criktex Privacy Policy

criktex collects personal data in three principal ways: directly from you when you register an account or interact with our platform; automatically through your use of the platform; and from third-party service providers involved in identity verification, payment processing, and fraud prevention.

1.1 Data You Provide Directly

When you register a criktex account or use our services, you provide us with the following categories of personal data:

1.2 Data Collected Automatically

When you visit or use the criktex platform, certain data is collected automatically by our systems. This includes:

• Device and Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
• Usage Data: Pages visited, features accessed, time spent on each page, click-path data, session start and end times, and referring URL.
• Location Data: General geographic location derived from your IP address (country and city level only — we do not collect GPS or precise location data).
• Cookie and Tracking Data: Session cookies, persistent cookies, and similar technologies as described in Section 4 of this policy.

1.3 Data from Third-Party Sources

criktex may receive personal data about you from the following third-party sources in order to verify your identity, detect fraud, and ensure the integrity of financial transactions:

• KYC and Identity Verification Providers: Third-party services that cross-reference your submitted documents against official identity databases to confirm authenticity.
• Payment Processors: bKash, Nagad, Rocket, Upay, and banking partners may share transaction confirmation data (including sender account reference numbers) to reconcile deposits and withdrawals.
• Fraud Prevention Services: We may receive risk signals or device fingerprint data from fraud detection partners to help identify suspicious account activity.

criktex does not purchase data lists from data brokers and does not receive personal data from social media platforms or advertising networks for targeting purposes.

criktex may share your personal data with the following categories of third parties, strictly limited to the purposes described:

3.1 Service Providers and Data Processors

We engage third-party companies to provide specific services on our behalf. These parties act as data processors and are contractually prohibited from using your data for any purpose beyond the specific service they provide to criktex. Service provider categories include:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Islami Bank, Sonali Bank, and card processing networks (Visa, Mastercard) receive transaction data necessary to process your deposits and withdrawals.
• KYC and Identity Verification Providers: Third-party services receive copies of your identity documents and personal details to perform identity checks on our behalf.
• Game Content Providers: Studios such as Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe receive a pseudonymous player identifier and session data to deliver game content. These providers do not receive your full name, contact details, or financial information through the game integration.
• Cloud Hosting and Infrastructure Providers: Our platform data, including player account information, is stored on secure cloud servers operated by our hosting partners. These partners are bound by strict data processing agreements and have no independent access to your personal data.
• Fraud Detection and Cybersecurity Services: We use third-party tools to detect bot activity, account takeover attempts, and suspicious transaction patterns. These tools may process your device data, IP address, and behavioural signals.

3.2 Legal and Regulatory Disclosure

criktex may disclose your personal data to law enforcement agencies, financial intelligence units, or other governmental authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of criktex, its players, or the public. Such disclosures will always be made in accordance with applicable legal requirements and will be limited to the minimum data necessary to fulfil the legal obligation.

3.3 Business Transfers

In the event that criktex undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. In such circumstances, criktex will notify registered players by email in advance and will ensure that the successor entity assumes equivalent data protection obligations under this Privacy Policy.

In all cases of data sharing, criktex maintains records of what data was shared, with whom, and on what legal basis. Players may request a summary of data sharing activity relating to their account by contacting [email protected].

criktex retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply to the principal categories of data we hold:

• Account and Identity Data: Retained for the full duration of your active account, plus a minimum of 5 years following account closure. This retention period is required to satisfy anti-money laundering (AML) record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping requirements applicable to payment service operations.
• KYC and Document Data: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Gaming and Betting Records: Retained for a minimum of 3 years from the date of each session or bet, and up to 5 years where a gaming record is associated with a dispute or investigation.
• Customer Support Records: Support tickets, live chat transcripts, and related communications are retained for 2 years from the date the support case was closed.
• Analytics Data (Aggregated): Anonymised usage analytics data that cannot be linked back to an individual player may be retained indefinitely for platform improvement purposes.
• Marketing Consent Records: Records of your opt-in consent for marketing communications are retained for the full duration of your account and for 1 year after account closure, to demonstrate compliance with consent obligations.

When a data retention period expires, criktex will securely delete or anonymise the relevant data. Where deletion is not technically immediately possible (for example, due to backup rotation schedules), the data will be isolated and protected until secure deletion can be completed. Players who have closed their accounts and wish to confirm that their data has been deleted upon expiry of the applicable retention period may contact [email protected].

As a player on the criktex platform, you have the following rights in relation to your personal data. These rights may be exercised at any time by contacting criktex at [email protected]. criktex will respond to all valid privacy rights requests within 30 calendar days of receipt.

• Right of Access: You have the right to request a copy of the personal data criktex holds about you, including information on how it is used and with whom it has been shared. This is sometimes referred to as a Subject Access Request (SAR).
• Right to Rectification: If any personal data criktex holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain data directly through your account settings on the criktex platform.
• Right to Erasure: You have the right to request that criktex delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent (and no other legal basis applies), or where the data has been unlawfully processed. This right is subject to overriding legal retention obligations — for example, criktex is required to retain transaction records for a minimum of 5 years and cannot delete them on request within that period.
• Right to Restriction of Processing: You have the right to request that criktex restrict the processing of your personal data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved, or while you are contesting the legitimacy of our processing.
• Right to Data Portability: Where processing is based on your consent or on contract performance, and is carried out by automated means, you have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data where that processing is based on our legitimate interests, including profiling for responsible gaming monitoring purposes. criktex will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, submit a written request to [email protected] from the email address registered to your criktex account. Include your full name, registered mobile number, and a description of the right you wish to exercise. For access requests, please indicate the specific categories of data you wish to receive. criktex may ask you to verify your identity before processing a request to protect against fraudulent access to another player's data.

criktex does not charge a fee for handling privacy rights requests unless a request is manifestly unfounded or excessive (for example, repetitive requests for the same data within a short period), in which case a reasonable administrative fee may apply. We will notify you of any applicable fee before proceeding.