ko8 Privacy Policy — How We Protect Your Data

Information You Provide Directly

When registering a ko8 account or completing KYC verification, you may be asked to provide the following:

• Full legal name, date of birth, and gender as they appear on your government-issued identity document.
• Current residential address, including city, district, and postal code (Bangladesh addresses accepted in full).
• Mobile phone number and email address, used for account verification, security alerts, and support communications.
• Government-issued photo identification (National ID, passport, or driving licence) for KYC age and identity verification.
• Proof of address (utility bill, bank statement, or other document issued within 3 months) when required for enhanced KYC verification.

Information Generated Through Your Use of ko8

When you use the ko8 platform, certain data is generated automatically as part of the normal operation of the service:

• Account activity logs: login timestamps, session durations, device type, operating system, and browser version used to access ko8.
• Transaction history: all deposit and withdrawal records, including payment method used, amount in BDT, timestamp, and transaction status.
• Betting and gaming history: records of all bets placed, games played, bonus claims, and wagering activity across all product verticals on ko8.
• IP address and approximate geolocation data used to enforce access restrictions and detect suspicious activity consistent with our responsible gaming and fraud prevention obligations.

Information from Third-Party Service Providers

Ko8 may receive personal data from third-party providers in the following limited circumstances:

• Payment processors (bKash, Nagad, Rocket, Upay, Visa, Mastercard, and bank partners) may share transaction confirmation data and, where required for fraud prevention, additional payment instrument details.
• Identity verification and KYC service providers may return verification outcomes and document validation results to ko8 as part of the onboarding process.
• Fraud detection and anti-money laundering (AML) screening providers may return risk scores or flags that inform ko8's account management decisions.

Purposes of Processing

• Account creation and management: to register your account, verify your identity, process KYC documentation, and maintain your account in good standing throughout the player lifecycle.
• Service delivery: to process deposits and withdrawals, award bonuses, run promotions, provide customer support, and deliver the gaming and betting services you have requested.
• Legal and regulatory compliance: to comply with applicable anti-money laundering (AML) laws, KYC requirements, responsible gaming obligations, and any other applicable legal or regulatory requirements.
• Fraud prevention and security: to detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, collusion, and other prohibited activities on the ko8 platform.
• Responsible gaming: to monitor player activity for signs of problem gambling, to apply deposit limits, time-outs, and self-exclusion measures at the player's request, and to fulfil our responsible gaming obligations.
• Platform improvement: to analyse aggregated, anonymised usage patterns that help us improve ko8's speed, reliability, game selection, and overall user experience. No individually identifiable data is used for this purpose.

Permitted Disclosure Circumstances

• Service providers: trusted third-party vendors engaged by ko8 to help deliver the service — such as KYC identity verification providers, payment processors, fraud detection systems, and cloud infrastructure providers — receive only the minimum data required to perform their function and are contractually bound to handle it securely and confidentially.
• Legal obligations: ko8 may be required to disclose personal data to law enforcement agencies, regulatory bodies, or courts in response to a valid legal request, court order, or statutory obligation. ko8 will notify affected players of such disclosures where legally permitted to do so.
• Business transfers: in the event of a merger, acquisition, or sale of all or a substantial portion of ko8's assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer in advance.
• With your consent: ko8 may share your information with other parties where you have given explicit prior consent. You may withdraw such consent at any time by contacting [email protected].

bKash, Nagad, Rocket and Upay Transactions

For mobile banking transactions via bKash, Nagad, Rocket, and Upay, ko8 receives only the transaction reference number, the registered mobile number associated with the payment, the transaction amount in BDT, and the transaction timestamp. Ko8 does not receive or store your mobile banking PIN or full account credentials. Your mobile banking provider's own privacy policy governs how they handle your data on their side of the transaction.

Types of Cookies Used

• Essential cookies: necessary for core platform functionality including login sessions, balance display, and game loading. These cannot be disabled without breaking the service.
• Analytics cookies: anonymised session data used to understand how players navigate ko8, which games are most played, and where technical issues occur. No personally identifiable information is included in analytics data.
• Preference cookies: store your language preference, notification settings, and display options so you do not need to reconfigure them on each visit.

Retention Schedule

Active accounts: personal data is retained for the full duration your account remains open and active. Transaction records and KYC documentation are retained for a minimum of 5 years from the date of the transaction or verification, in line with standard AML record-keeping requirements. Closed accounts: following account closure, ko8 retains core identity and transaction data for a minimum of 5 years to satisfy legal and regulatory obligations. After this period, data is securely deleted or irreversibly anonymised. Support correspondence: records of support interactions are retained for up to 2 years from the date of the interaction.

Available Data Rights

• Right of access: you may request a complete copy of the personal data ko8 holds about you, including the categories of data held, the purposes for which it is processed, and the third parties with whom it has been shared.
• Right to rectification: if any personal data ko8 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to erasure: subject to legal retention requirements, you may request deletion of your personal data by requesting account closure. Ko8 will securely delete your data once all mandatory retention periods have elapsed.
• Right to restrict processing: you may request that ko8 pause the processing of your personal data in certain circumstances — for example, while a data accuracy dispute is being resolved.
• Right to data portability: you may request a copy of the personal data you have provided to ko8 in a structured, commonly used, machine-readable format, so that you may transfer it to another service provider if you choose.