crecax Privacy Policy —
Your Data, Handled with Care
At crecax, safeguarding the personal information of our players across Bangladesh is a responsibility we take seriously. This Privacy Policy explains precisely what data we collect, why we collect it, how it is used, who we share it with, and the rights you hold over your own information.
How crecax Protects Your Information
The following cards summarise the most important privacy commitments crecax makes to every registered player. These summaries are provided for convenience and do not replace the full policy text in each section below. Where any conflict exists, the full section text governs.
crecax collects only the personal data that is strictly necessary to operate your account, process payments, verify your identity, and comply with applicable legal obligations. We do not collect data speculatively or for purposes unrelated to your crecax experience.
All data transmitted between your device and the crecax platform is protected by industry-standard TLS/SSL encryption. Sensitive account information — including payment details and identity documents — is stored using strong encryption at rest, never in plain text.
crecax does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Your information is shared only with the limited service providers necessary to operate the platform and only under strict confidentiality agreements.
Every crecax player has the right to access, correct, or request deletion of their personal data. You may also object to certain processing activities or request that your data be restricted. All such requests are handled by our support team within a reasonable timeframe.
crecax does not store full card numbers or mobile wallet PINs on its servers. Payment processing is handled by trusted third-party providers including bKash, Nagad, and Rocket. crecax receives only a transaction confirmation and a masked reference from each payment partner.
crecax uses only essential and functional cookies required to operate the platform — such as session management and security tokens. We do not deploy third-party advertising or cross-site tracking cookies. You can review and manage your cookie preferences through your browser settings at any time.
Information We Collect
crecax collects personal information about you when you register an account, make deposits or withdrawals, use our games and betting products, interact with our customer support team, or browse the crecax website. The categories of personal information we collect are described below.
Registration & Identity Data
When you create a crecax account, we collect: your full legal name as it appears on government-issued identification; a valid email address; a mobile phone number registered in your name; your date of birth; your residential address; and a username and password of your choosing. This information is required to create and maintain your account and to verify that you meet the eligibility requirements set out in our Terms & Conditions.
Identity Verification (KYC) Documents
To comply with responsible gaming standards and to protect our platform against fraud and money laundering, crecax may request copies of identity documents at various stages of your account lifecycle. Acceptable documents include a Bangladesh National Identity Card (NID), a valid passport, or a driving licence. We may also request proof of address (e.g., a utility bill or bank statement dated within 90 days) or proof of payment method ownership.
Financial Transaction Data
crecax records details of all deposits, withdrawals, and in-platform transactions associated with your account. This includes transaction amounts (in BDT), timestamps (Bangladesh Standard Time, UTC+6), payment method type (e.g., bKash, Nagad, Rocket, Upay, bank transfer, Visa, Mastercard), and masked payment references. Full card numbers, mobile wallet PINs, and bank account credentials are never stored by crecax — these are handled exclusively by your chosen payment provider.
Gaming & Betting Activity Data
We record all wagering activity on your account, including game sessions played, bet amounts, game outcomes, bonus usage, tournament participation, and sports betting selections. This data is used to operate your account correctly, calculate balances, audit game results, identify responsible gaming triggers, and personalise your platform experience.
Technical & Device Data
When you access crecax from any device, our servers automatically log certain technical data including: your IP address; device type and operating system; browser type and version; screen resolution; referring URL; pages visited and time spent on each; session start and end times; and error logs. This data is collected to maintain platform security, diagnose technical issues, and improve the platform experience.
Communications Data
If you contact crecax via live chat, email ([email protected]), or any other support channel, we retain a record of the communication including the content of messages, timestamps, and the identity of the crecax agent who handled your enquiry. This data is used for quality assurance, dispute resolution, and staff training.
| Data Category | Examples | Collection Method |
|---|---|---|
| Identity Data | Full name, date of birth, NID, email, phone | Provided by you at registration / KYC |
| Financial Data | Transaction amounts, payment method type, masked references | Generated automatically during transactions |
| Gaming Activity | Bets placed, games played, win/loss record | Generated automatically during platform use |
| Technical Data | IP address, device type, browser, session logs | Collected automatically by our servers |
| Communications Data | Live chat transcripts, email correspondence | Provided by you when contacting support |
How We Use Your Data
crecax processes your personal data only for specific, defined purposes and only where we have a lawful basis to do so. The primary lawful bases on which crecax processes personal data are: (a) performance of the contract between you and crecax (i.e., operating your account and delivering the services you have requested); (b) compliance with legal obligations (e.g., KYC, anti-money-laundering requirements); (c) our legitimate interests (e.g., platform security, fraud prevention, service improvement); and (d) your consent, where specifically obtained (e.g., for optional marketing communications).
Account Operations
We use your registration and identity data to create and maintain your crecax account, authenticate your identity at login, process deposits and withdrawals to and from your verified payment methods, apply bonuses and promotional credits, and communicate important account-related notifications such as deposit confirmations, withdrawal updates, and security alerts.
Identity Verification & Fraud Prevention
crecax uses your identity and financial transaction data to carry out KYC verification, detect and investigate suspected fraudulent activity, identify patterns consistent with money laundering or bonus abuse, and enforce the one-account-per-player rule. Where fraud is suspected, data may be shared with relevant authorities as described in the Data Sharing section below.
Responsible Gaming
Your gaming activity data is analysed by crecax's responsible gaming systems to identify patterns that may indicate problem gambling behaviour — such as unusual increases in bet frequency or size, extended unbroken sessions, or rapidly escalating loss thresholds. Where such patterns are detected, crecax may contact you with responsible gaming information or apply protective restrictions to your account in accordance with our Responsible Gaming policy.
Platform Security
Technical and device data is used to protect the crecax platform against unauthorised access, distributed denial-of-service attacks, automated bot activity, and other security threats. IP addresses and device fingerprints are analysed to detect suspicious login patterns and to enforce geographical or device-level restrictions where necessary.
Service Improvement & Analytics
Aggregated and anonymised technical and gaming data is used by crecax's product and engineering teams to monitor platform performance, identify areas for UX improvement, test new features, and optimise game loading speeds and interface responsiveness for players across Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, Barisal, Rangpur, and Mymensingh.
Marketing Communications
Where you have provided explicit consent to receive promotional communications from crecax, we may use your email address and/or mobile number to send you information about new games, seasonal promotions (such as Eid offers, Pohela Boishakh specials, or BPL cricket promotions), deposit match bonuses, and platform updates. You may withdraw your consent to marketing communications at any time by contacting support or by following the unsubscribe instructions in any marketing email you receive. Withdrawing marketing consent does not affect the lawfulness of prior processing.
Data Sharing & Disclosure
crecax does not sell, rent, or exchange your personal data with any third party for commercial or marketing purposes. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.
Payment Service Providers
To process deposits and withdrawals, crecax shares transaction-relevant data with payment service providers including bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, and card processing partners (Visa, Mastercard). The data shared is limited to what is required to execute or verify a specific transaction — typically a transaction amount, a masked payment reference, and a timestamp. Each payment provider operates under its own privacy policy and is independently responsible for the data it processes.
Game Software Providers
The games and sports betting markets available on crecax are powered by third-party software providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi. These providers may receive limited session data (such as a pseudonymous player ID, stake amount, and game outcome) necessary to operate the game engine and validate results. No directly identifiable personal data such as your name, email, or NID is shared with game providers.
Legal & Regulatory Obligations
crecax may disclose your personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where required to do so by applicable law, a court order, or a lawful request from an authorised public authority. In such cases, crecax will disclose only the data specifically requested and will, where permitted by law, notify you that such a disclosure has been made.
Anti-Fraud & Risk Management Partners
crecax works with specialist third-party fraud prevention and risk management providers to detect and prevent financial crime on the platform. These providers may receive anonymised or pseudonymised behavioural data and device fingerprint data for the purpose of fraud scoring. They operate under strict contractual confidentiality obligations and are prohibited from using this data for any purpose other than fraud prevention services delivered to crecax.
