kraiya Privacy
Policy

This Privacy Policy ("Policy") applies to all users of the kraiya website at https://kraiya.net and any associated services operated by kraiya ("kraiya", "we", "us", "our"). It describes the categories of personal data we collect, the purposes for which that data is processed, the legal bases we rely on, how long we keep data, and the rights you can exercise regarding your own information.

By registering a kraiya account, making a deposit, placing a wager, or otherwise using the platform, you acknowledge that you have read and understood this Policy. If you do not agree with how kraiya processes personal data, you should discontinue use of the platform and contact us to request account closure.

1. Data We Collect

kraiya collects personal data from you directly when you register, interact with the platform, or contact support. We also collect certain data automatically as you browse and use the site. The categories of personal data we process are described below.

1.1 Registration & Identity Data

When you create a kraiya account, we collect:

• Full legal name
• Date of birth (used to verify the 18+ age requirement)
• Email address
• Mobile phone number
• Residential address (city, district, Bangladesh)
• Username and encrypted password

1.2 Identity Verification Data

To comply with our Know Your Customer (KYC) obligations and to protect players from fraud, kraiya may request copies of identity documents. These may include:

• National Identity Card (NID) — front and back
• Passport or driving licence
• Proof of address (utility bill, bank statement dated within 90 days)
• Selfie photograph for biometric matching

Submission of these documents is a condition of completing verification and of processing withdrawal requests above the stated threshold. Documents are stored in an encrypted environment and are never shared with third parties for marketing purposes.

1.3 Financial & Transaction Data

When you deposit or withdraw funds, kraiya records transaction information including the payment method used (bKash, Nagad, Rocket, Upay, Visa, Mastercard), transaction reference numbers, amounts in BDT, timestamps, and account identifiers. kraiya does not store full card numbers or mobile banking PINs — these are handled exclusively by the payment processor's own secure infrastructure.

1.4 Usage & Behavioural Data

As you use the kraiya platform, we automatically collect certain technical and behavioural data, including:

• IP address and approximate geolocation (city/district level)
• Device type, operating system, and browser version
• Pages visited, time spent on each page, and click-path data
• Games played, bet amounts, session duration, and wagering patterns
• Deposit and withdrawal frequency and amounts
• Login timestamps and session identifiers

This data is used to improve platform performance, detect unusual activity, personalise your experience, and support our responsible gaming monitoring obligations.

1.5 Communications Data

When you contact kraiya support via email or live chat, we retain records of those communications including the content of messages, timestamps, and any attachments. This allows us to track the history of your support interactions, resolve disputes fairly, and improve our service quality. Support communications are stored for a minimum of two years.

2. How We Use Your Data

kraiya processes your personal data for the following specific purposes. Where we rely on a legal basis other than your consent, we identify that basis alongside each purpose.

Where kraiya relies on consent as the legal basis for processing — most notably for marketing communications — you may withdraw that consent at any time by emailing [email protected] or by unsubscribing from any promotional email. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

3. Data Sharing & Disclosure

kraiya does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the specific circumstances described below.

3.1 Payment Processors

To facilitate deposits and withdrawals, kraiya shares necessary transaction details with our payment processing partners, which include the operators of bKash, Nagad, Rocket, Upay, and the card-processing networks for Visa and Mastercard. These partners receive only the minimum data required to complete the transaction and are bound by their own regulatory and data-security obligations.

3.2 Game & Platform Providers

kraiya integrates games from third-party providers including Pragmatic Play, Evolution Gaming, Spribe, NetEnt, Microgaming, and Ezugi. When you launch a game from one of these providers, your session identifier, account reference, and wager data are transmitted to that provider for game-engine purposes. These providers do not receive your full identity or payment data and are contractually prohibited from using session data for any purpose other than delivering the game.

3.3 Regulatory & Law Enforcement Disclosure

kraiya may disclose personal data to regulatory bodies, law enforcement agencies, or financial intelligence units where we are legally required to do so — for example, in connection with an anti-money-laundering investigation or a court order. Such disclosures are made strictly to the extent required by law and are not voluntary.

3.4 Business Transfers

In the event that kraiya undergoes a merger, acquisition, or sale of all or substantially all of its assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you via email and/or a prominent notice on the kraiya platform prior to your data being transferred and becoming subject to a different privacy policy.

3.5 Service Providers

We engage certain trusted third-party service providers to operate aspects of the platform on our behalf — including cloud hosting providers, email delivery services, and analytics platforms. These providers act strictly as data processors, are bound by data processing agreements, and may not use your data for their own purposes.

4. Cookies & Tracking

kraiya uses cookies and similar tracking technologies to deliver and improve the platform. A cookie is a small text file stored on your device by your browser. Cookies cannot execute code or deliver viruses; they are simply a record of your interactions with the site.

4.1 Types of Cookies We Use

• Essential cookies: Required for the platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing cookies. They cannot be disabled without breaking core platform functionality.
• Analytics cookies: Used to understand how players navigate the kraiya platform — which pages are visited most, where sessions end, and how long players spend on different sections. This data is aggregated and anonymised.
• Preference cookies: Store your platform preferences such as language selection, display settings, and last-visited game category to provide a more personalised experience on return visits.
• