Your Privacy Matters at cx88

cx88 ("we", "our", "us") is committed to protecting the privacy and personal data of every individual who visits, registers with, or interacts with the cx88 platform at cx88.im ("the Platform"). This Privacy Policy sets out in clear terms the types of personal data we collect, the purposes for which we process that data, the parties with whom we may share it, the security measures we apply to protect it, and the rights you hold in relation to your personal data.

By accessing the cx88 Platform, creating a registered account, or otherwise engaging with our services, you acknowledge that you have read, understood, and accepted the practices described in this Privacy Policy. If you do not agree with any part of this Policy, you should discontinue your use of the Platform and may request account closure by contacting our support team.

This Privacy Policy is intended to be read in conjunction with cx88's Terms & Conditions, which are available at cx88.im/terms-conditions. In the event of any conflict between the two documents regarding the handling of personal data, the provisions of this Privacy Policy shall prevail.

cx88 collects personal data in several categories depending on the nature of your interaction with the Platform. The table below summarises the categories of personal data we collect and the typical examples within each category:

cx88 does not collect any special category personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) except where strictly required to fulfil its age verification and anti-money-laundering obligations, in which case only the minimum necessary data is collected and processed.

cx88 collects personal data through the following primary methods:

• Direct interactions: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account profile.
• Automated technologies: As you navigate the cx88 Platform, we automatically collect technical and usage data through cookies, web beacons, server logs, and similar tracking technologies. See Section 7 for full details of our cookie practices.
• Payment processors: When you transact via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, or Mastercard, our payment processor partners share transaction confirmation data with cx88 to credit your account and maintain accurate financial records.
• Identity verification partners: cx88 may engage third-party KYC and identity verification service providers to cross-reference the documents you submit during the verification process against government-issued identity databases where applicable.
• Fraud detection and risk analytics: cx88's internal risk management systems automatically analyse patterns in Technical Data and Usage Data to identify unusual or potentially fraudulent account activity.

cx88 processes personal data only for defined, legitimate purposes. The table below maps each processing purpose to the categories of data involved:

cx88 does not process your personal data for automated profiling that produces legal or similarly significant effects without your explicit consent and the ability to request human review of such decisions.

cx88 processes personal data under one or more of the following legal bases depending on the specific processing activity:

• Contractual necessity: Processing required to enter into and perform the contract between cx88 and you as a registered account holder — including account creation, KYC verification, deposit and withdrawal processing, and provision of gaming services.
• Legal obligation: Processing required to comply with cx88's legal and regulatory obligations, including anti-money-laundering (AML) checks, fraud prevention measures, and record-keeping requirements.
• Legitimate interests: Processing carried out for cx88's legitimate business interests, where those interests are not overridden by your data protection rights — including fraud detection, Platform security, responsible gaming monitoring, and Platform analytics and improvement.
• Consent: Processing for purposes where cx88 relies on your freely given, specific, informed, and unambiguous consent — primarily for direct marketing communications such as promotional emails, bonus SMS notifications, and push alerts. You may withdraw your consent at any time by updating your account preferences or contacting [email protected].

cx88 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Your data is shared only with carefully selected categories of recipient where sharing is necessary for the purposes described in this Policy:

• Payment processing partners: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, Visa, and Mastercard receive the minimum data required to authorise and process financial transactions on your behalf.
• KYC and identity verification providers: Third-party verification partners receive identity document data solely for the purpose of confirming your identity and age in line with cx88's KYC policy.
• Fraud prevention and risk analytics providers: Data shared with these partners is used exclusively to detect and prevent fraudulent activity, account takeovers, and money laundering on the cx88 Platform.
• Technology infrastructure providers: Cloud hosting, data storage, and content delivery partners who process data on cx88's behalf under strict data processing agreements that prohibit independent use of your data.
• Legal and regulatory authorities: cx88 may disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required to do so by applicable law, court order, or regulatory direction. cx88 will notify affected users of such disclosures where legally permitted to do so.
• Professional advisers: Lawyers, auditors, and accountants acting in an advisory capacity, bound by professional confidentiality obligations.

All third-party processors engaged by cx88 are contractually bound to process personal data only on cx88's documented instructions, to maintain appropriate technical and organisational security measures, and to refrain from any independent processing of the data they receive.

cx88 uses cookies and similar tracking technologies to operate and improve the Platform, maintain your session, remember your preferences, and analyse how the Platform is used. The categories of cookies used by cx88 are as follows:

You may manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies, although disabling strictly necessary cookies will affect your ability to use the Platform. Detailed browser-specific guidance on managing cookies is available from the help documentation of your chosen browser.

cx88 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce agreements. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your account and for a minimum of 5 years following permanent account closure, in accordance with anti-money-laundering record-keeping requirements.
• KYC and identity document data: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Communications data (support correspondence): Retained for 3 years from the date of the last communication in a given support thread, or for the duration of any ongoing dispute resolution process.
• Technical and usage data: Retained in identifiable form for up to 24 months, after which data is anonymised and may be retained indefinitely for aggregate analytics purposes.
• Marketing preference records: Retained for the duration of your account or until you withdraw your consent, plus 12 months thereafter as an auditable consent record.

