8mbit Privacy Policy – Your Data, Our Responsibility

Introduction

8mbit is committed to handling your personal data with transparency, integrity, and respect. This Policy applies to all individuals who access or use the 8mbit platform, including registered account holders, prospective players who browse without registering, and individuals who contact our customer support team.

This Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy. Together, these documents form the complete framework governing your relationship with 8mbit. Where any conflict exists between this Policy and the Terms & Conditions on matters of data privacy, this Policy shall take precedence.

We review this Policy periodically and update it to reflect changes in our data practices, technology, or legal obligations. The "Last Updated" date at the top of this document indicates when the most recent revision was made. Material changes will be communicated to registered players via email before they take effect.

Personal Data We Collect

Depending on how you interact with the 8mbit platform, we may collect the following categories of personal data:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is strictly necessary for identity document verification during KYC.

How We Collect Your Data

8mbit collects personal data through the following channels:

• Direct interactions: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account settings, you provide us with personal data directly.
• Automated technologies: As you navigate the 8mbit platform, we automatically collect technical and usage data through cookies, server logs, and similar tracking technologies. This data is collected from the moment you first visit https://8mbit.io, regardless of whether you hold a registered account.
• Payment processors: When you initiate a financial transaction via bKash, Nagad, Rocket, or Upay, our payment processor partners share limited transaction confirmation data with us to reconcile your account balance and verify the transfer.
• Third-party identity verification services: To complete KYC checks, we may use third-party identity verification providers who compare your submitted documents against relevant databases. These providers act as data processors under our instruction and are contractually bound by strict data security requirements.
• Publicly available sources: In limited fraud prevention scenarios, we may cross-reference information you provide against publicly available records to verify its accuracy.

Purpose & Legal Basis for Processing

We process your personal data only where we have a legitimate legal basis to do so. The table below sets out our primary processing purposes and the corresponding legal basis for each:

Where we rely on your consent as the legal basis for processing (such as for marketing communications), you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

Sharing Your Personal Data

8mbit does not sell, rent, or trade your personal data to third parties for commercial gain. We share personal data only in the following limited and controlled circumstances:

• Payment processors: bKash, Nagad, Rocket, and Upay receive the minimum financial data necessary to process your deposit or withdrawal transactions. These providers operate under their own privacy and security standards.
• Identity verification providers: Third-party KYC service providers receive copies of identity documents you submit solely for the purpose of verifying your identity and age. They are contractually prohibited from using this data for any other purpose.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi may receive an anonymised player session identifier to facilitate gameplay and resolve technical disputes. No personally identifiable information is shared with game studios.
• Fraud prevention and security services: We may share technical data (such as IP addresses or device fingerprints) with anti-fraud platforms to detect suspicious activity. This sharing is based on our legitimate interest in protecting the platform and its players.
• Legal and regulatory authorities: We will disclose personal data to law enforcement agencies, financial intelligence units, or other competent authorities when required to do so by applicable law, court order, or regulatory directive. We will notify you of such disclosures where legally permitted to do so.
• Business successors: In the event that 8mbit undergoes a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer and given the opportunity to delete your account before the transfer is finalised.

Cookies & Tracking Technologies

8mbit uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies: These are essential for the platform to function. They enable you to log in, maintain your session, and use core features. They cannot be disabled without significantly impairing your ability to use 8mbit.
• Functional cookies: These remember your preferences — such as your preferred game category or responsible gaming settings — so you do not have to re-enter them on each visit.
• Analytical cookies: We use anonymised analytics data to understand how players navigate the platform, which games are most popular, and where technical issues arise. This data is aggregated and does not identify individual players.
• Security cookies: These help us detect and prevent fraudulent activity, bot traffic, and unauthorised account access attempts.

You can manage your cookie preferences through your browser settings. However, disabling strictly necessary cookies will prevent you from logging in and using account-specific features. Analytical and functional cookies can be disabled without affecting core functionality.

We do not use third-party advertising cookies or cross-site tracking pixels to serve personalised advertisements.

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Active account data: Retained for the duration of your active account relationship with 8mbit, plus a period of up to 5 years following account closure to meet audit, fraud investigation, and regulatory record-keeping obligations.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction, in compliance with anti-money laundering record-keeping requirements.
• KYC verification documents: Retained for the duration of the account relationship plus 5 years post-closure. Original document copies are securely deleted at the end of the retention period.
• Customer support communications: Retained for 2 years from the date of the interaction, unless related to an unresolved dispute in which case they are retained until the dispute is fully resolved.
• Marketing consent records: Retained for as long as you remain subscribed to marketing communications, plus 1 year thereafter as evidence of consent.
• Self-exclusion records: Retained permanently to prevent re-registration by players who have self-excluded indefinitely, and for the duration of the exclusion period plus 5 years for time-limited exclusions.

