live chat.

2.2 Marketing Communications

If you have opted in to receive promotional communications from criikex, we may contact you by email or SMS to inform you of new promotions, bonus offers, or seasonal events (such as BPL season launches, T20 World Cup specials, or Eid promotions). You can withdraw your marketing consent at any time without affecting your account status. Withdrawal requests can be submitted via live chat support.

criikex does not sell, rent, or trade your personal information. We share your data only in the limited circumstances described below, and always subject to appropriate contractual and technical safeguards.

3.1 Service Partners

criikex works with a small number of carefully selected third-party service providers who process personal data on our behalf. These include:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and the Visa and Mastercard networks, solely for the purpose of processing your financial transactions
• KYC and identity verification providers: Services that cross-check submitted identity documents against authoritative sources to confirm your age and identity
• Game software providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, and other studio partners whose games run on the criikex platform. These providers receive anonymised session identifiers necessary to operate game rounds and return results — they do not receive your name, contact details, or payment information
• Hosting and infrastructure providers: Cloud and server infrastructure partners who host the criikex platform under strict data processing agreements that prohibit any secondary use of your data
• Fraud prevention services: Industry tools that assess risk signals associated with account registration and transaction activity

All service partners are contractually bound to process your data only for the specific purpose for which it was shared and to maintain security standards consistent with industry best practice.

3.2 Legal and Regulatory Disclosure

criikex may disclose your personal data to law enforcement agencies, financial intelligence units, or other competent authorities where we are legally required to do so, or where disclosure is necessary to prevent, detect, or investigate suspected fraud, money laundering, or other criminal activity. We will notify affected players of such disclosures where we are legally permitted to do so.

3.3 Business Transfers

In the event that criikex undergoes a merger, acquisition, or sale of all or part of its business assets, your personal data may form part of the transferred assets. You will be notified via your registered email address before your data becomes subject to a materially different privacy policy as a result of any such transaction.

criikex uses cookies and similar local storage technologies to operate the platform, maintain your session, remember your preferences, and analyse aggregate usage patterns. The following categories of cookies are in use on the criikex platform.

4.1 No Third-Party Advertising Cookies

criikex does not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. No cookie on the criikex platform is used to build a profile of your behaviour across other websites or to serve you targeted advertisements on external platforms.

4.2 Managing Cookies

You can manage or delete non-essential cookies through your browser settings at any time. Instructions for the most common browsers are available in their respective help documentation. Note that disabling functional cookies may affect your experience on the criikex platform — for example, your display preferences may not be retained between sessions. Disabling essential cookies will prevent you from logging in and using the platform.

4.3 Local Storage

In addition to cookies, criikex may store small amounts of data in your browser's local storage for performance purposes, such as caching game asset lists to reduce load times. This data does not contain personal information and is cleared when you clear your browser's site data.

Protecting the personal data of our players is a core operational responsibility at criikex. We apply multiple layers of technical and organisational security measures to reduce the risk of unauthorised access, accidental loss, disclosure, or destruction of your data.

5.1 Technical Security Measures

• Transport encryption: All communications between your browser and the criikex platform use TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS.
• Data at rest encryption: Sensitive data fields — including identity document copies, payment instrument references, and KYC records — are encrypted at rest using AES-256 encryption.
• Password handling: Passwords are never stored in plain text. We use industry-standard adaptive hashing algorithms so that even in the theoretical event of a database breach, your password could not be recovered from stored data.
• Access controls: Access to systems containing personal data is restricted to authorised criikex personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication for all administrative systems.
• Intrusion detection: Our infrastructure is monitored continuously for anomalous access patterns, with automated alerts and response protocols in place for potential security incidents.

5.2 Data Storage Location

criikex stores player data on servers located in secure data centres. Data transfer to third-party service partners (such as payment processors and KYC providers) occurs over encrypted channels only. criikex does not transfer your personal data to any third country without ensuring adequate protections are in place consistent with applicable data protection standards.

5.3 Data Breach Response

In the event of a confirmed personal data breach that poses a risk to the rights and freedoms of affected players, criikex will notify affected individuals without undue delay, providing details of the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed to address the breach. Notifications will be sent to the registered email address associated with the affected account.

As a player on the criikex platform, you hold the following rights with respect to your personal data. These rights may be exercised at any time by contacting criikex support via live chat. We will acknowledge your request within 48 hours and aim to fulfil it within 14 business days, or notify you if additional time is required for complex requests.

6.1 Right of Access

You may request a copy of the personal data criikex holds about you, together with information about how it is being used, where it is stored, and with whom it has been shared. This is sometimes called a Subject Access Request (SAR). There is no fee for a first SAR in any 12-month period.

6.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. For changes to core identity data such as your name or date of birth, re-submission of KYC documents will be required to prevent fraudulent amendment requests.

6.3 Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where the data has been processed unlawfully. This right is not absolute — criikex is required to retain certain categories of data (particularly transaction records and KYC documents) for legally mandated retention periods even after account closure. We will inform you clearly of what data can be deleted immediately and what must be retained, and for how long.

6.4 Right to Restriction of Processing

You may request that criikex restricts the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed, or where you contest the lawfulness of processing but do not want the data deleted pending resolution.

6.5 Right to Data Portability

Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive a copy of the personal data you provided to criikex in a structured, commonly used, machine-readable format (such as CSV or JSON). This right applies to data you have actively provided — for example, your profile information and transaction history — rather than derived or inferred data.

6.6 Right to Object

You have the right to object to processing of your personal data where criikex relies on legitimate interest as its legal basis. You also have an absolute right to object to processing of your data for direct marketing purposes at any time, with immediate effect.

6.7 Rights Related to Automated Decisions

Where criikex uses automated decision-making that produces significant effects on your account (as described in Section 2.1), you have the right to request human review of that decision, to express your point of view, and to contest the outcome. Submit such requests via live chat with your account username and a description of the decision you are contesting.

criikex retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, after which it is securely deleted or anonymised. The retention schedule below reflects our current policy as of January 2026.

Following the expiry of the applicable retention period, personal data is either permanently deleted from criikex's systems or irreversibly anonymised such that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for aggregate statistical analysis.

7.1 Accelerated Deletion Requests

Where a player requests erasure of their data under Section 6.3 and the applicable retention period has not yet expired, criikex will delete all data that is not subject to a legal retention obligation and will clearly communicate which categories of data must be retained and for how long. We do not use legal retention periods as a pretext to retain data beyond what is genuinely required.

criikex reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform. The effective date at the top of this policy will be updated whenever material changes are made.

8.1 Notification of Material Changes

Where a change to this Privacy Policy materially affects how we process your personal data — for example, a new category of data being collected, a new sharing arrangement with a third party, or a change to retention periods — we will notify registered players via their registered email address and via an on-screen notification upon next login. The notification will summarise the key changes and provide a link to the updated policy. Your continued use of the criikex platform after the effective date of the updated policy constitutes acceptance of the revised terms.

8.2 Contact for Privacy Queries

If you have any questions about this Privacy Policy, about how criikex handles your personal data, or about exercising any of your privacy rights, please contact our support team via 24/7 live chat on the criikex platform. Our support team is available in English and can escalate privacy-specific queries to our data protection contact where required.

Email for privacy-related correspondence: [email protected] (plain text — not a clickable link).