kr18 Privacy Policy — How We Protect Your Data
This Privacy Policy explains what personal data kr18 collects from Bangladesh players, why we collect it, how we use it, and the rights you have over your own information.
1. Introduction
kr18 ("the Platform", "we", "us", "our") is committed to protecting the privacy and personal data of all users who access or register on the kr18 platform at kr18.asia. This Privacy Policy describes how kr18 collects, processes, stores, shares and protects personal data in connection with your use of the Platform. It applies to all registered players, visitors and any other individuals whose personal data kr18 processes in the course of its operations.
By using the kr18 Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to this Privacy Policy, you must not use the Platform. kr18 may update this Policy from time to time. The current version will always be accessible at kr18.asia/privacy-policy. Continued use of the Platform following any update constitutes acceptance of the revised Policy.
Our Privacy Principles at a Glance
kr18 approaches data privacy through six core commitments. These summaries give you a quick overview — the full details follow in the sections below.
2. Information We Collect
kr18 collects personal data through several channels: information you provide directly during registration and account use, information generated automatically through your use of the Platform, and information received from third-party payment providers and identity verification services. The categories of data we collect are summarised below.
kr18 does not collect special categories of personal data (such as health data, political opinions or biometric data) except where required by law or with your explicit consent. You are not required to provide data beyond what is requested during registration and KYC — however, failure to provide required data may prevent kr18 from offering certain services or processing withdrawals.
3. How We Use Your Information
kr18 uses your personal data for the following purposes, each of which is necessary for the Platform to operate correctly and to meet its obligations to players and regulators:
- Account creation and management — to register your account, verify your identity, maintain your profile, and process login and authentication.
- Payment processing — to process deposits and withdrawals via bKash, Nagad, Rocket, Upay, bank transfer and other supported payment methods, and to maintain an accurate record of all financial transactions on your account.
- Legal and regulatory compliance — to conduct identity and age verification (KYC), carry out anti-money-laundering (AML) screening, respond to requests from law enforcement or regulatory authorities, and fulfil any other legal obligation applicable to kr18's operations.
- Platform operation and improvement — to monitor platform performance, diagnose technical issues, detect and prevent fraud, ensure security, analyse usage patterns and continuously improve the player experience.
- Responsible gaming — to monitor player behaviour for signs of problem gambling, apply account-level limits or restrictions where appropriate, and respond to self-exclusion requests or referrals for responsible gaming support.
- Marketing and promotions — to send you relevant promotional communications, bonus offers and platform updates where you have provided consent to receive such communications. You may withdraw this consent at any time by contacting [email protected] or updating your communication preferences in your account settings.
4. Legal Basis for Processing
kr18 processes personal data only where it has a valid legal basis to do so. The legal bases on which kr18 relies are as follows:
- Contractual necessity — processing required to fulfil the agreement between kr18 and you as a registered player, including account management, payment processing, game provision and customer support.
- Legal obligation — processing required for kr18 to comply with applicable laws, including KYC/AML obligations, age verification requirements, record-keeping requirements, and reporting obligations to competent authorities.
- Legitimate interests — processing carried out in the legitimate interests of kr18 or players, including fraud prevention, security monitoring, platform improvement, and responsible gaming monitoring, where these interests are not overridden by your data protection rights.
- Consent — processing based on your freely given, specific, informed and unambiguous consent, including the sending of optional marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of any processing carried out prior to withdrawal.
5. Sharing Your Information
kr18 does not sell, rent, or trade your personal data. We share your information only in the limited circumstances described below, and only to the extent necessary for each purpose.
- Payment providers — your transaction data is shared with the relevant payment provider (e.g. bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank) solely to process your deposit or withdrawal. These providers operate under their own privacy policies and data protection obligations.
- Identity verification services — to comply with KYC and AML obligations, kr18 may share identity data with third-party identity verification and screening service providers. These providers process data under contractual data protection obligations.
- Game providers — game activity data (bet history, session data) may be shared with game providers including Pragmatic Play, Evolution Gaming, Spribe, Ezugi and NetEnt for the purpose of game operation, dispute resolution and audit compliance.
- Law enforcement and regulatory authorities — kr18 will disclose personal data to competent authorities, courts or regulators where required to do so by applicable law, court order, or regulatory requirement. kr18 will notify you of any such disclosure where permitted by law to do so.
All third parties with whom kr18 shares personal data are required to maintain appropriate technical and organisational security measures and to process your data only for the stated purpose. kr18 does not transfer personal data outside of Bangladesh to third parties except where required by the circumstances described above and where adequate data protection safeguards are in place.
6. Payment Data and Financial Information
When you make a deposit or request a withdrawal on kr18 using bKash, Nagad, Rocket, Upay or any other supported payment method, the financial transaction is processed directly by the relevant payment provider. kr18 receives a transaction confirmation and a reference identifier from the provider, but does not receive or store your full payment credentials (such as your full bKash PIN, Nagad PIN or bank account password). Your payment provider's own privacy policy governs how it handles your financial credentials during this process.
kr18 maintains a complete internal record of all deposits, withdrawals, bonuses credited and wagering activity on your account. This financial record is retained for a minimum of five years following account closure to comply with applicable anti-money-laundering record-keeping requirements. You may request a copy of your transaction history at any time by contacting [email protected].
7. Cookies and Tracking Technologies
kr18 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your login session, and analyse how players navigate the site. The following categories of cookies are used on kr18:
- Strictly necessary cookies — essential for the Platform to function. These enable core features such as login session management, security token validation and payment flow continuity. These cookies cannot be disabled without breaking Platform functionality.
- Functional cookies — used to remember your language preferences, display settings and other personalisation choices so that you do not need to re-enter these each time you visit.
- Analytics cookies — used to collect aggregated, anonymised data about how players use the Platform, which pages are most visited, and where technical errors occur. This data is used solely to improve Platform performance and user experience.
- Session security cookies — short-lived cookies used to protect against cross-site request forgery (CSRF) and other session-based security threats. These are deleted automatically when you close your browser or end your session.
You may control or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the kr18 Platform, including the ability to maintain a login session. kr18 does not use advertising or third-party tracking cookies for the purpose of serving targeted advertisements.
8. Data Retention
kr18 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply as a general guide, subject to specific legal obligations that may require longer retention in individual cases:
Account and identity data is retained for the duration of your account and for a minimum of five years following account closure, in accordance with AML record-keeping requirements. Financial transaction records are retained for a minimum of five years. Gaming activity records are retained for two years following the last session date, unless a longer period is required for dispute resolution or compliance purposes. Marketing preferences and consent records are retained until you withdraw consent, after which a suppression record is kept to ensure no further communications are sent. Technical and log data is typically retained for 12 months on a rolling basis.
9. Your Data Protection Rights
Subject to applicable law, you have the following rights in relation to the personal data kr18 holds about you. To exercise any of these rights, contact kr18 at [email protected] with your full name, registered email address and a description of the right you wish to exercise.
- Right of access — you may request a copy of the personal data kr18 holds about you, together with information about the purposes for which it is processed and the categories of recipients with whom it has been shared.
- Right to rectification — you may request that kr18 correct any inaccurate or incomplete personal data held about you. Where possible, kr18 will action rectification requests within 14 days.
- Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent and there is no other legal basis for processing, or where processing is unlawful. This right is subject to kr18's legal obligations to retain certain data (e.g. AML records).
- Right to restriction — you may request that kr18 restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is being contested or while an objection to processing is being assessed.
- Right to data portability — where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your personal data in a structured, machine-readable format.
- Right to object — you may object to processing based on legitimate interests, including direct marketing. Where you object to direct marketing, kr18 will cease that processing immediately. Where you object to other legitimate interest processing, kr18 will assess whether its interests override your rights.
kr18 will respond to all data rights requests within 30 days of receipt. In complex cases, kr18 may extend this period by a further 30 days with prior notification. kr18 will not charge a fee for handling data rights requests unless they are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.
10. Security Measures
kr18 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration or destruction. These measures include 256-bit SSL/TLS encryption for all data in transit, encrypted storage of sensitive data at rest, access controls limiting staff access to personal data on a strict need-to-know basis, regular security audits and vulnerability assessments, and two-factor authentication options for player accounts.
While kr18 takes all reasonable precautions to secure your data, no method of electronic storage or transmission is completely free from risk. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, kr18 will notify affected players without undue delay, in accordance with its obligations under applicable data protection law. You should also take steps to protect your own account security, including using a strong unique password and not sharing your login credentials with any third party.
11. Children and Minors
The kr18 Platform is strictly intended for adults aged 21 and above. kr18 does not knowingly collect, process or retain personal data from any person under the age of 21. If kr18 becomes aware that personal data has been collected from a person under 21 without verifiable parental or guardian consent, kr18 will take immediate steps to delete that data and close the associated account. If you believe that a minor has provided personal data to kr18, please contact [email protected] immediately with the relevant details.
12. Changes to This Policy and How to Contact Us
kr18 reserves the right to update or revise this Privacy Policy at any time. When we make material changes, we will update the Effective Date at the top of this page and, where appropriate, notify registered players by email or via a notification on the Platform. We encourage you to review this Privacy Policy periodically. The most current version will always be published at kr18.asia/privacy-policy.
If you have any questions, concerns or requests relating to this Privacy Policy or to the way kr18 handles your personal data, please contact our support team by email at [email protected]. Please note that this email address must be used as plain text — it is not a clickable link. We aim to acknowledge all privacy enquiries within 2 business days and to resolve them within 30 days.
Play Safe and Explore kr18
Your privacy is protected every step of the way at kr18. Ready to explore Bangladesh's trusted casino and sports betting platform? Start with our FAQ or head straight to the casino.
Explore kr18 Casino Read Our FAQPlayers must be 21 years or older. Please play responsibly. T&C apply.