kikya Privacy Policy

1 Introduction

kikya ("we", "us", "our") is an internationally operated online casino and sports betting platform serving Bangladeshi players at https://kikya.io. We are committed to protecting the privacy of every individual who accesses, browses, or registers on our platform. This Privacy Policy describes the types of personal data we collect, the purposes for which that data is processed, the parties with whom it may be shared, and the rights available to you as a data subject.

This Privacy Policy applies to all users of the kikya Platform regardless of the device or method used to access it — desktop browser, mobile browser, or any other client. It applies to registered Players and to unregistered visitors alike, though the scope of data collected differs depending on whether you hold an active account.

By accessing the Platform, creating an account, or continuing to use our services after this policy has been updated, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you should discontinue use of the Platform immediately.

2 Data We Collect

The categories of personal data that kikya collects and processes are set out below. We have organised them by the context in which they arise.

We do not collect special-category data (also known as sensitive personal data) such as racial or ethnic origin, religious beliefs, health information, or biometric data for identification purposes, except where identity verification documents incidentally contain such information, in which case only the minimum necessary fields are recorded for KYC compliance purposes.

3 How We Collect Data

kikya collects personal data through several channels, all of which are described transparently below:

• Direct collection: Data you provide actively when registering an account, completing KYC verification, making a deposit or withdrawal, updating your profile, or submitting a support request.
• Automated collection: Technical and behavioural data collected automatically as you navigate the Platform, using server-side logs, browser-based cookies, and analytics tools. This includes IP addresses, session identifiers, and device fingerprinting signals used for fraud prevention.
• Payment providers: Transaction confirmation data and payment status information received from our payment processing partners including bKash, Nagad, Rocket, Upay, and card processing gateways. We do not receive or store full card numbers or mobile banking PINs.
• Identity verification partners: Where automated document checking is used as part of the KYC process, our verification service partner may supply a verification outcome and associated risk score to us. The underlying document data is handled in accordance with that partner's own privacy policy.
• Game providers: Aggregated or session-level game data from third-party game studios integrated into the Platform (Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, Ezugi, and others). This data relates to game session activity and is used for account management, dispute resolution, and responsible gaming monitoring.

4 Legal Basis for Processing

kikya processes personal data only where a valid legal basis exists for doing so. The primary legal bases on which we rely are as follows:

• Contractual necessity: Processing that is required to perform the contract we have with you as a registered Player, including operating your account, processing deposits and withdrawals in BDT, crediting bonuses, and settling bets.
• Legal obligation: Processing required to comply with applicable legal obligations, including anti-money laundering (AML) regulations, know-your-customer (KYC) requirements, and record-keeping mandates imposed on licensed gaming operators.
• Legitimate interests: Processing carried out for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes fraud detection, platform security monitoring, responsible gaming enforcement, business analytics, and service improvement.
• Consent: Where we rely on your consent — for example, to send you optional marketing communications about kikya promotions, seasonal offers such as those around Eid or Pohela Boishakh, and new game launches — you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

5 How We Use Your Data

The personal data we collect is used for the specific purposes listed below. We do not use your data for purposes that are incompatible with those stated at the time of collection.

• Creating and managing your kikya Player account, including authentication, account security, and profile maintenance.
• Processing deposits and withdrawals through bKash, Nagad, Rocket, Upay, Visa, and Mastercard, and maintaining accurate transaction records denominated in BDT.
• Conducting age and identity verification to enforce our strict 21+ age policy and satisfy KYC obligations.
• Detecting, investigating, and preventing fraud, money laundering, cheating, collusion, and other prohibited activities as defined in the Terms and Conditions.
• Operating responsible gaming tools including deposit limit enforcement, cooling-off periods, and self-exclusion processing.
• Providing customer support and resolving disputes, complaints, or account queries submitted via [email protected].
• Personalising your experience on the Platform, including recommending games and promotions relevant to your activity history, where you have not opted out of such personalisation.
• Sending transactional communications such as deposit confirmations, withdrawal status updates, and account security alerts — these are not marketing messages and are sent regardless of marketing preferences.
• Sending optional marketing communications about promotions, bonuses, and new product launches to Players who have provided consent.
• Conducting internal analytics to understand usage patterns, improve Platform performance, and inform product development decisions.
• Complying with legal obligations including responding to lawful requests from regulatory bodies, law enforcement agencies, or courts of competent jurisdiction.

