Karikya Privacy Policy — How We Handle Your Personal Data

1. Introduction

Karikya takes the privacy of its players seriously. We understand that when you share personal information with us — whether during registration, when making a deposit, or when contacting support — you are trusting us to handle that information responsibly. This Privacy Policy is our commitment to you that we will do exactly that.

This policy applies to all personal data collected through the Karikya website at karikya.co, the Karikya mobile app, and any communication channels operated by Karikya, including live chat and email support. It covers players based in Bangladesh and any other jurisdiction where Karikya operates.

If you have questions about anything in this policy, you can reach the Karikya privacy team directly at [email protected]. We aim to respond to all privacy-related enquiries within 72 hours.

2. Data We Collect

Karikya collects personal data in three ways: information you provide directly, information generated automatically by your use of the platform, and information received from third-party payment providers for the purpose of processing transactions.

Karikya does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data. We collect only what is necessary to operate your account, process payments, verify your identity, and comply with our legal obligations.

3. How We Use Your Data

Karikya uses your personal data for the following purposes:

• Account operation: To create and manage your Karikya account, authenticate your identity at login, and maintain your account preferences and settings.
• Payment processing: To process deposits and withdrawals via bKash and Nagad, verify that payment accounts are registered in your name, and maintain accurate financial records.
• Identity verification: To confirm that you meet the minimum age requirement of 18 years and to comply with anti-money laundering (AML) obligations.
• Customer support: To respond to your enquiries, resolve disputes, and provide assistance with your account.
• Responsible gaming: To monitor gaming patterns that may indicate problem gambling behaviour and to apply responsible gaming tools you have activated on your account.
• Platform improvement: To analyse aggregated, anonymised usage data to improve the performance, design, and game selection of the Karikya platform.
• Security and fraud prevention: To detect and prevent fraudulent activity, unauthorised account access, bonus abuse, and money laundering.
• Legal compliance: To meet our obligations under applicable law, including responding to lawful requests from regulatory authorities or law enforcement agencies.

Karikya does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review. If an automated system flags your account for review, a member of the Karikya compliance team will assess the situation before any action is taken.

4. Legal Basis for Processing

Karikya processes your personal data on the following legal grounds:

• Contract performance: Processing your data is necessary to provide the services described in the Karikya Terms and Conditions — including operating your account, processing payments, and delivering game services.
• Legal obligation: Karikya is required by law to collect and retain certain data for anti-money laundering compliance, age verification, and financial record-keeping.
• Legitimate interests: Karikya has a legitimate interest in preventing fraud, maintaining platform security, and improving its services — provided these interests do not override your fundamental privacy rights.
• Consent: Where Karikya sends you optional marketing communications or uses non-essential cookies, it does so only with your explicit consent, which you may withdraw at any time.

5. Data Sharing

Karikya does not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Payment providers: Karikya shares the minimum necessary data with bKash and Nagad to process your transactions. These providers operate under their own privacy policies and are bound by contractual data protection obligations with Karikya.
• Identity verification services: Where required for age or identity verification, Karikya may share data with licensed third-party verification providers. These providers are contractually prohibited from using your data for any purpose other than verification.
• Legal and regulatory authorities: Karikya will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required to do so by law or in response to a valid legal order. Karikya will notify you of such disclosure where legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of Karikya's business, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy terms that will apply.

All third parties with whom Karikya shares data are required to maintain appropriate technical and organisational security measures and to process your data only for the specific purpose for which it was shared.

6. Payment Data Security

Karikya takes the security of your financial data particularly seriously. The following measures are in place specifically for payment data:

• Your bKash and Nagad login credentials (PIN, password) are never entered on the Karikya platform and are never stored on Karikya's servers. All mobile banking authentication happens directly within the bKash and Nagad apps or APIs.
• Karikya stores only masked payment account numbers (for example, the last four digits of your bKash number) for the purpose of matching deposits and withdrawals to your account.
• All financial transaction data is stored in encrypted form on servers with restricted access. Access to financial records is limited to authorised Karikya compliance and finance personnel only.
• Transaction reference numbers are retained for a minimum of five years to comply with financial record-keeping requirements.

7. Cookies and Tracking

Karikya uses cookies and similar technologies on its platform. A cookie is a small text file stored on your device that helps the platform remember information about your visit. Karikya uses the following types of cookies:

• Essential cookies: Required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled without breaking core platform functionality.
• Preference cookies: Remember your settings such as language preference and display options. These are set only after you have logged in.
• Analytics cookies: Collect anonymised data about how players use the platform — which pages are visited most, where players encounter errors, and how long sessions last. This data is used in aggregate form only and cannot be used to identify individual players.

Karikya does not use advertising cookies, retargeting pixels, or any third-party tracking technology designed to follow you across other websites. You can manage cookie preferences through your browser settings. Disabling essential cookies will affect your ability to use the Karikya platform.

8. Data Retention

Karikya retains your personal data for as long as your account is active and for a period after account closure as required by law and legitimate business need. The following retention periods apply:

When data is no longer required, Karikya deletes or anonymises it securely. Data that has been anonymised — meaning it can no longer be linked to any individual — may be retained indefinitely for statistical and analytical purposes.

9. Your Rights

As a Karikya player, you have the following rights in relation to your personal data. To exercise any of these rights, contact [email protected] with the subject line "Data Rights Request".

10. Children's Privacy

The Karikya platform is strictly for adults aged 18 and over. Karikya does not knowingly collect personal data from anyone under the age of 18. If you believe that a minor has registered an account on the Karikya platform, please contact [email protected] immediately. Karikya will investigate and, if confirmed, close the account and delete all associated personal data without delay.

Karikya uses age verification checks during the registration process and reserves the right to request identity documents to confirm age at any point. Accounts where age verification cannot be completed will be suspended until verification is provided.

11. Security Measures

Karikya implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL/TLS encryption for all data in transit between your device and Karikya's servers.
• AES-256 encryption for sensitive data stored in Karikya's databases.
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent required for their specific role.
• 24/7 automated security monitoring with alerts for unusual access patterns or potential intrusion attempts.
• Regular third-party security audits and penetration testing of the Karikya platform.
• Two-factor authentication available for all player accounts and mandatory for all Karikya staff accounts with access to player data.
• Secure data disposal procedures ensuring that deleted data cannot be recovered.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that affects your personal information, Karikya will notify you within 72 hours of becoming aware of the incident, providing details of what data was affected and what steps you should take to protect yourself.

12. Policy Updates

Karikya may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. When material changes are made, we will notify registered players via the platform's notification system and update the "Last updated" date at the top of this page.

Your continued use of the Karikya platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you may request account closure by contacting [email protected]. Any balance in your account will be processed for withdrawal subject to standard verification requirements.

We recommend reviewing this Privacy Policy periodically. Previous versions of the policy are available on request by contacting [email protected].

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way Karikya handles your personal data, please get in touch:

• Email: [email protected] (subject line: "Privacy Policy Enquiry" or "Data Rights Request")
• Live chat: Available 24/7 through your Karikya account dashboard

Karikya aims to respond to all privacy-related enquiries within 72 hours. For data rights requests, we will acknowledge receipt immediately and provide a full response within 72 hours of verifying your identity. If you are not satisfied with Karikya's response to a privacy concern, you have the right to escalate the matter to the relevant data protection authority in your jurisdiction.

You can also review our related policies for a complete picture of how Karikya operates: Terms and Conditions and Responsible Gaming.