Business Transfers
In the event that crecax undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the acquiring or successor entity as part of that transaction. In such circumstances, crecax will endeavour to notify registered players by email prior to data being transferred and to ensure that any successor entity is bound by data protection obligations no less protective than those in this Privacy Policy.
Cookies & Tracking Technologies
crecax uses cookies and similar technologies (such as local storage tokens and session identifiers) on its platform. This section explains what these technologies are, which specific categories crecax uses, and how you can manage them.
What Are Cookies?
Cookies are small text files that a website stores on your device when you visit it. They allow the platform to recognise your device on subsequent visits, remember your session state, and provide a consistent and secure experience. Cookies can be "session cookies" (deleted when you close your browser) or "persistent cookies" (stored for a defined period after your session ends).
Cookies crecax Uses
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session authentication, CSRF protection tokens, load balancing, security flags | Session (deleted on browser close) |
| Functional | Remembering your language preference, display settings, and last-visited game category | Up to 30 days |
| Analytics (First-Party) | Aggregated, anonymised page-view and session-duration data used to improve platform performance | Up to 12 months |
Managing Cookies
You can manage or delete cookies through your browser settings at any time. Most modern browsers allow you to block all cookies, block third-party cookies only, or delete existing cookies. Please note that disabling strictly necessary cookies will affect the functionality of the crecax platform — for example, you will not be able to remain logged in between pages if session cookies are blocked. Functional and analytics cookies can be disabled without affecting core platform access.
Instructions for managing cookies in common browsers can be found in each browser's built-in help section. crecax support can also assist you with cookie-related queries at [email protected].
Data Security Measures
crecax implements a layered security architecture designed to protect your personal data against unauthorised access, accidental loss, alteration, and unlawful destruction. The following measures are in place at all times.
- TLS/SSL Encryption in Transit: All data exchanged between your device and crecax servers is encrypted using TLS 1.2 or higher. This prevents eavesdropping on your account credentials, transaction data, and personal information as it travels over the network.
- Encryption at Rest: Sensitive personal data stored on crecax servers — including identity documents, hashed passwords, and financial transaction records — is encrypted using strong symmetric encryption standards.
- Password Hashing: Your crecax account password is never stored in plain text. Passwords are processed through a one-way cryptographic hashing function with a unique salt before storage, meaning that crecax staff cannot read your password and it cannot be recovered even in the event of a data breach.
- Two-Factor Authentication (2FA): crecax offers optional 2FA for all registered accounts. When enabled, a time-sensitive verification code is required in addition to your password at every login. crecax strongly recommends enabling 2FA on your account.
- Access Controls: Access to personal data held by crecax is restricted on a need-to-know basis. Only staff members whose role requires access to specific categories of player data are granted the relevant permissions. Access logs are maintained and reviewed regularly.
- Regular Security Audits: crecax's technical infrastructure is subject to regular internal and third-party security reviews to identify and address vulnerabilities before they can be exploited.
While crecax maintains robust security practices, no internet-based platform can guarantee absolute security. You also play an important role in protecting your data — please use a strong, unique password for your crecax account, enable 2FA, and never share your login credentials with any third party. If you suspect unauthorised access to your account, contact crecax support immediately.
Data Retention
crecax retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The retention periods below apply under standard circumstances.
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years after closure | Legal obligation, fraud prevention, dispute resolution |
| KYC Documents | Duration of account + 5 years after closure | Anti-money-laundering compliance requirements |
| Financial Transaction Records | 7 years from transaction date | Financial record-keeping obligations |
| Gaming Activity Logs | 3 years from the date of each session | Dispute resolution, responsible gaming audit trail |
| Technical / Device Logs | 12 months on a rolling basis | Security monitoring, platform diagnostics |
| Support Communications | 3 years from date of communication | Quality assurance, dispute resolution |
| Marketing Consent Records | Until consent withdrawn + 2 years | Evidence of lawful basis for marketing |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual. Where anonymisation is used, the resulting data may be retained indefinitely for analytical purposes as it no longer constitutes personal data.
