kiraya Privacy Policy

kiraya collects personal data from you in three primary ways: data you provide directly when registering and using the platform, data generated automatically through your use of the platform, and data received from trusted third-party partners such as payment processors and identity verification providers. The categories of personal data we collect are described below.

1.1 Data You Provide Directly

When you create a kiraya account or interact with our support team, you may provide the following categories of personal data:

• Identity data: Your full legal name, date of birth, and gender as stated on your Bangladesh National Identity Card (NID) or passport.
• Contact data: Your email address, mobile number, and residential address (including city — for example, Dhaka, Chittagong, Sylhet, Khulna, or Rajshahi).
• Account credentials: Your chosen username and a hashed version of your password. kiraya never stores passwords in plain text.
• KYC documentation: Copies of government-issued identity documents, proof of address, and payment method ownership screenshots submitted during the Know Your Customer verification process.
• Financial data: Your registered bKash, Nagad, or Rocket mobile wallet number and transaction references associated with deposits and withdrawal requests.
• Communications data: The content of messages, emails, or live chat transcripts you exchange with the kiraya customer support team.
• Responsible gaming preferences: Any deposit limits, session reminders, cooling-off periods, or self-exclusion requests you configure on your account.

1.2 Data Collected Automatically

When you access the kiraya platform, our systems automatically collect certain technical and behavioural data, including:

• Device and browser data: IP address, device type, operating system, browser type and version, screen resolution, and language settings.
• Usage data: Pages visited, games played, bet amounts, session duration, login timestamps, and navigation paths within the platform.
• Transaction data: Records of all deposits, withdrawals, wagers, bonus activations, and game round outcomes associated with your account.
• Cookie and tracking data: Data collected via cookies, pixel tags, and similar technologies as described in the Cookies section of this Policy.

1.3 Data Received from Third Parties

In certain circumstances kiraya may receive personal data about you from third parties, including:

• Identity verification and fraud screening providers who confirm the authenticity of KYC documentation you submit.
• Mobile financial service providers (bKash, Nagad, Rocket) who share transaction confirmation data with kiraya to facilitate deposit and withdrawal processing.
• Game studio and sports data providers (Evolution Gaming, Pragmatic Play, Spribe, Ezugi, and others) who share game session data and bet settlement records to populate your account transaction history.

kiraya processes your personal data only where there is a lawful basis to do so. The primary purposes for which your data is used, and the corresponding lawful basis for each, are set out in the table below.

kiraya will not use your personal data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your explicit consent. Where kiraya relies on consent as the lawful basis for processing, you have the right to withdraw that consent at any time by updating your account preferences or contacting our support team.

kiraya does not sell your personal data. We share your data only with carefully selected third parties where doing so is necessary to operate the platform, fulfil our legal obligations, or protect the safety of our players. All third-party data processors engaged by kiraya are contractually required to handle your data securely and in accordance with applicable data protection law.

3.1 Categories of Third-Party Recipients

• Payment service providers: bKash, Nagad, and Rocket receive the minimum data necessary to process deposit and withdrawal transactions — typically your registered wallet number and transaction amount in BDT. These providers operate under their own privacy policies and regulatory obligations.
• Identity verification providers: Third-party KYC and fraud screening services may receive copies of your identity documents and biometric data (such as a selfie match against your NID) solely for the purpose of confirming your eligibility to hold a kiraya account.
• Game studio and sports data providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, Ezugi, and other platform partners receive a session token and account identifier to facilitate real-time game delivery. These providers do not receive your full personal profile or financial data.
• IT and cloud infrastructure providers: kiraya uses third-party cloud hosting and database services to store and process platform data. All such providers are required to maintain data security standards equivalent to or exceeding those applied by kiraya directly.
• Analytics and performance monitoring services: Anonymised or pseudonymised usage data may be shared with analytics providers to help kiraya understand platform performance and improve the player experience. This data cannot reasonably be used to identify individual players.
• Legal and regulatory authorities: kiraya may be required by applicable law to disclose personal data to law enforcement agencies, financial intelligence units, or regulatory bodies in connection with fraud investigations, anti-money laundering obligations, or court orders. kiraya will notify affected players of such disclosures where legally permitted to do so.

3.2 International Data Transfers

As an internationally operated platform, some of kiraya's third-party service providers may be located outside Bangladesh. Where personal data is transferred internationally, kiraya takes steps to ensure that appropriate safeguards are in place — including contractual protections — to protect your data to a standard equivalent to that required under applicable Bangladeshi data protection principles.

kiraya uses cookies and similar tracking technologies to operate essential platform functions, remember your preferences, analyse platform usage, and — where you have consented — deliver personalised content and relevant promotional offers. This section explains what cookies we use and how you can manage them.

4.1 Types of Cookies Used by kiraya

4.2 Managing Your Cookie Preferences

You can manage or withdraw your cookie consent at any time through the cookie preference settings accessible in your kiraya account dashboard. You may also configure your browser to block or delete cookies; however, please be aware that disabling strictly necessary cookies will impair your ability to log in and use the kiraya platform.

kiraya uses session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period). Persistent cookies used by kiraya do not retain sensitive financial data and are used only for the purposes described above.

kiraya retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply to the main categories of personal data we hold.