6 Data Sharing & Disclosure

kikya does not sell your personal data to any third party. We share personal data only in the limited circumstances described below, and always subject to appropriate data-handling obligations on the part of the recipient.

• Payment processors: We share necessary transaction data with bKash, Nagad, Rocket, Upay, and card payment gateways solely to execute deposits and withdrawals. These processors operate under their own privacy policies and regulatory obligations.
• KYC and identity verification providers: Document verification data is shared with our contracted identity verification partner to perform age and identity checks. This partner processes data under a data processing agreement that restricts use to verification purposes only.
• Game studio providers: Session-level activity data is exchanged with integrated game providers (Pragmatic Play, NetEnt, Microgaming, Evolution Gaming, Spribe, Ezugi) as required for game operation, RNG certification, and dispute resolution. These studios do not receive your identity or financial data beyond what is technically required for session continuity.
• Fraud prevention and security services: Technical data including IP addresses, device fingerprints, and behavioural signals may be shared with specialist fraud-prevention service providers to identify and mitigate fraudulent activity on the Platform.
• Legal and regulatory authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so, or where we have a good-faith belief that disclosure is necessary to protect the rights, safety, or property of kikya, our Players, or third parties.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data held by kikya may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections being maintained.

7 Cookies & Tracking Technologies

The kikya Platform uses cookies and similar tracking technologies to operate core platform functions, maintain your session state, detect fraud, and gather aggregated analytics data. The categories of cookies we use are described below.

You may control cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent the Platform from functioning correctly and will log you out of your session. For all other cookie categories, you may submit an opt-out request to [email protected] and we will update your preferences within five business days.

8 Payment Data

kikya takes particular care in handling financial data given the sensitivity of payment information. The following principles govern how payment data is managed on the Platform:

• kikya does not store full mobile banking account credentials, PINs, or passwords for bKash, Nagad, Rocket, or Upay. Payment initiation is handled via tokenised redirects to the respective provider's secure gateway.
• For Visa and Mastercard transactions, full card numbers are never transmitted to or stored on kikya servers. Only the last four digits and card expiry are retained for display and withdrawal-routing purposes.
• All payment data in transit is protected by TLS 1.2 or higher. Payment data at rest is encrypted using AES-256 encryption.
• Transaction records in BDT are retained for a minimum of five years from the date of the transaction in compliance with applicable financial record-keeping requirements.
• kikya does not accept cryptocurrency payments. Any attempt to deposit via a cryptocurrency address will be rejected at the gateway level and no transaction data will be retained.

9 Data Security

kikya implements a layered set of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security infrastructure includes the following controls:

• 256-bit SSL/TLS encryption for all data in transit between clients and our servers.
• AES-256 encryption for personal and financial data stored at rest in our database infrastructure.
• Role-based access control (RBAC) ensuring that staff members can access personal data only to the extent required for their specific job function.
• Multi-factor authentication enforced for all administrative access to systems holding personal data.
• Regular automated vulnerability scanning and periodic penetration testing of the Platform's security perimeter.
• A formal data breach response procedure that includes containment, investigation, notification to affected Players, and where applicable, regulatory reporting within the timelines required by law.
• Third-party service providers are assessed for security compliance before onboarding and are contractually required to maintain security standards consistent with industry best practice.

Despite the measures described above, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials. If you suspect that your account has been compromised, contact [email protected] immediately.

