crckx Privacy Policy
Your privacy is a fundamental priority at crckx. This Privacy Policy sets out in plain terms exactly what personal data we collect when you use Bangladesh's premier online casino platform, how we use and protect that data, who we may share it with, and what rights you hold over your own information. We encourage every crckx player to read this document carefully before registering or depositing.
256-bit SSL Encryption
Your data is always protected
Please Read in Full: This Privacy Policy forms part of the crckx Terms & Conditions and constitutes a legally binding agreement between you and crckx regarding the processing of your personal data. By registering an account or using the crckx platform, you acknowledge that you have read and understood this policy. If you have any questions, contact our support team via live chat before registering.
Section 1
Information We Collect
crckx collects personal data from you in three primary ways: information you provide directly during account registration and ongoing platform use, information we collect automatically as you interact with the crckx platform, and information we may receive from third-party partners such as payment processors and identity verification services.
Information You Provide Directly
- Registration data: Full legal name, date of birth, email address, mobile phone number, and country of residence (Bangladesh).
- Identity verification (KYC) documents: Copies of government-issued photo identification (National ID card, passport, or driving licence) and proof of address (utility bill or bank statement).
- Payment information: Mobile wallet account identifiers (bKash number, Nagad number, Rocket number, Upay number), card details (for Visa/Mastercard transactions processed via our PCI-compliant payment gateway), and transaction history.
- Communications: Messages you send to crckx support via live chat, email at [email protected], or WhatsApp, and any responses or case notes generated in the course of providing support.
- Preferences and settings: Responsible gaming tool settings (deposit limits, loss limits, self-exclusion status), marketing communication preferences, and language/display settings.
Information Collected Automatically
- Device and technical data: IP address, device type, operating system version, browser type and version, screen resolution, and device identifiers.
- Usage data: Pages visited on crckx, games launched, bet history, session duration, login timestamps, and navigation path through the platform.
- Location data: General geographic location inferred from IP address (used for fraud prevention and regulatory compliance — not precise GPS location).
- Cookies and similar technologies: See the Cookies & Tracking section below for full details.
Information from Third Parties
crckx may receive supplementary personal data from third-party identity verification providers, payment processors, and fraud-prevention services engaged as part of our KYC and anti-money-laundering (AML) compliance obligations. This data is used solely for the purposes of verifying your identity, processing your transactions, and protecting the platform against fraud.
Minimum Data Principle: crckx collects only the personal data that is genuinely necessary for the purposes described in this policy. We do not collect data speculatively or beyond what is required to operate the platform safely, legally, and effectively for our Bangladesh players.
| Data Category | Collection Point |
|---|---|
| Name & Date of Birth | Registration |
| Email & Phone | Registration |
| KYC Documents | Verification stage |
| Payment Details | Deposit / Withdrawal |
| IP & Device Data | Automatic (all sessions) |
| Bet & Game History | Automatic (platform use) |
| Support Communications | Live chat / Email |
Section 2
How We Use Your Data
crckx processes your personal data only for clearly defined, legitimate purposes. We do not sell your personal data to third parties for commercial marketing purposes. The following table summarises the primary purposes for which crckx uses your personal data, together with the legal basis for that processing:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account registration and management | Name, email, phone, date of birth | Contractual necessity |
| Identity verification (KYC / AML) | KYC documents, payment details, IP address | Legal obligation |
| Processing deposits and withdrawals | Payment identifiers, transaction data | Contractual necessity |
| Fraud detection and prevention | IP address, device data, bet history | Legitimate interest |
| Responsible gaming compliance | Bet history, session data, limit settings | Legal obligation / legitimate interest |
| Customer support | Communications, account data | Contractual necessity |
| Platform improvement and analytics | Usage data, device data (anonymised) | Legitimate interest |
| Promotional communications (opt-in) | Email, phone number | Consent |
| Regulatory reporting and compliance | Transaction data, KYC documents | Legal obligation |
crckx will not use your personal data for any purpose incompatible with those listed above without first obtaining your explicit consent or identifying a new lawful basis. If we introduce a new processing purpose in the future, this Privacy Policy will be updated accordingly and you will be informed via the on-platform notification system or by email.
Where crckx relies on legitimate interest as the legal basis for processing, we have conducted a balancing test to confirm that our legitimate interests are not overridden by your rights and interests as a data subject. If you wish to obtain further information about any specific legitimate interest assessment, please contact us at [email protected].
Section 4
Data Sharing
crckx does not sell, rent, or trade your personal data to third parties for their own commercial purposes. However, in order to operate the platform and meet our legal obligations, crckx shares limited personal data with a defined set of trusted third-party service providers and, where required by law, with regulatory and law enforcement authorities. The categories of recipients are described below.
