crciex Privacy Policy —
Your Data, Your Rights

Data We Collect

When you register for and use the crciex Platform, we collect a range of personal data that is necessary to provide you with a safe, legal, and enjoyable gaming experience. The categories of data we collect, and the specific data points within each category, are described in the table below. We collect only the minimum data necessary for each stated purpose — a principle known as data minimisation.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (other than identity document photographs required for KYC), or health data, except where you voluntarily disclose health-related information in the context of a responsible gaming self-exclusion request.

crciex does not knowingly collect personal data from individuals under the age of 18. If we become aware that data has been collected from a minor, we will delete it immediately and close the associated account. If you believe a minor has registered on crciex, please notify us immediately at [email protected].

How We Use Your Data

crciex processes your personal data only for specific, legitimate purposes that are necessary to operate the Platform, fulfil our legal obligations, and protect the interests of all players. We do not use your data for any purpose that is incompatible with the purposes described below.

• Account management: To create, maintain, and secure your crciex account, verify your identity, and manage your profile settings and preferences.
• Service delivery: To provide access to all crciex games — including Slots, Cricket Betting, Poker, Treasure Boat Fishing, and live casino products — and to process your bets, transactions, and bonus claims.
• Payment processing: To process deposits and withdrawals via bKash, Nagad, Rocket, Upay, and supported bank channels, and to maintain accurate financial records of all transactions.
• Legal compliance (KYC/AML): To verify your identity and age as required for anti-money-laundering (AML) compliance, fraud prevention, and regulatory reporting obligations. This is a legal obligation we cannot waive.
• Responsible gaming: To monitor gaming patterns and identify signs of problem gambling, apply self-exclusion or deposit-limit restrictions at your request, and send welfare communications where appropriate.
• Customer support: To respond to your queries, complaints, and requests submitted via live chat, email, or support ticket systems.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, account takeovers, collusion, bonus abuse, and any other behaviour that violates our Terms & Conditions.
• Platform improvement: To analyse aggregated, anonymised usage data in order to improve game selection, website performance, and the overall user experience on crciex.
• Marketing communications: To send you promotional offers, bonus notifications, and news about new games or features — but only where you have given explicit consent to receive such communications. You may withdraw consent at any time.
• Legal proceedings: To establish, exercise, or defend legal claims in the event of disputes, and to comply with court orders or requests from law enforcement agencies.

Data Sharing & Disclosure

crciex does not sell your personal data. We may share your data with trusted third-party service providers strictly on a need-to-know basis and only to the extent necessary to fulfil the purposes described in this Privacy Policy. All third-party partners are contractually bound to process your data only as instructed by crciex and to maintain appropriate security standards.

• Payment processors: bKash, Nagad, Rocket, Upay, and supported banks receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and regulatory obligations.
• Game providers: Third-party game studios such as Pragmatic Play, Evolution Gaming, Spribe, Ezugi, NetEnt, and Microgaming may receive anonymised session data to facilitate game delivery and resolve game-related disputes. They do not receive your full identity or financial details.
• Identity verification partners: KYC verification services may process your identity documents (NID, passport) to confirm your identity and age. These providers operate under strict data processing agreements.
• Analytics providers: Aggregated, anonymised usage data may be shared with web analytics services to help us understand how the Platform is used and how it can be improved. No personally identifiable information is shared for analytics purposes.
• Legal and regulatory authorities: crciex may disclose your personal data to law enforcement agencies, regulatory bodies, financial intelligence units, or courts when required by law or in response to a valid legal request. We will notify you of such disclosures where permitted by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of crciex's business assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and your rights will be preserved.

crciex does not transfer your personal data to countries outside of your region without ensuring appropriate safeguards are in place, such as standard contractual clauses or equivalent data protection agreements. Where data is processed by game providers located in other jurisdictions, crciex requires those providers to maintain data protection standards consistent with this Privacy Policy.

Cookies & Tracking Technologies

crciex uses cookies — small text files stored on your device — and similar tracking technologies to operate the Platform effectively, remember your preferences, and understand how you use our services. The following table summarises the types of cookies we use and their purpose.

crciex does not use third-party advertising cookies or behavioural tracking cookies that follow you across other websites. We do not share cookie data with advertising networks. Essential and security cookies cannot be disabled as they are strictly necessary for the Platform to function. Analytics and functional cookies may be managed through your browser settings.

Data Retention

crciex retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and contractual obligations. The following retention periods apply:

• Active account data: Retained for the duration of your active account relationship with crciex, plus a minimum of five (5) years following account closure, as required by anti-money-laundering regulations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of account closure or last transaction, in compliance with AML and financial record-keeping obligations.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the relevant transaction. Certain financial records may be retained for up to seven (7) years where required by applicable law.
• Communications and support records: Retained for up to three (3) years from the date of the last communication, or longer if related to an unresolved dispute or legal proceeding.
• Gaming activity logs: Retained for up to three (3) years for responsible gaming monitoring and dispute resolution purposes.
• Marketing consent records: Retained for as long as you remain subscribed, plus one (1) year following unsubscription, as evidence of your consent history.
• Technical and security logs: Retained for up to twelve (12) months for fraud detection and security investigation purposes.

Upon expiry of the applicable retention period, crciex will securely delete or anonymise your personal data so that it can no longer be linked to you as an individual. Where anonymisation is used rather than deletion, the anonymised data may be retained indefinitely for statistical and research purposes.

If you submit a request for erasure of your personal data, crciex will delete or anonymise your data as requested, subject to overriding legal retention obligations. In cases where retention is legally required, we will restrict processing of your data to only those purposes mandated by law and will notify you of this restriction.

Your Privacy Rights

As a user of the crciex Platform, you have a comprehensive set of rights with respect to your personal data. crciex is committed to honouring these rights promptly and transparently. All rights requests should be submitted to [email protected] with the subject line "Privacy Rights Request" and include your registered email address and account username for identity verification purposes.

crciex will respond to all verified privacy rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by up to an additional 30 days, in which case we will notify you of the extension and the reason for it. There is no charge for submitting a privacy rights request. However, if requests are manifestly unfounded, repetitive, or excessive, crciex reserves the right to charge a reasonable administrative fee or decline to act.

Data Security

crciex implements a multi-layered security framework to protect your personal data from unauthorised access, loss, alteration, or disclosure. Our security measures include both technical controls and organisational practices, and are reviewed and updated regularly to address evolving threats.

• 256-bit SSL/TLS encryption: All data transmitted between your browser or device and crciex servers is encrypted using industry-standard TLS protocols. This ensures that data cannot be read or modified in transit.
• Password hashing: Your account password is never stored in plain text. crciex uses a strong one-way cryptographic hashing algorithm (bcrypt) to store password credentials. Even crciex staff cannot view your password.
• Two-factor authentication (2FA): crciex offers optional 2FA for all accounts, providing an additional layer of login security via a time-based one-time password (TOTP) application.
• Access controls: Access to personal data within crciex's internal systems is restricted to authorised personnel on a strict need-to-know basis. All internal data access is logged and audited.
• Secure data storage: Personal data is stored on servers protected by enterprise-grade firewalls, intrusion detection systems, and physical access controls. Sensitive data at rest is encrypted using AES-256.
• Penetration testing: crciex conducts regular security audits and penetration tests to identify and remediate vulnerabilities before they can be exploited.
• Data breach response: In the event of a personal data breach that poses a risk to your rights and freedoms, crciex will notify affected users and relevant authorities within 72 hours of becoming aware of the breach, in accordance with applicable data breach notification obligations.

While crciex takes all reasonable technical and organisational precautions to protect your data, no system is entirely immune from security threats. You also play an important role in keeping your account secure: use a strong, unique password for your crciex account, enable 2FA, never share your login credentials, and contact [email protected] immediately if you suspect unauthorised access to your account.

Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or crciex's data practices, please contact us using the details below. Our Data Protection Officer (DPO) oversees all privacy-related matters and is responsible for ensuring crciex's compliance with applicable data protection obligations.

• General privacy enquiries: [email protected] — use subject line "Privacy Enquiry"
• Subject Access Requests: [email protected] — use subject line "Privacy Rights Request"
• Data breach reports: [email protected] — use subject line "Data Security Report"
• Marketing opt-out: [email protected] — use subject line "Marketing Unsubscribe", or update your preferences directly in your account settings
• Response time: All privacy-related requests are acknowledged within 2 business days and resolved within 30 calendar days of receipt.

crciex is committed to resolving all privacy concerns directly and in good faith. If you are not satisfied with our response to your privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.