kiriya Privacy Policy

Legal Basis for Processing

kiriya processes your personal data on the following legal bases: (a) Contract performance — processing is necessary to provide the services you have registered for, including operating your account, processing deposits and withdrawals, and delivering game access; (b) Legal obligation — processing is required to comply with applicable anti-money-laundering, counter-terrorism financing, and age-verification laws; (c) Legitimate interests — processing is necessary for fraud prevention, platform security, responsible gaming monitoring, and service improvement, provided those interests are not overridden by your data protection rights; (d) Consent — where we send you optional marketing communications, we rely on your explicit consent, which you may withdraw at any time.

How We Use Your Data

kiriya uses your personal data for the following purposes:

• Creating and managing your kiriya account and verifying your identity
• Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Visa, and Mastercard
• Conducting KYC and age-verification checks to confirm you are 21 years of age or older
• Detecting and preventing fraud, money laundering, and other forms of financial crime
• Monitoring gameplay patterns to identify and support players who may be experiencing gambling-related harm
• Providing customer support via live chat and email at [email protected]
• Sending transactional communications such as deposit confirmations, withdrawal notifications, and security alerts
• Sending optional promotional communications (only where you have given consent)
• Complying with requests from regulatory authorities, courts, or law enforcement agencies
• Improving the kiriya platform through usage analytics and performance monitoring

Sharing Your Data with Third Parties

kiriya shares personal data with third parties only where strictly necessary and only with organisations that have agreed to handle it in a manner consistent with this Policy. Categories of recipients include:

• Payment processors — bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, Visa, and Mastercard, solely to process financial transactions
• Identity verification providers — third-party KYC service providers used to verify government-issued ID documents
• Game studios and content providers — Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive anonymised session data necessary to operate their games on our platform
• Fraud prevention services — specialist providers that help detect and block fraudulent activity, using anonymised or pseudonymised data where possible
• Legal and regulatory authorities — where required to comply with a court order, legal obligation, or lawful request from a competent authority
• Technology infrastructure providers — cloud hosting and content delivery providers operating under strict data processing agreements

kiriya does not share your personal data with social media companies, advertising networks, or data brokers.

Cookies and Tracking Technologies

kiriya uses cookies and similar tracking technologies on the kiriya.im platform to ensure the site functions correctly, to maintain your session state across pages, and to gather anonymised analytics data about how users navigate the platform. The following types of cookies may be set:

• Essential cookies — required for core platform functionality such as login sessions, account security tokens, and language preferences. These cannot be disabled without impairing the service.
• Analytics cookies — used to understand aggregate usage patterns, identify performance issues, and improve the platform. Data collected is anonymised before analysis.
• Fraud-detection cookies — used to fingerprint devices and detect anomalous behaviour patterns associated with bonus abuse or account takeover attempts.

kiriya does not use advertising or retargeting cookies. You may manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent you from logging in and using core features of the kiriya platform.

Data Security Measures

kiriya implements a layered security architecture to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our technical and organisational measures include:

• End-to-end SSL/TLS encryption for all data in transit between your device and our servers
• AES-256 encryption for sensitive data fields stored in our databases
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent necessary for their job function
• Multi-factor authentication for all internal administrative systems
• Regular penetration testing and vulnerability assessments by independent security professionals
• Automated intrusion detection and real-time security monitoring across all platform infrastructure
• Incident response procedures that require notification to affected users within 72 hours of discovering a material data breach

International Data Transfers

kiriya's platform infrastructure is hosted across servers located in secure data centre facilities. Some of our third-party service providers — including certain game studios and fraud prevention partners — may process data outside Bangladesh. Where such transfers occur, kiriya ensures that adequate protections are in place through contractual safeguards, including standard data protection clauses that require the recipient to handle your data in a manner consistent with this Policy. kiriya does not transfer data to jurisdictions that offer materially lower data protection standards without implementing appropriate compensating controls.

Retention & Deletion

kiriya retains different categories of personal data for different periods based on the purpose for which they were collected and applicable legal requirements:

• Account and identity data — retained for the duration of the account relationship and for a minimum of 5 years after account closure, to satisfy anti-money-laundering record-keeping obligations
• Transaction records — retained for a minimum of 5 years in accordance with financial record-keeping requirements
• KYC documents — retained for a minimum of 5 years after the business relationship ends
• Live chat and support records — retained for 2 years to support dispute resolution
• Technical and usage logs — retained for up to 12 months for security monitoring and platform improvement purposes
• Marketing consent records — retained for as long as you remain opted in, plus 1 year after opt-out for audit purposes

Upon expiry of the applicable retention period, data is either securely deleted using industry-standard data destruction methods or anonymised such that it can no longer be linked to your identity.

Your Rights as a Data Subject

As a user of the kiriya platform, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of all personal data kiriya holds about you, free of charge, at any time
• Right to rectification — you may request correction of any inaccurate or incomplete personal data
• Right to erasure — you may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations
• Right to restriction — you may request that kiriya restricts processing of your data in certain circumstances, for example while a dispute is being resolved
• Right to object — you may object to processing based on legitimate interests, including profiling for responsible gaming monitoring purposes
• Right to withdraw consent — where processing is based on consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to data portability — you may request that kiriya provides your personal data in a structured, commonly used, machine-readable format

To exercise any of these rights, contact kiriya's support team via live chat or by emailing [email protected] (plain text — not a clickable link). We will respond to all verified requests within 30 days. We may need to verify your identity before actioning a request.

Children and Minors

The kiriya platform is strictly intended for adults aged 21 years and above. kiriya does not knowingly collect personal data from any person under the age of 21. If we discover that personal data has been collected from a person who is under 21, we will delete that data immediately and close the associated account. If you believe that kiriya may have inadvertently collected data from a minor, please contact [email protected] (plain text — not a clickable link) immediately. kiriya supports responsible gaming measures including mandatory age verification at registration and at the point of first withdrawal.

Marketing Communications

kiriya may, with your explicit consent, send you promotional communications regarding new games, seasonal offers (such as Eid, Pohela Boishakh, or BPL cricket season promotions), and platform updates. You may opt out of marketing communications at any time by: (a) clicking the unsubscribe link in any marketing email; (b) contacting support via live chat; or (c) updating your communication preferences in your account settings. Opting out of marketing communications will not affect transactional messages such as deposit confirmations and security alerts, which are necessary for the operation of your account.

Changes to This Privacy Policy

kiriya reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. Where changes are material — such as introducing a new category of data sharing or a new purpose for processing — kiriya will provide at least 7 days' advance notice via a prominent notice on the platform or by email to your registered address. The date at the top of this Policy will always reflect when it was last updated. Your continued use of the kiriya platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.