How BK8 Cambodia handles your personal data

Who holds your data, and where the company sits

BK8 is operated by Mettlemind Tech Ltd., registration number 15779, registered at Hamchako, Mutsamudu, on the Autonomous Island of Anjouan in the Union of Comoros. Our current licence is issued by the Government of the Autonomous Island of Anjouan under number ALSI-202504032-FI2. That company is the controller of everything described on this page — the account you open, the documents you send us, the deposits you make and the pages you read on the way there. Our official Cambodian property is www.bk8khr.com, and its bare root sends you to the Khmer locale at /km-kh/home rather than an English one. That is a small detail, but it tells you which market the product was built for. Note also where this page sits. There are BK8-branded sites in this market that host no legal pages of their own at all — bk8kh88.com sends its About Us, Contact Us, Terms & Conditions and Responsible Gaming links offsite to the redirect host safeelink.com. Ours are here, on the same domain as the product they describe.

The shape of a Cambodian account decides how much financial data exists in the first place. We run two internal currency codes for this market and both resolve to hard currency — US dollars and euros — while the string KHR appears nowhere in our platform's currency table. Registration for the Cambodia region is restricted to a single currency, USD. So there is no riel balance on your account, no conversion history and no exchange-rate record attached to your name. In a country where 83.4% of broad money was already denominated in US dollars at the end of 2025, that is less exotic than it sounds — but it does mean one whole category of financial data simply never comes into existence here.

What we collect at each stage of an account

Collection is staged, not upfront. Opening an account asks for very little; the heavier checks arrive later, and only around money. The table below is the whole inventory for a Cambodian account, in the order the pieces usually appear. Each line exists because a specific part of the product, a payment rail or a licence obligation needs it. If you want to see the front end of this before you commit to anything, the registration walkthrough sets out exactly which fields you meet on day one.

Two absences are worth naming, because they are configuration decisions rather than oversights. Cambodian accounts require phone and email verification and nothing heavier at the door: birthdate verification and bank verification are switched on for some of our other currencies and are not switched on for this one. And the interface language sitting in your record is not a guess — we serve five distinct Cambodia locales (English, Khmer, Simplified Chinese, Indonesian and Vietnamese) with Khmer as the regional default, so which one you pick is stored and honoured rather than re-detected on every visit.

Why each piece is held

Every category in that table traces to one of five jobs, and if a piece of data does not serve one of them it has no business being on your record.

• Licence obligations. We operate under an Anjouan licence, and licensed operators are required to know who holds an account and to be able to reconstruct a transaction history when asked. That is the floor, not our preference.
• Fraud and account-takeover screening. Our footer carries iovation and ThreatMetrix badges, and device and network signals are what those tools read. They are also what catches somebody else logging into your account from a device you have never touched.
• Moving money. A deposit needs a routing reference and a withdrawal needs a destination. Three bank codes are configured for Cambodian deposits — ABA, ACLEDA and Maybank — and the reference attached to your account is what tells the money where to go.
• Responsible play. GamCare and BeGambleAware badges sit in our footer for a reason: limits, cool-offs and self-exclusion cannot work without a record of what you have deposited and staked. Our responsible gaming page covers the tools themselves.
• The product you actually get. Language, currency and promotion state decide which lobby loads and which offers are still open to you. If you took the +1500% first-deposit match and the 250 free spins, the turnover attached to that promotion lives on your record until it clears.

Identity checks: what verification actually looks at

Identity verification on our platform runs through Sumsub, and it is enabled on nine of our ten platform currencies — every one except PHP — with both Cambodian codes inside that nine. In practice a document request surfaces where the money does: around a first withdrawal, a change of payment destination, or a deposit pattern that does not match the rest of the account. It is a normal event in an account's life, not a signal that something has gone wrong. If you would rather see how it fits the payout sequence, our withdrawal page walks the whole route out.

What a verification check sees is narrow and finite: the document image, the selfie taken against it, and the machine-readable fields on the document itself. It does not open your bank app, read your messages or touch anything else on your phone. The result that comes back to us is a status and the identity fields that matched — enough to confirm the account belongs to the person named on it, and not more. Verification records are kept for as long as the account and the obligations around it require, and we would rather say that plainly than publish a retention figure we could not stand behind.