Upon expiry of the applicable retention period, cx88 will securely delete or anonymise your personal data in accordance with its internal data destruction procedures. Where deletion is not immediately possible due to technical constraints (such as data held in backup archives), cx88 will isolate and protect the data from further processing until deletion is technically feasible.

cx88 implements a comprehensive suite of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and the cx88 Platform, ensuring that your personal data and financial information cannot be intercepted in transit.
• Encryption at rest for all sensitive personal data and financial records stored within cx88's data infrastructure.
• Two-factor authentication (2FA) available to all registered account holders and mandatory for all cx88 staff who access systems containing personal data.
• Role-based access controls ensuring that only authorised cx88 personnel with a legitimate need can access personal data, and that access is logged and audited.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists to identify and remediate potential weaknesses in the Platform's security architecture.
• Incident response procedures including a defined data breach response protocol. In the event of a data breach that is likely to result in a risk to your rights and freedoms, cx88 will notify affected individuals as promptly as practicable.

While cx88 applies industry-standard security measures, no digital platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying cx88 immediately at [email protected] if you suspect any unauthorised access to your account.

As a data subject whose personal data is processed by cx88, you hold the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request" and include your registered account username and a description of your request.

• Right of Access: You may request a copy of the personal data cx88 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request that cx88 correct any inaccurate or incomplete personal data held about you. You may also update certain data fields directly through your account settings.
• Right to Erasure: You may request that cx88 delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent and no other legal basis for processing applies. This right is subject to cx88's overriding legal obligations to retain certain data (see Section 8).
• Right to Restriction of Processing: You may request that cx88 restrict the processing of your personal data in certain circumstances, such as where the accuracy of the data is contested or where processing is unlawful but you prefer restriction to erasure.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you may request that cx88 provide your personal data to you in a structured, commonly used, machine-readable format.
• Right to Object: You may object to cx88's processing of your personal data where that processing is based on legitimate interests. cx88 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

cx88 will acknowledge receipt of a data rights request within 2 business days (Bangladesh Standard Time, UTC+6) and will respond substantively within 30 calendar days of acknowledgement. In complex cases, this period may be extended by a further 30 days, in which case cx88 will notify you of the extension and the reasons for it.

The cx88 Platform is strictly intended for individuals aged 21 years and above. cx88 does not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the cx88 account registration and KYC process, and any account identified as being held by a person under 21 will be immediately suspended.

If you are a parent or guardian and believe that a person under the age of 21 in your care has provided personal data to cx88 or has gained access to the Platform, please contact our support team immediately at [email protected]. cx88 will investigate the matter promptly and, where confirmed, will delete the relevant account and any associated personal data without undue delay.

The cx88 Platform may occasionally reference third-party services such as game content providers (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi) or payment partners. Where links to or integrations with third-party services exist within the Platform, those third parties operate under their own independent privacy policies.

cx88 does not control and is not responsible for the privacy practices, security standards, or content of any third-party service. We encourage you to review the privacy policy of any third-party service you interact with through or in connection with the cx88 Platform. The presence of a third-party integration within cx88 does not constitute an endorsement of that third party's privacy practices.

cx88 reserves the right to update, revise, or replace this Privacy Policy at any time in response to changes in applicable law, our data processing practices, or the services we offer. When material changes are made to this Policy, cx88 will update the "Last updated" date displayed at the top of this page and will notify registered account holders of significant changes via the email address associated with their account, where practicable.

Your continued use of the cx88 Platform following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you disagree with any changes to this Policy, you should stop using the Platform and may request account closure in accordance with cx88's Terms & Conditions.

We recommend reviewing this Privacy Policy periodically to stay informed of how cx88 collects, uses, and protects your personal data. This Policy was last reviewed and updated on 1 January 2026.

If you have any questions, concerns, or requests relating to this Privacy Policy or cx88's data processing practices, please contact our dedicated privacy support team through the following channel:

• Email: [email protected] — please use the subject line "Privacy Policy Enquiry" for faster routing.
• Response time: cx88 aims to acknowledge all privacy-related enquiries within 2 business days (Bangladesh Standard Time, UTC+6) and to provide a substantive response within 30 calendar days.

For data rights requests (access, rectification, erasure, portability, and related rights), please see Section 10 of this Policy for detailed instructions on how to submit a formal request.

cx88 takes every privacy enquiry seriously. If you are not satisfied with cx88's response to a privacy concern, you may escalate the matter by writing to cx88's senior management team at the same email address with the subject line "Privacy Escalation".