Service Providers
- Payment processors: bKash, Nagad, Rocket, Upay, and card-payment gateway providers receive the minimum necessary payment identifiers required to process your deposits and withdrawals. These providers operate under their own privacy policies and are bound by contractual obligations with crckx to protect your data.
- Identity verification partners: Third-party KYC and AML service providers receive copies of your identity documents and associated personal data solely for the purpose of completing mandatory verification checks. Data shared with these partners is not used by them for any other purpose.
- Game providers: When you launch a game from a third-party studio (such as Pragmatic Play, Evolution Gaming, Spribe, or Microgaming), limited technical data (such as a pseudonymous player token and session identifier) is passed to that provider's game server. Game providers do not receive your full registration details, financial data, or KYC documents.
- Analytics and security vendors: Anonymised and pseudonymised usage data may be shared with analytics and fraud-detection service providers engaged by crckx to monitor platform integrity and improve user experience.
Legal and Regulatory Disclosures
crckx will disclose personal data to governmental, regulatory, or law enforcement authorities where we are required to do so by law, by a valid court order, or in order to protect the safety and rights of crckx, its players, or third parties. crckx will, where legally permissible, notify affected players of any such disclosure request.
Business Transfers
In the event that crckx undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, personal data held by crckx may form part of the transferred assets. In such an event, crckx will take reasonable steps to ensure that the acquiring entity honours the commitments made in this Privacy Policy, or will notify affected players and provide an opportunity to delete their accounts before data is transferred.
Section 5
Data Retention
crckx retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable legal, regulatory, or contractual obligations. The following general retention periods apply:
- Active account data: Retained for the full duration of your account's active status on crckx, plus a minimum post-closure period as described below.
- Transaction and financial records: Retained for a minimum of five years following the date of each transaction, in compliance with standard financial record-keeping obligations applicable to offshore gaming platforms.
- KYC and identity documents: Retained for a minimum of five years following account closure or the completion of the relevant KYC check, in compliance with anti-money-laundering record-keeping standards.
- Support communications: Retained for three years from the date of the most recent communication in each support case, to enable follow-up and dispute resolution.
- Analytics data: Aggregated and anonymised analytics data may be retained indefinitely as it no longer constitutes personal data once de-identified. Pseudonymised analytics data is retained for a maximum of 24 months.
- Self-exclusion records: Records of permanent self-exclusion are retained indefinitely to ensure that the exclusion can be enforced if the same individual attempts to re-register using different details.
When personal data is no longer required and its retention period has expired, crckx will securely delete or irreversibly anonymise it. Secure deletion procedures are applied to all storage media containing personal data.
| Data Type | Retention Period |
|---|---|
| Account registration data | Active + 5 years post-closure |
| Transaction records | 5 years minimum |
| KYC documents | 5 years post-closure |
| Support communications | 3 years |
| Pseudonymised analytics | 24 months |
| Self-exclusion records | Indefinite |
Account Closure Note: Closing your crckx account does not result in the immediate deletion of all personal data. Certain records are retained for the periods shown above in order to meet legal and regulatory obligations. You may submit a data deletion request after the applicable retention period has expired.
Section 6
Data Security
crckx implements a layered, defence-in-depth approach to protecting the personal data of Bangladesh players. Our security measures are reviewed and updated on a regular basis to address emerging threats and to reflect evolving industry best practice. The following is a summary of the technical and organisational security measures crckx maintains.
256-Bit SSL Encryption
All data transmitted between your browser or device and crckx servers is encrypted using 256-bit SSL/TLS protocols, preventing interception by third parties during transit.
Encrypted Data Storage
Sensitive personal data — including KYC documents and financial identifiers — is stored in encrypted form on crckx servers. Encryption keys are managed separately from the encrypted data itself.
Access Controls
Access to personal data within crckx systems is restricted on a strict need-to-know basis. Staff access is controlled by role-based permissions, multi-factor authentication, and comprehensive audit logging.
Fraud Monitoring
Automated fraud detection systems monitor platform activity in real time, flagging unusual access patterns, suspicious transaction sequences, and potential account compromise attempts for immediate review.
PCI-Compliant Payments
Card payment processing is handled by PCI DSS-compliant third-party processors. crckx does not store raw card numbers, CVV codes, or full card data on its own servers.
Regular Security Reviews
crckx conducts periodic internal security reviews and vulnerability assessments. Any identified security gaps are remediated according to a risk-prioritised schedule.
Data Breach Notification: In the event of a personal data breach that poses a risk to your rights and interests, crckx will notify affected players without undue delay and will take all reasonable steps to contain the breach and mitigate its impact. You should report any suspected compromise of your crckx account credentials to [email protected] or via live chat immediately.