Payment data: what your bank sees, and what we see

Cambodian payment rails are unusually transparent about who holds what, and it helps to know where the line falls. KHQR is the national QR standard — one code any participating bank or wallet can pay — and Bakong, run by the National Bank of Cambodia, is the rail underneath it. When you pay from ABA Mobile, the confirmation PIN is entered in ABA's own app, at the last step of ABA's own flow. That PIN never travels through us. Neither does your banking login, your account password, or the balance sitting in your other accounts. What reaches our side is a payment reference and an amount.

The mirror image is also true: your bank keeps its own record of every transfer, and that record is not ours to edit or erase. Use a TrueMoney agent for a Bakong cash-in and you walk away with three copies of the same event — a push notification in your bank app, a paper receipt from the agent, and the entry on the rail itself. Cash out at one of Wing's 12,000-plus agents and the same logic applies. One practical consequence: the Bakong rail refuses cross-currency transfers, so the transfer currency and the account currency must match, which is why a dollar payout aimed at a riel account does not arrive slowly — it does not arrive. Our ABA Pay guide covers the mechanics in full.

Cookies, analytics and the click that brought you here

Cookies here do three jobs. They keep you signed in between pages so you are not re-entering an OTP every time you open the sportsbook. They remember which of the five Cambodian locales you chose. And they tell us, in aggregate, which pages people read and which ones they abandon — that is how a page like this one gets rewritten when nobody finishes it. Clearing them is your call, with one predictable consequence: you are logged out, and the language picker resets to Khmer, the regional default.

There is also a referral layer, and it is honest to name it. Google carries 97.35% of Cambodian mobile search referrals, and Facebook 48.94% of social referrals, so most people arriving here came through one of two doors and a tag on the visit records which. That tag measures campaigns; it does not follow you around the rest of your browsing. Every browser in common use here gives you the controls — Chrome runs 74.13% of Cambodian browsing across all devices and Safari 14.72%, and both let you block or clear cookies per site in a couple of taps. Worth noting the local convention while you are looking: even ABA Bank keeps the word Cookies in Latin script on its Khmer pages, so the setting you are hunting for will look the same in either language.

Your choices, and how to use them

Most of what people want from a privacy policy is not a document — it is a way to change something. These are the routes, in the order they are usually needed.

1. See what is on file. The personal details panel inside your BK8 account shows the phone number, email address and language currently attached to it. Start there before writing to anyone.
2. Correct it. A wrong digit in an 855 number is the single most common cause of a lost OTP and a locked account. Fix it while you can still receive the code on the old number.
3. Ask for a copy, or ask us to close the account. Both requests go through the support channels on our contact page. Send them from the email address on the account — it is the fastest way to prove the request is yours.
4. Set limits or exclude yourself. Deposit limits, cool-off periods and self-exclusion are account settings rather than privacy requests, and they are described on the responsible gaming page. Self-exclusion deliberately keeps a record of the exclusion itself, because a record is the only thing that makes it enforceable.
5. Withdraw a marketing consent. Turning off promotional email or SMS is separate from closing an account, and it does not touch service messages about withdrawals, verification or security.

Keeping the account itself secure

The weakest link in Cambodian account security is rarely the platform. It is a shared handset, a swapped SIM or a convincing message. Cambodia counted 25.3 million active cellular mobile connections at the start of 2025 against roughly 10.8 million internet users — 143% of the population in live connections, which is another way of saying a lot of people here carry more than one number. If the 855 number on your account is a SIM you no longer use, every recovery route we have runs into a dead end.

Two habits cover most of the remaining risk. Do not stay logged in on a phone other people use — a shop counter tablet, a friend's handset, a shared machine at an internet café — because a live session needs no password at all. And treat the email on the account as part of the account: if that inbox is compromised, the reset path is compromised with it. Opening an account at BK8 takes a couple of minutes; unwinding an account somebody else got into takes considerably longer.

Questions Cambodian players actually ask

Keep reading