10 Data Retention

We retain personal data for as long as is necessary to fulfil the purposes for which it was collected, and for no longer than is required by applicable law or legitimate business necessity. Our standard retention periods are as follows:

• Active account data: Retained for the lifetime of the account plus five years following permanent account closure, to satisfy anti-money laundering record-keeping obligations.
• KYC and identity documents: Retained for five years from the date of verification, or for five years from the date of account closure, whichever is later.
• Transaction records: Retained for a minimum of five years from the date of each transaction.
• Support communications: Retained for three years from the date of the last communication in a support thread.
• Technical and behavioural logs: Retained for up to 13 months on a rolling basis, after which they are aggregated or deleted.
• Marketing consent records: Retained for the duration of the consent plus three years following withdrawal of consent, to demonstrate compliance in the event of a regulatory enquiry.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to any identifiable individual. Anonymised or aggregated data may be retained indefinitely for statistical and analytical purposes.

11 Your Rights

As a data subject, you hold a number of rights in relation to the personal data that kikya processes about you. These rights are described below. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request" and your registered account username.

• Right of access: You may request a copy of the personal data we hold about you, along with information about the purposes for which it is processed and the categories of recipients to whom it has been disclosed.
• Right to rectification: You may request that we correct any inaccurate personal data held about you, or that we complete any incomplete data, without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent and no other legal basis applies, or where the data has been unlawfully processed. This right is subject to overriding legal obligations that require retention.
• Right to restrict processing: You may request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data while we verify it.
• Right to data portability: Where processing is carried out on the basis of consent or contractual necessity and by automated means, you may request that we provide your personal data to you in a structured, commonly used, machine-readable format.
• Right to object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before the withdrawal.

kikya will respond to all data rights requests within 30 calendar days of receipt. Where a request is complex or involves a high volume of data, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

12 Children & Minors

The kikya Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that a user account has been created by a person under 21, or that personal data belonging to a minor has been submitted to the Platform, we will immediately suspend the account, return any deposits to the originating payment method, forfeit any winnings generated during the period of underage use, and permanently delete all associated personal data.

If you are a parent or guardian and believe that your child may have registered on the kikya Platform, please contact us immediately at [email protected]. We treat reports of underage account creation as a high-priority matter and will investigate and resolve all such reports within one business day.

13 Third-Party Links

The kikya Platform may from time to time contain references to third-party game providers and payment services. While these integrations are embedded within the kikya interface, the underlying platforms and services are operated by independent companies with their own privacy policies and data-handling practices. kikya is not responsible for the privacy practices of any third-party provider whose services are accessed through the Platform.

We recommend that you review the privacy policies of any third-party service provider whose terms you are subject to when using games or payment methods on the kikya Platform. The key third-party providers integrated into kikya include Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Ezugi, bKash, Nagad, Rocket, and Upay, among others. Each of these operates under its own independent data governance framework.

14 Policy Amendments

kikya reserves the right to update or amend this Privacy Policy at any time. When material changes are made, we will notify registered Players by email to the address associated with their account, and we will update the "Effective" date shown at the top of this document and in the hero section of this page. Non-material clarifications or formatting corrections may be made without prior notice.

Your continued use of the kikya Platform following notification of a material amendment constitutes acceptance of the revised Privacy Policy. If you do not agree with the amended policy, you must cease using the Platform and may request account closure by contacting [email protected]. We will process all data associated with the closed account in accordance with the retention periods set out in Section 10.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Archived versions of previous policies are available upon request.

15 Contact & Data Requests

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data that kikya holds about you, please contact our support team using the details below. All privacy-related enquiries are handled by trained staff and treated with strict confidentiality.

• Email: [email protected] — use subject line "Privacy Enquiry" or "Data Rights Request" for faster routing
• Support hours: Available 24/7, with priority response during 10:00 AM – 2:00 AM Bangladesh Standard Time (BST, UTC+6)
• Response time: General privacy enquiries are acknowledged within 48 hours; formal data rights requests are acknowledged within 5 business days and resolved within 30 calendar days
• Postal address: Not applicable — kikya is an internationally operated digital platform with no physical retail presence in Bangladesh