Section 7
Your Rights
As a crckx player, you hold a number of rights over your personal data. crckx is committed to honouring these rights in a timely and transparent manner. To exercise any of the rights listed below, please submit a request via live chat on the crckx platform or by email to [email protected]. crckx will respond to all valid data rights requests within a reasonable period and will not charge a fee for handling routine requests.
Right of Access
You have the right to request a copy of the personal data crckx holds about you, along with information about how that data is being processed and the legal basis for each processing activity.
Right to Rectification
If any personal data crckx holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay. Some corrections may require supporting documentation.
Right to Erasure
You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to crckx's legal retention obligations. Data subject to mandatory retention cannot be deleted before its retention period expires.
Right to Restrict Processing
You may request that crckx restrict the processing of your data in specific circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.
Right to Data Portability
Where processing is based on your consent or on a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to request that it be transferred to another controller where technically feasible.
Right to Object
You have the right to object to the processing of your personal data where crckx relies on legitimate interest as the legal basis. crckx will cease that processing unless it can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where crckx processes your data on the basis of your consent (for example, for promotional communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Right to Lodge a Complaint
If you believe crckx has not handled your personal data in accordance with this Privacy Policy, you have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction where crckx is incorporated.
Identity Verification for Data Requests: To protect the security of your personal data, crckx may ask you to verify your identity before processing any data rights request. This is to ensure that personal data is not disclosed to, amended by, or deleted at the request of an unauthorised third party. Verification is typically completed via your registered email address or by answering account-level security questions.
Section 8
Contact & DPO
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way crckx processes your personal data, please contact us through any of the following channels. crckx is committed to responding to all privacy-related enquiries promptly and transparently.
Customer Support (General Enquiries)
- Live chat: Available 24 hours a day, 7 days a week, directly on the crckx platform. This is the fastest route for general privacy enquiries and data access requests.
- Email: [email protected] — for written enquiries, data subject access requests, erasure requests, and portability requests. Please use the subject line "Privacy Request" to ensure prompt routing.
- WhatsApp: Available between 08:00 and 24:00 Bangladesh Standard Time (BST, UTC+6) for general account and privacy queries.
Data Protection Officer
crckx has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and for handling escalated data protection matters. If your privacy concern has not been resolved satisfactorily through standard customer support channels, you may escalate it to the crckx DPO by submitting a written request via email to [email protected] with the subject line "DPO Escalation". The DPO will acknowledge your escalation within five business days and will aim to provide a full response within 30 days.
Updates to This Privacy Policy
crckx reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or improvements to our platform. When material changes are made, the "Last Updated" date at the top of this page will be revised and, where appropriate, registered players will be notified via on-platform notification or email. We encourage all crckx players to review this Privacy Policy periodically. Your continued use of the crckx platform following any update constitutes your acceptance of the revised policy.
For complete details of your account-level rights and obligations, please also review the crckx Terms & Conditions and our Responsible Gaming Policy.
24/7 Live Chat Support
The fastest way to reach crckx regarding any privacy matter is via live chat, available around the clock on the crckx platform. Our support team can handle most data requests directly or escalate to the DPO where needed.
Email Privacy Requests
For formal data subject access requests, erasure requests, or portability requests, email [email protected] with the subject "Privacy Request". crckx targets a response within 30 days of receiving a valid, verified request.
Response Timeline: crckx aims to acknowledge all privacy-related enquiries within two business days and to provide a substantive response within 30 calendar days. Complex requests requiring identity verification or legal review may take up to an additional 30 days, and crckx will notify you if an extension is required.
Our Commitment
Why crckx Takes Privacy Seriously
No Data Sales — Ever
crckx has never sold player personal data to third-party commercial advertisers and has no plans to do so. Your data is used only to operate and improve the crckx platform and to meet our legal obligations.
KYC Done Right
Identity verification at crckx is conducted by certified third-party KYC providers. Your documents are processed in a secure, encrypted environment and are never shared beyond the verification workflow.
bKash & Nagad Privacy
When you deposit or withdraw via bKash, Nagad, Rocket, or Upay, crckx shares only the minimum necessary transaction data with those providers. Your crckx account data is not shared with mobile wallet operators beyond what is required to complete the transaction.
Anonymised Analytics
Platform usage analytics are processed in aggregated, anonymised form. crckx does not build individual behavioural profiles for advertising targeting and does not share usage data with ad networks.
Policy Kept Current
This Privacy Policy is reviewed regularly by the crckx compliance team. Any material change to data processing practices triggers an immediate policy update and player notification, keeping you informed at all times.
Consent-First Marketing
crckx sends promotional communications — bonus offers, tournament alerts, seasonal promotions for Eid, BPL, and IPL — only to players who have explicitly opted in. You can withdraw marketing consent at any time from your account settings.
Questions About Your Privacy?
Our support team is available 24/7 to help with any data-related enquiry. Explore the crckx platform, review our FAQ, or log in to manage your account and privacy settings.