• Account and identity data: Retained for the duration of your active kiraya account plus a minimum of 5 years following permanent account closure, in compliance with anti-money laundering record-keeping obligations.
• KYC documentation: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later, in line with financial compliance requirements.
• Transaction records: All deposit, withdrawal, wagering, and bonus transaction records are retained for a minimum of 5 years following the date of each transaction.
• Customer support communications: Retained for 3 years from the date of the most recent interaction in a given support case, unless the communication relates to an active dispute or legal proceeding.
• Marketing consent records: Retained for 3 years from the date of consent, or until withdrawn, whichever is earlier.
• Cookie and analytics data: Anonymised analytics data may be retained for up to 26 months. Individual session logs are retained for 90 days for security monitoring purposes.

When the applicable retention period expires, kiraya will securely delete or permanently anonymise your personal data in accordance with our internal data destruction procedures. Data that has been fully anonymised — meaning it can no longer reasonably be used to identify you — may be retained indefinitely for statistical and product improvement purposes.

As a kiraya player, you have a number of rights in relation to the personal data we hold about you. kiraya is committed to honouring these rights promptly and transparently. To exercise any of the rights listed below, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and your registered account email address.

• Right of Access: You have the right to request a copy of all personal data kiraya holds about you, along with information on how it is being processed. kiraya will respond to access requests within 30 days.
• Right to Rectification: If any personal data kiraya holds about you is inaccurate or incomplete, you have the right to request that it be corrected without undue delay. You may also update certain personal details directly through your account settings dashboard.
• Right to Erasure: Subject to our legal and contractual retention obligations, you may request that kiraya delete the personal data we hold about you. Note that kiraya is legally required to retain certain data (such as KYC records and transaction history) for a minimum period even after account closure; erasure requests cannot override these obligations.
• Right to Restrict Processing: In certain circumstances — for example, where you contest the accuracy of your data or object to a particular processing activity — you may request that kiraya restrict its use of your data while the matter is resolved.
• Right to Data Portability: Where kiraya processes your data on the basis of your consent or the performance of a contract, and the processing is carried out by automated means, you may request that kiraya provide your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object at any time to kiraya processing your personal data for direct marketing purposes. Upon receipt of such an objection, kiraya will cease processing your data for marketing immediately. You may also object to processing based on legitimate interest; kiraya will then assess whether compelling grounds exist to continue.
• Right to Withdraw Consent: Where processing is based on your consent — for example, marketing communications — you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

kiraya takes the security of your personal data seriously and applies a layered set of technical and organisational safeguards designed to protect your information against unauthorised access, accidental loss, disclosure, or destruction.

• TLS/SSL Encryption: All data transmitted between your device and the kiraya platform is encrypted using Transport Layer Security (TLS). This applies to login sessions, payment flows, and customer support interactions.
• Password Hashing: Player passwords are never stored in plain text. kiraya uses industry-standard cryptographic hashing algorithms to store password data, meaning that even in the event of a database breach, your password cannot be recovered in its original form.
• Access Controls: Access to player personal data within kiraya's internal systems is restricted on a strict need-to-know basis. Staff members can only access the data necessary to perform their specific role. All internal data access is logged and audited.
• Secure Payment Processing: kiraya integrates with bKash, Nagad, and Rocket via their official secured APIs. Full mobile wallet credentials are not transmitted to or stored on kiraya's servers at any point.
• Fraud and Anomaly Detection: kiraya employs automated monitoring systems that flag unusual account activity — such as login attempts from new devices, atypical withdrawal patterns, or multiple accounts linked to the same device or IP address — for immediate review by our security team.
• Regular Security Reviews: kiraya conducts periodic internal security reviews of its data handling practices and platform infrastructure. Identified vulnerabilities are remediated on a priority basis.

Despite these measures, no online platform can guarantee absolute security. kiraya cannot accept liability for data breaches that result from events entirely outside its reasonable control, such as vulnerabilities in third-party software or force majeure events. In the event of a data breach that is likely to result in a risk to the rights and freedoms of affected players, kiraya will notify affected individuals without undue delay in accordance with applicable legal requirements.

kiraya reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. When material changes are made, kiraya will notify registered players via the email address associated with their account, or via a prominent notice on the platform, at least 14 days before the revised policy takes effect.

The effective date of the current version of this Privacy Policy is stated at the top of this page. Continued use of the kiraya platform after the effective date of a revised Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the revised Privacy Policy, you must cease using the platform and close your account before the effective date of the changes.

Previous versions of this Privacy Policy are archived and available upon request by contacting our support team.

Contact Our Privacy Team

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data kiraya holds about you, please contact us using the details below. Our English-language support team is available 24 hours a day, 7 days a week, including Bangladesh public holidays such as Eid, Victory Day (December 16), and Independence Day (March 26).

• Email: [email protected]
• Subject Line for Privacy Requests: "Privacy Rights Request"
• Response Time: Acknowledgement within 5 working days; full response within 30 calendar days
• Language: English (all privacy communications are handled in English)
• Hours: 24/7, Bangladesh Standard Time (BST, UTC+6)