crtckex Privacy Policy — How We Collect, Use and Protect Your Personal Data

Section 1

Information We Collect

When you register and use crtckex, we collect a range of information necessary to operate the platform safely, verify your identity, process transactions, and comply with applicable legal obligations. We collect only what is reasonably necessary for these purposes and do not gather data speculatively.

The categories of personal data we collect are described in the table below, along with the specific circumstances in which each category is gathered:

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health information. If any such data is incidentally disclosed during a support interaction, it will not be stored, processed, or referenced beyond the resolution of that specific interaction.

Section 2

How We Use Your Information

crtckex processes your personal data only for specific, defined purposes. We do not use data in ways that are incompatible with the purpose for which it was originally collected. The primary purposes for which we process personal data are set out below:

• Account Management: To create, maintain, and administer your crtckex player account, including authentication, password recovery, and account preferences.
• Identity Verification (KYC): To verify your age (18+) and identity in accordance with our responsible gaming obligations. KYC is mandatory before any withdrawal can be processed.
• Transaction Processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and bank transfer, and to maintain accurate financial records for your account.
• Platform Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and other prohibited conduct.
• Responsible Gaming: To monitor play patterns for signs of problem gambling and to enforce self-exclusion requests, deposit limits, and other player-protection measures you have set.
• Customer Support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality and training purposes.
• Service Improvement: To analyse aggregated usage data in order to improve game selection, platform performance, payment flows, and the overall player experience.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform news — but only where you have opted in to receive such communications. You may opt out at any time.

Every processing activity carried out by crtckex rests on at least one lawful basis: contract performance (to deliver the service you signed up for), legal obligation (KYC and anti-money-laundering requirements), legitimate interest (fraud prevention and security), or your explicit consent (marketing communications).

Section 3

Data Sharing and Disclosure

crtckex does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. We share data only to the extent strictly necessary to operate the platform, meet legal obligations, or protect the rights and safety of our players and the Company. The categories of recipients with whom we may share your data are as follows:

• Payment Processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, City Bank, Visa, and Mastercard receive the minimum data required to authorise and complete your financial transactions. These processors operate under their own privacy frameworks and security standards.
• Game Technology Providers: Third-party game studios such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming may receive anonymised session identifiers to deliver game content. These providers do not receive your full name, contact details, or financial information.
• KYC and Identity Verification Services: Specialist identity verification partners may receive your submitted documents solely for the purpose of confirming your identity and age. These partners are bound by strict data processing agreements with crtckex.
• Fraud Detection and Analytics Providers: Security and analytics tools receive technical and usage data (IP address, device fingerprint, session data) to help us identify suspicious activity. This data is pseudonymised wherever possible.
• Law Enforcement and Regulatory Authorities: Where required by a valid legal order, court ruling, or regulatory investigation, crtckex will disclose the minimum data necessary to comply with that legal obligation. We will notify affected players of such disclosures where we are legally permitted to do so.
• Business Successors: In the event of a merger, acquisition, or sale of substantially all of our business assets, your personal data may be transferred to the acquiring entity, which will be required to honour this Privacy Policy or provide you with notice of any material changes.

Section 4

Cookies and Tracking Technologies

crtckex uses cookies and similar lightweight tracking technologies (such as local storage tokens and session identifiers) to operate the platform efficiently, keep you securely logged in, and understand how players interact with our features. We do not use advertising cookies and we do not participate in cross-site tracking networks.

The cookies deployed on crtckex fall into the following categories:

Strictly necessary cookies cannot be disabled as they are essential to the functioning of the platform — disabling them would prevent you from logging in or using core features. Functional and analytics cookies can be managed through your browser settings or the cookie preference panel within your Account Settings. Disabling functional cookies may reduce the quality of your experience but will not prevent you from placing bets or making transactions.

Section 5

Data Retention and Storage

crtckex retains your personal data only for as long as is necessary to fulfil the purpose for which it was collected or to comply with applicable legal and regulatory requirements. The retention periods we apply are as follows:

• Active Account Data: For as long as your crtckex account remains open and active. If your account becomes inactive (no login for 24 consecutive months), we will notify you before archiving or deleting account data.
• Financial Transaction Records: A minimum of 5 years from the date of the transaction, in compliance with financial record-keeping obligations applicable to online payment processing.
• KYC and Identity Documents: A minimum of 5 years from the date of account closure or the last transaction, in line with standard anti-money-laundering record retention requirements.
• Support Communications: Up to 3 years from the date of the interaction, to allow for reference in the event of a follow-up complaint or dispute.
• Marketing Preference Records: For the duration of your account, plus 1 year after closure, to demonstrate compliance with opt-in requirements and to honour opt-out requests if you re-register.
• Technical and Log Data: Up to 13 months from the date of recording, after which logs are either deleted or irreversibly anonymised.

