Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how x8bd ("x8bd", "we", "us", or "our") collects, uses, stores, shares, and protects personal data provided by or collected from users ("you" or "your") who access or use the x8bd online casino and sports betting platform at https://x8bd.io (the "Platform").

By registering an account on x8bd, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

This Policy should be read alongside x8bd's Terms & Conditions and Responsible Gaming policy, both of which are incorporated by reference into the overall framework governing your use of the Platform.

This Policy applies to all registered members, visitors browsing the Platform without an account, and any individual whose personal data is processed by x8bd in connection with the services we provide. It covers data collected through the website, any associated mobile application, email communications, customer support interactions, and payment processing flows.

2 Data Controller

x8bd is the data controller responsible for the personal data processed under this Policy. As data controller, x8bd determines the purposes for which your personal data is collected and the means by which it is processed. x8bd operates as an internationally licensed online gaming platform serving players in Bangladesh and other permitted markets.

For all data protection enquiries, requests to exercise your rights, or concerns about how x8bd handles your personal data, you may contact our Data Protection team directly:

3 Data We Collect

x8bd collects personal data in several categories, depending on the nature of your interaction with the Platform. The table below summarises the categories of data we collect and provides examples of the specific data points within each category.

x8bd does not intentionally collect special category data (such as racial or ethnic origin, religious beliefs, health data, or political opinions) unless legally required to do so in the context of a specific regulatory or AML compliance obligation. If such data is inadvertently submitted, it will be deleted as soon as reasonably practicable.

4 How We Collect Data

x8bd collects your personal data through a combination of direct provision by you, automated technical collection, and information received from trusted third-party partners. The primary collection mechanisms are as follows:

• Direct Provision: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, submit a complaint, or update your account profile, you directly provide us with personal data.
• Automated Technical Collection: When you visit and interact with the x8bd Platform, our servers automatically collect technical data including your IP address, device identifiers, browser type, referring URL, and session activity. This occurs regardless of whether you are logged in to an account.
• Cookies and Similar Technologies: x8bd uses first-party cookies, session cookies, and similar tracking technologies to maintain your session state, remember your preferences, and analyse Platform usage patterns. See Section 8 for full details.
• Payment Providers: When you make a deposit or withdrawal via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, or BRAC Bank, the payment provider confirms transaction status and transmits limited payment reference data to x8bd to credit or debit your account accordingly.
• KYC Verification Partners: x8bd works with specialist Know Your Customer (KYC) verification service providers to validate the identity and age of account holders. These partners may return verification status, document validity flags, and risk scores derived from the documents you submit.
• Game Providers: Third-party game studios including Pragmatic Play, Evolution Gaming, PG Soft, Ezugi, NetEnt, Habanero, Microgaming, and Spribe transmit game session logs and outcome data to x8bd for purposes of account crediting, dispute resolution, and responsible gaming monitoring.

5 How We Use Your Data

x8bd uses your personal data only for specific, defined purposes directly related to the operation of the Platform and the delivery of our services. We do not use your data for purposes incompatible with those disclosed in this Policy without obtaining fresh consent. The purposes for which we use your data are:

• Account Management: To create, maintain, verify, and administer your x8bd account, including processing your registration, authenticating your identity at login, and applying your account preferences.
• Age and Identity Verification: To confirm that you meet the mandatory minimum age of 21 years and to verify that the identity you have provided is accurate, as required by our responsible gaming obligations and AML compliance framework.
• Payment Processing: To process deposits into and withdrawals from your x8bd account via your chosen payment method (bKash, Nagad, Rocket, Upay, or bank transfer), and to maintain an accurate transaction ledger for your account.
• Service Delivery: To provide access to the sports betting markets, live casino tables, slots library, and card game products available on the Platform, and to credit or debit your account with winnings and losses accurately.
• Customer Support: To respond to your enquiries, resolve complaints, investigate disputes, and provide 24/7 assistance via live chat and email.
• Responsible Gaming: To monitor gaming patterns for indicators of problem gambling, to apply deposit limits, session time controls, cooling-off periods, and self-exclusion status that you have set, and to proactively intervene where our responsible gaming monitoring system flags a concern.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, bonus abuse, money laundering, collusion, and other prohibited conduct as defined in our Terms & Conditions.
• Legal and Regulatory Compliance: To comply with applicable AML obligations, to respond to lawful requests from regulatory or law enforcement authorities, and to maintain transaction records for the legally required retention periods.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may withdraw your marketing consent at any time by contacting support or updating your account preferences.
• Platform Improvement: To analyse anonymised and aggregated usage data to improve the x8bd Platform, optimise game performance, enhance the user interface, and develop new features.

6 Legal Basis for Processing

x8bd processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: The majority of x8bd's data processing is necessary for the performance of the contract between you and x8bd (i.e., the Terms & Conditions you accepted at registration). This includes account creation, payment processing, game session management, and customer support.
• Legal Obligation: Certain processing activities are required by law, including AML compliance record-keeping, age verification, identity verification, and the provision of information to regulatory authorities upon lawful request.
• Legitimate Interests: x8bd processes some data on the basis of its legitimate interests as a business, where those interests are not overridden by your rights and freedoms. This includes fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics.
• Consent: Where x8bd relies on your consent as the legal basis for processing — primarily in the context of direct marketing communications and optional profiling — you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

7 Data Sharing & Disclosure

x8bd does not sell, rent, or trade your personal data to third parties for their own commercial marketing purposes. We share your personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, and BRAC Bank receive the transaction data necessary to process your deposit or withdrawal request. These providers operate under their own privacy policies and are independent data controllers in respect of your payment account information.
• KYC & Identity Verification Partners: x8bd shares the identity documents you submit (national ID, passport, selfie) with specialist KYC verification providers solely for the purpose of verifying your age and identity. Verified results are returned to x8bd; the raw documents are not retained by these partners beyond their own contractual obligations.
• Game Studio Providers: Pragmatic Play, Evolution Gaming, PG Soft, Ezugi, NetEnt, Habanero, Microgaming, Spribe, and other integrated game providers receive a session token and account identifier sufficient to load games and transmit outcomes. They do not receive your full identity or financial data.
• Fraud Prevention & Security Services: x8bd works with third-party risk and fraud detection providers who receive technical data (IP addresses, device fingerprints, behavioural patterns) to identify and block fraudulent activity. This processing occurs under data processing agreements that restrict secondary use.
• Legal and Regulatory Authorities: x8bd may disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory authorities where required to do so by a lawful order, court order, or binding legal obligation. x8bd will notify you of such disclosures where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, or sale of all or part of x8bd's business, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections.

8 Cookies & Tracking Technologies

x8bd uses cookies and similar tracking technologies to ensure the Platform functions correctly and to provide a personalised, secure experience. The following categories of cookies are used on the x8bd Platform:

Strictly necessary cookies cannot be disabled as they are essential for the Platform to function. Functional, analytics, and security cookies may be managed through your browser settings. Note that disabling certain functional or security cookies may impair your experience on the Platform or reduce the security of your account.

x8bd does not use third-party advertising cookies or permit third-party ad networks to place tracking cookies on the x8bd Platform. No cross-site advertising profile is built from your x8bd activity.

9 Data Retention

x8bd retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Account and Identity Data: Retained for the duration of your account plus a minimum of 5 years following account closure, to satisfy AML record-keeping obligations and to defend against potential legal claims.
• Transaction and Financial Records: Retained for a minimum of 5 years from the date of each transaction, in accordance with standard financial record-keeping obligations applicable to international online gaming operators.
• Gaming Activity Logs: Retained for a minimum of 3 years from the date of each session, for purposes of dispute resolution, responsible gaming monitoring, and regulatory compliance.
• Customer Support Communications: Retained for 2 years from the date of the final communication in each support thread, to provide context for follow-up enquiries and to support complaint investigations.
• Marketing Preference Records: Retained for the duration of your account plus 1 year following account closure or marketing opt-out, to maintain a suppression list and evidence of consent/withdrawal.
• Technical and Analytics Data: Anonymised aggregated analytics data may be retained indefinitely. Identifiable technical data (e.g., IP logs) is retained for a maximum of 12 months.

Following expiry of the applicable retention period, your personal data will be securely deleted or irreversibly anonymised. Data that has been anonymised beyond reasonable re-identification falls outside the scope of this Policy and may be retained and used by x8bd for analytical and business improvement purposes without time limitation.

10 Data Security

x8bd takes the security of your personal data seriously and implements a layered set of technical and organisational security measures to protect your data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and x8bd's servers is encrypted using 256-bit SSL/TLS. This applies to account login flows, payment transactions, game sessions, and customer support communications.
• Password Hashing: x8bd does not store your password in plain text. Passwords are hashed using a strong one-way cryptographic algorithm (bcrypt with a per-user salt). Even x8bd staff cannot retrieve your plain-text password.
• Two-Factor Authentication (2FA): x8bd supports SMS-based 2FA for account login and sensitive account changes. Members are strongly encouraged to enable 2FA. x8bd may enforce mandatory 2FA before processing certain high-value withdrawals.
• Access Controls: Access to personal data within x8bd's systems is restricted on a strict need-to-know basis. Staff are granted the minimum level of access required to perform their role. Access permissions are reviewed regularly and revoked upon role change or departure.
• Server Security: x8bd's servers are hosted in access-controlled, monitored data centre environments. Firewalls, intrusion detection systems, and regular penetration testing are employed to identify and remediate vulnerabilities.
• Incident Response: x8bd maintains a documented data breach response procedure. In the event of a security incident that poses a material risk to your rights and freedoms, x8bd will notify affected users promptly and take immediate remedial action.

Despite these measures, no online platform can guarantee absolute security. You are responsible for keeping your account credentials confidential and for logging out of your account when using shared devices. If you suspect your account has been compromised, contact x8bd support immediately at [email protected].

11 Your Rights

As a data subject whose personal data is processed by x8bd, you hold the following rights in respect of that data. To exercise any of these rights, please contact x8bd at [email protected] with the subject line "Data Subject Rights Request":

• Right of Access: You have the right to request a copy of the personal data that x8bd holds about you (commonly known as a Subject Access Request or SAR). x8bd will respond within 10 business days of receiving a valid, verified request.
• Right to Rectification: If the personal data x8bd holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For minor corrections (e.g., updating a contact number), you may do this directly via your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where the processing was unlawful. This right is subject to x8bd's legal retention obligations — data that must be retained for AML or regulatory compliance cannot be deleted on request.
• Right to Restriction of Processing: You may request that x8bd restricts the processing of your personal data in certain circumstances, such as while the accuracy of data is contested or while a complaint is being investigated.
• Right to Data Portability: You have the right to receive the personal data you provided to x8bd in a structured, commonly used, machine-readable format (e.g., CSV or JSON), and to request that x8bd transmit that data directly to another controller where technically feasible.
• Right to Object: You may object at any time to x8bd processing your personal data on the basis of legitimate interests, including profiling based on legitimate interests. You may also object at any time to direct marketing communications, and x8bd will act on that objection immediately.
• Right to Withdraw Consent: Where x8bd's processing of your data is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

x8bd will not charge a fee for handling data subject rights requests unless the request is manifestly unfounded or excessive. In such cases, x8bd may charge a reasonable administrative fee or decline to act on the request, and will explain why.

12 Children's Privacy

x8bd strictly prohibits access to and use of the Platform by anyone under the age of 21. The Platform is designed exclusively for adults aged 21 and above. x8bd does not knowingly collect, process, or store personal data from individuals under the age of 21.

If x8bd discovers or has reasonable grounds to believe that personal data has been collected from an individual under 21 years of age, x8bd will immediately close the associated account, void any wagering activity, return deposited funds where technically possible, and securely delete all personal data associated with that account.

If you are a parent or guardian and believe that your child (under 21 years of age) may have registered an account on x8bd, please contact us immediately at [email protected] with the subject line "Underage Account Report". x8bd will investigate and respond within 24 hours.

13 Third-Party Links

The x8bd Platform may display references to third-party game providers, payment partners, and sports organisations (such as BPL, IPL, and ICC) in the context of providing our services. These references do not constitute endorsements, and x8bd is not responsible for the privacy practices of any third-party organisation whose services are accessible through or referenced on the Platform.

Each third-party service provider (including game studios and payment processors) operates under its own privacy policy. x8bd encourages you to review the privacy policies of any third-party services you interact with in connection with your use of x8bd, particularly those of your chosen payment provider (bKash, Nagad, Rocket, or Upay).

x8bd has no control over, and accepts no responsibility for, the content, data collection practices, or privacy policies of any third-party provider accessed through the Platform. Your interactions with third-party services are solely between you and that third party.

14 Policy Updates

x8bd reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal standards. The "Effective Date" displayed at the top of this Policy indicates when the current version came into force.

Where changes to this Policy are material — meaning they significantly affect your rights, the categories of data we collect, or the purposes for which we use your data — x8bd will provide at least 7 days' advance notice via a notice displayed on the Platform homepage and, where appropriate, by direct email to registered account holders.

For minor, non-material changes (such as editorial clarifications or corrections to formatting), x8bd may update this Policy without advance notice. In all cases, the version published on the Platform at any given time is the version in force. Your continued use of the x8bd Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

We encourage you to review this Policy periodically. If you have concerns about any update to this Policy, please contact our Data Protection team at [email protected] before continuing to use the Platform.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which x8bd processes your personal data, please get in touch with our team using the contact details below:

x8bd is committed to resolving all privacy-related concerns fairly and promptly. If you remain dissatisfied with our response to your privacy enquiry, you may escalate your concern to x8bd's third-party dispute resolution body. Details are available upon request from the support team.