kirika Privacy Policy — Your Data, Protected

1 Information We Collect

When you interact with the kirika platform — whether by registering an account, making a deposit, placing a wager, or contacting our support team — kirika collects certain categories of personal information. The precise data we collect depends on how you use our services and at what stage of the account lifecycle you are at.

1.1 Registration and Identity Data

During the account registration process, kirika collects the following information directly from you:

• Full legal name as it appears on your government-issued identification document.
• Date of birth, used to verify that you meet the minimum age requirement of 18 years.
• Residential address, including district, division, and postcode within Bangladesh.
• Mobile phone number, used for account verification, two-factor authentication, and support communications.
• Email address, used for account notifications, promotional communications (where opted in), and password recovery.
• Username and password, which together form your account access credentials.

1.2 Identity Verification (KYC) Data

As part of our Know Your Customer (KYC) compliance obligations, kirika may request copies of the following documents at any point during your account lifecycle — typically before processing a withdrawal above a defined threshold or as part of a routine compliance review:

• National Identity Card (NID) — front and back.
• Passport bio-data page.
• Utility bill or bank statement issued within the past 90 days, confirming your registered address.
• Source of funds documentation, where required by our anti-money laundering (AML) compliance team.

All KYC documents are stored in encrypted form and accessed only by authorised compliance personnel on a strictly need-to-know basis.

1.3 Financial and Transaction Data

kirika records the following transaction-related information in order to process deposits, withdrawals, and account balances accurately:

• Payment method type (e.g., bKash, Nagad, Rocket, Upay, bank transfer).
• Mobile wallet number or bank account number associated with each transaction (stored in anonymised reference form only — full account numbers are not retained).
• Transaction amounts in Bangladeshi Taka (BDT / ৳).
• Transaction timestamps and reference numbers.
• Deposit and withdrawal history for your kirika account.

1.4 Technical and Device Data

When you access the kirika platform, our servers automatically collect certain technical information about your device and connection. This data is used for platform security, fraud prevention, and service optimisation:

• IP address and approximate geolocation (country and city level).
• Device type, operating system, and browser version.
• Device fingerprint (a non-personally identifiable hash used for fraud detection).
• Pages visited, features accessed, session duration, and navigation patterns.
• Referring URLs and exit pages.

1.5 Communications Data

When you contact kirika's support team via live chat, email, or any other support channel, we retain records of the conversation — including the content of messages, timestamps, and the outcome of any support tickets — for quality assurance, training, and dispute resolution purposes.

---

2 How We Use Your Information

kirika uses the personal information it collects for the following defined purposes. We process your data only where we have a lawful basis to do so — primarily contractual necessity, legal obligation, or our legitimate interests in operating a secure and compliant gaming platform.

kirika will never use your personal data for purposes that are incompatible with those listed above without first obtaining your explicit consent. You may withdraw consent for marketing communications at any time by contacting kirika support or updating your account notification preferences.

---

3 Data Sharing & Third Parties

kirika does not sell your personal information to any third party. We share your data only in the following clearly defined and controlled circumstances:

3.1 Payment Processing Partners

To process your deposits and withdrawals, kirika transmits the minimum necessary transaction data to payment service providers including bKash, Nagad, Rocket, Upay, and the banking partners we work with. These providers process payment data under their own privacy policies and are bound by applicable financial data security standards. kirika does not transmit more data than is strictly required to execute each transaction.

3.2 Game Technology Providers

The games available on the kirika platform are powered by third-party game studios including Pragmatic Play, Evolution Gaming, Ezugi, NetEnt, Microgaming, and Spribe. These providers receive anonymised session data (such as game round identifiers and wager amounts) sufficient to operate and audit their games. They do not receive your full personal profile or contact information.

3.3 Legal and Regulatory Disclosure

kirika may disclose your personal information to law enforcement authorities, regulatory bodies, or legal representatives where required to do so by applicable law, court order, or regulatory directive. We will notify you of any such disclosure to the extent permitted by law, unless disclosure notification is itself prohibited by the relevant legal instrument.

3.4 Fraud Prevention and Security Services

kirika uses third-party fraud detection and cybersecurity service providers to protect the integrity of the platform. These providers may receive anonymised or pseudonymised technical data (such as device fingerprints and IP addresses) to identify and block malicious activity. They do not receive directly identifying personal information such as your name, address, or payment details.

---

4 Cookies & Tracking Technologies

The kirika website uses cookies and similar tracking technologies to deliver a functional, secure, and personalised experience. A cookie is a small text file placed on your device when you visit a website. kirika uses cookies for the following distinct purposes:

4.1 Strictly Necessary Cookies

These cookies are essential for the kirika platform to function correctly. They maintain your session state, preserve your login status between pages, remember your game preferences within a session, and protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core platform functionality and do not require your consent to be set.

4.2 Performance and Analytics Cookies

kirika uses analytics cookies to understand how players navigate the platform — which pages are visited most frequently, where users encounter friction, and how long sessions typically last. This data is collected in aggregate and anonymised form and is used solely to improve the kirika user experience. No individual player is identified in analytics reporting.

4.3 Functional Cookies

Functional cookies allow the kirika platform to remember your preferences between sessions — such as your preferred display language, notification settings, and any customisation you have applied to your account dashboard. Disabling these cookies may result in a reduced personalisation experience.

4.4 Fraud Detection Cookies

kirika's fraud detection system uses a combination of cookies and device fingerprinting to identify and prevent fraudulent account activity, bonus abuse, and unauthorised access attempts. These security cookies are strictly necessary and cannot be disabled as they form a core part of kirika's platform security infrastructure.

4.5 Managing Your Cookie Preferences

You may manage non-essential cookie preferences through your browser's cookie settings at any time. Most modern browsers allow you to view, block, or delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging into and using your kirika account. Detailed instructions for managing cookies in popular browsers are available through the respective browser's help documentation.

---

5 Data Retention & Storage

kirika retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as standard:

• Active account data (registration, contact details, account preferences): retained for the lifetime of your kirika account plus 5 years following account closure.
• KYC and identity verification documents: retained for a minimum of 5 years following account closure, in line with standard anti-money laundering record-keeping requirements.
• Transaction and financial records: retained for 7 years following each transaction date to comply with financial record-keeping obligations.
• Support communications: retained for 3 years from the date of the most recent interaction.
• Technical and device data: retained in anonymised, aggregated form for up to 2 years for platform security and fraud analysis purposes.
• Marketing consent records: retained until consent is withdrawn, plus 1 year thereafter as an audit record of the consent history.

Once a retention period expires, personal data is securely deleted or irreversibly anonymised using methods that prevent reconstruction of the original data. Data held in encrypted backup systems is purged during the next scheduled backup rotation cycle following expiry of the applicable retention period.

---

6 Your Privacy Rights

As a kirika player, you hold the following rights with respect to your personal data. These rights can be exercised at any time by submitting a written request to kirika's support team at [email protected]. kirika will respond to all verified privacy rights requests within 5 business days.

6.1 Right of Access

You have the right to request a copy of all personal data that kirika holds about you. Upon receiving a verified access request, kirika will provide a structured summary of your stored data, the purposes for which it is used, and the categories of third parties with whom it has been shared.

6.2 Right to Rectification

If any personal information stored in your kirika account is inaccurate or incomplete, you have the right to request that it be corrected. You may update some account details directly through your account settings; for changes to identity-related records (such as your legal name), a written request accompanied by supporting documentation is required.

6.3 Right to Erasure

You may request the deletion of your personal data from kirika's systems. Please note that kirika is legally obligated to retain certain categories of data — particularly KYC records and financial transaction histories — for defined periods regardless of an erasure request. kirika will clearly communicate which data can be immediately deleted and which must be retained under legal obligations when processing your request.

6.4 Right to Restrict Processing

In certain circumstances — for example, where you contest the accuracy of your stored data or have objected to a specific use of your information — you may request that kirika restricts its processing of your personal data while the matter is under review. During a restriction period, kirika will continue to store your data but will not actively process it for the contested purpose.

6.5 Right to Withdraw Marketing Consent

If you have opted in to receive promotional emails, SMS notifications, or other marketing communications from kirika, you may withdraw this consent at any time. You can do so by contacting kirika support at [email protected] or by updating your communication preferences in your account settings. Withdrawal of marketing consent will take effect within 48 hours of confirmation.

6.6 Right to Lodge a Complaint

If you believe that kirika has handled your personal data in a manner that does not comply with this Privacy Policy or applicable data protection principles, you have the right to raise a formal complaint. Complaints should be submitted in writing to [email protected] with the subject line "Privacy Complaint". kirika will acknowledge your complaint within 2 business days and provide a substantive response within 10 business days.

---

7 Data Security Measures

kirika implements a layered approach to data security, combining technical, organisational, and procedural controls to protect your personal information against unauthorised access, accidental loss, destruction, or disclosure. The key security measures in place include:

• Transport Layer Security (TLS): All data transmitted between your browser and kirika's servers is encrypted using TLS 1.3, the current industry standard for secure web communications.
• Data encryption at rest: All personal data stored in kirika's databases is encrypted using AES-256 encryption. Encryption keys are managed separately from the encrypted data and rotated on a regular schedule.
• Access controls: Access to personal data systems is restricted to authorised personnel only, governed by role-based access controls and multi-factor authentication. All access events are logged and subject to periodic security audit.
• Penetration testing: kirika's technical infrastructure undergoes periodic third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses before they can be exploited.
• Incident response plan: kirika maintains a documented data breach incident response plan. In the event of a breach affecting your personal data, kirika will notify affected players and take all appropriate remedial action without undue delay.
• Staff training: All kirika employees with access to personal data receive regular training on data protection obligations, secure data handling practices, and the identification of social engineering attacks.

Despite these measures, no online platform can guarantee absolute security against all possible threats. kirika strongly recommends that all players use a unique, strong password for their kirika account, enable two-factor authentication, and never share their login credentials with any third party.

---

8 Updates to This Policy

kirika reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable legal requirements, or the services we offer. When material changes are made to this policy, kirika will:

• Publish the updated Privacy Policy on this page with a revised "Last Updated" date at the top of the document.
• Send a notification email to all registered kirika players summarising the key changes at least 7 days before the revised policy takes effect.
• Display an on-platform notification prompting players to review the updated policy when they next log in to their kirika account.

Your continued use of the kirika platform after a revised Privacy Policy has taken effect constitutes your acceptance of the updated terms. If you do not agree with changes to this policy, you must cease using the platform and submit an account closure request before the revised policy becomes effective.

For any questions, concerns, or requests related to this Privacy Policy or kirika's data handling practices, please contact our dedicated privacy team at [email protected]. We are committed to responding to all privacy enquiries promptly and transparently.