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to you as an individual.

Security Measures

8mbit takes the security of your personal data seriously and implements a range of technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. Our key security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers.
• Encryption at rest for all sensitive data stored in our databases, including identity documents and financial records.
• Access controls limiting internal access to personal data on a strict need-to-know basis. All staff with access to personal data undergo data protection training.
• Multi-factor authentication for internal administrative access to systems holding personal data.
• Regular security audits and penetration testing conducted by qualified third-party security professionals.
• Incident response procedures to detect, contain, and notify affected individuals of any personal data breach within the timeframes required by applicable law.

While we take every reasonable precaution, no online platform can guarantee absolute security. You play an important role in protecting your own data — use a strong, unique password for your 8mbit account and never share your login credentials with anyone.

Your Data Rights

As an 8mbit player, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request":

• Right of Access: You may request a copy of all personal data 8mbit holds about you, along with information about how it is used and with whom it is shared. We will respond to access requests within 30 days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. You may update most account details directly through your account settings.
• Right to Erasure: You may request deletion of your personal data in certain circumstances — for example, where it is no longer necessary for the purpose it was collected and we have no legal obligation to retain it. Note that legal record-keeping obligations may prevent us from fulfilling deletion requests in full.
• Right to Restrict Processing: You may request that we limit how we use your data while a dispute about its accuracy or our right to process it is being resolved.
• Right to Data Portability: Where technically feasible, you may request a copy of your personal data in a structured, machine-readable format for transfer to another service.
• Right to Object: You may object to processing based on our legitimate interests, including any profiling carried out for fraud prevention. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing emails), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Children & Minors

The 8mbit platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect personal data from any person under the age of 21. If we become aware that personal data has been collected from a minor, we will immediately close the relevant account, forfeit any associated balances, and securely delete all personal data relating to that individual.

If you are a parent or guardian and believe your child has created an 8mbit account, please contact us immediately at [email protected] so we can take appropriate action without delay.

Third-Party Links

The 8mbit platform does not contain links to external third-party websites. All navigation within the platform remains on the 8mbit domain. However, game content streamed or served by third-party game providers (such as Pragmatic Play, Evolution Gaming, Microgaming, and others) is delivered through embedded iframes or API integrations. These providers operate under their own privacy and security standards, and 8mbit is not responsible for the data practices of game studios in relation to any data those studios independently collect through their own systems.

We encourage you to review the privacy policies of any third-party services you interact with outside of the 8mbit platform.

International Data Transfers

Where personal data is transferred outside of Bangladesh — for example, to cloud hosting providers or KYC verification services whose infrastructure is hosted in other countries — 8mbit takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to its protection within Bangladesh.

Such safeguards may include contractual clauses that require recipient organisations to protect personal data in accordance with applicable data protection standards, and vendor due diligence processes to confirm that international data processors maintain adequate security certifications (such as ISO 27001).

Your financial transaction data processed via bKash, Nagad, Rocket, and Upay is handled within Bangladesh in accordance with those providers' own regulatory obligations under Bangladeshi financial law.

Policy Updates

8mbit may update this Privacy Policy from time to time to reflect changes in our data handling practices, the services we offer, or applicable legal requirements. When we make material changes to this Policy — meaning changes that significantly affect how we use your personal data or the rights available to you — we will:

• Send a notification to your registered email address at least 7 days before the changes take effect.
• Display a prominent notice on the 8mbit platform homepage for a period of at least 14 days following the update.
• Update the "Last Updated" date at the top of this page.

Non-material changes — such as clarifications of existing language, correction of typographical errors, or updates to contact details — may be made without advance notice and will take effect immediately upon publication. We encourage you to review this Policy periodically to stay informed about how 8mbit protects your data.

Your continued use of the 8mbit platform following the effective date of any revised Policy constitutes your acceptance of the changes.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how 8mbit has handled your personal data, please contact our Data Support team using the details below. All privacy-related communications should include your registered email address and, where relevant, the specific data category or right you are enquiring about.

Email: [email protected]

Subject line for data requests: Data Rights Request

Response time: Within 30 calendar days of receipt of a valid request. We aim to acknowledge all enquiries within 2 business hours (Bangladesh Standard Time, UTC+6).

If you are not satisfied with how we have handled your personal data or responded to a data rights request, you have the right to escalate your concern to the relevant data protection authority in your jurisdiction.

This Privacy Policy was last reviewed and updated on 1 January 2026. It supersedes all previous versions of the 8mbit Privacy Policy.