All data stored by crtckex is held on secure servers protected by access controls, encryption at rest, and regular security audits. We engage only reputable infrastructure providers who have demonstrated compliance with recognised data security standards. Personal data is never stored on unencrypted portable devices or transmitted via unprotected channels.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised using methods that make re-identification impossible. Where data has been shared with a third-party processor, we instruct that processor to apply the same deletion standard within a reasonable timeframe following the conclusion of their processing engagement.

Section 6

Your Data Rights and Choices

crtckex recognises and respects your rights in relation to the personal data we hold about you. You may exercise any of the following rights at any time by contacting our support team at [email protected] with a clear description of your request:

• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed. We will respond to verified access requests within 30 days.
• Right of Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. You can update most contact information directly through your Account Settings panel.
• Right of Erasure: You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose it was collected or where you withdraw consent. Note that erasure requests may be declined where we are required to retain data by law (e.g., financial records).
• Right to Restrict Processing: You may request that we limit the processing of your data in specific circumstances, such as while an accuracy dispute is being investigated, or where processing is unlawful but you do not wish the data to be deleted.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request a structured, machine-readable copy of the data you have provided to us, suitable for transfer to another service provider.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming purposes and the use of your data for direct marketing. We will cease processing upon receiving a valid objection unless we can demonstrate compelling legitimate grounds.
• Marketing Opt-Out: You may withdraw consent to marketing communications at any time by adjusting your notification preferences in Account Settings or by replying "STOP" to any promotional message. Opt-out requests are processed within 5 business days.

We will verify your identity before processing any data rights request to ensure that personal data is not disclosed to an unauthorised party. In most cases, verification involves confirming details that match our account records. We aim to respond to all valid requests within 30 calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

Section 7

Data Security Measures

crtckex takes the security of your personal data seriously and has implemented a layered set of technical and organisational measures to protect it against unauthorised access, accidental loss, alteration, or disclosure. While no system can guarantee absolute security, we continuously review and strengthen our defences in response to emerging threats.

• TLS/SSL Encryption in Transit: All data exchanged between your browser or mobile device and our servers is encrypted using TLS 1.2 or higher, preventing eavesdropping or tampering during transmission.
• Encryption at Rest: Sensitive data fields — including identity document scans, financial reference numbers, and password hashes — are encrypted at rest using AES-256 encryption within our database infrastructure.
• Access Controls: Access to personal data within the crtckex organisation is granted on a strict need-to-know basis. Staff accounts are protected by multi-factor authentication and access logs are reviewed regularly by our security team.
• Penetration Testing: Our platform undergoes regular independent security assessments, including penetration testing and vulnerability scanning, to identify and remediate weaknesses before they can be exploited.
• Incident Response: In the event of a confirmed data breach that is likely to result in a high risk to your rights and freedoms, crtckex will notify affected players without undue delay and will take all reasonable steps to contain the breach and minimise its impact.
• Staff Training: All crtckex employees with access to personal data receive regular data protection and security awareness training to ensure they understand their obligations and can recognise social engineering and phishing attempts.

You also play a role in keeping your account secure. We strongly recommend enabling two-factor authentication, using a unique strong password, and never sharing your credentials with anyone. If you suspect your account has been accessed without your authorisation, contact our support team immediately at [email protected] so we can investigate and take protective action.

Section 8

Changes to This Privacy Policy

crtckex reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. When we make changes, we will revise the "Last updated" date at the top of this document and publish the new version on this page.

Where a change is material — meaning it significantly affects how we process your data or the rights available to you — we will provide advance notice via a prominent notice on the crtckex platform and, where we hold your email address, by sending you a direct notification. We will give you a reasonable period to review any material changes before they take effect. Your continued use of the platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically to stay informed about how crtckex is protecting and using your data. If you have any questions about this policy or about any specific data processing activity, please do not hesitate to reach our support team at [email protected]. We are committed to responding to all data-related enquiries promptly and transparently.

This Privacy Policy was last reviewed and published on 1 January 2026 and supersedes all previous versions. The English-language version of this document is the definitive and authoritative version. In the event of any inconsistency between this Privacy Policy and any other document or communication, this Privacy Policy shall prevail.