Requests for early deletion of personal data may be submitted by registered players and will be considered in accordance with the Your Privacy Rights section below. Note that early deletion requests cannot be fulfilled where retention is required by law or where the data is necessary for the resolution of an ongoing dispute.
Your Privacy Rights
As a crecax player, you hold a number of rights with respect to the personal data we hold about you. crecax is committed to honouring these rights and to responding to all legitimate requests within a reasonable timeframe — typically within 30 calendar days of receipt. If a request is complex or involves a large volume of data, crecax may extend this period by an additional 30 days, in which case you will be notified of the extension and its reason.
Right of Access
You have the right to request a copy of all personal data that crecax holds about you. This is commonly known as a Subject Access Request (SAR). Upon a valid request, crecax will provide a structured summary of your data in a commonly used electronic format. We may ask for proof of identity before processing a SAR to ensure that we do not disclose your data to an unauthorised third party.
Right to Rectification
If any personal data that crecax holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For routine corrections (e.g., updating a phone number or email address), please contact the support team directly. Corrections to identity data (name, date of birth) may require documentary verification.
Right to Erasure
In certain circumstances, you have the right to request that crecax delete the personal data it holds about you. This right applies where the data is no longer necessary for the purpose for which it was collected, where you withdraw consent and no other lawful basis applies, or where the data has been processed unlawfully. Note that this right does not apply where retention is required by law (e.g., financial records and KYC documents subject to mandatory retention periods) or where the data is needed for the establishment, exercise, or defence of a legal claim.
Right to Restriction of Processing
You may request that crecax restricts the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while a complaint is under investigation. Where processing is restricted, crecax will continue to store your data but will not actively use it except to establish, exercise, or defend legal claims or with your consent.
Right to Object
You have the right to object to the processing of your personal data where crecax relies on legitimate interests as its lawful basis. You also have an absolute right to object to the processing of your data for direct marketing purposes at any time, without needing to provide a reason. If you object to marketing, crecax will cease processing your data for that purpose immediately.
Right to Data Portability
Where crecax processes your data on the basis of your consent or to perform a contract with you, and where the processing is carried out by automated means, you have the right to receive a copy of your data in a structured, commonly used, and machine-readable format, and to request that this data be transferred directly to another data controller where technically feasible.
Policy Updates & Contact
crecax reviews this Privacy Policy on a regular basis to ensure that it remains accurate, up to date, and reflective of our current data processing practices. When material changes are made to this policy, crecax will notify all registered players by email at the address associated with their account and will display a prominent notice on the platform for a period of not less than 30 days following the change.
The "Last Updated" date at the top of this page reflects the most recent revision. We recommend reviewing this policy periodically, even if you have not received a notification, as minor clarifications and non-material updates may be made without individual notification. Continued use of the crecax platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.
Contact the crecax Privacy Team
If you have any questions, concerns, or requests relating to this Privacy Policy or to crecax's handling of your personal data, please contact us using the details below. Our support team is available 24 hours a day, 7 days a week to assist with all privacy-related enquiries.
- Email (plain text — not a link): [email protected]
- Subject line for privacy requests: "Privacy Rights Request" or "Privacy Policy Enquiry"
- Response time: Acknowledgement within 72 hours; substantive response within 30 calendar days
- Support hours: 24/7 — available in English
crecax is committed to resolving all privacy concerns directly and promptly. If you are not satisfied with the outcome of a privacy complaint handled by our support team, you may seek further recourse through applicable regulatory channels in your jurisdiction.
Questions About Your Privacy?
crecax's support team is available around the clock to answer any questions about how your personal data is used. You can also explore our FAQ for quick answers, review our full Terms & Conditions, or head back to the casino and start playing.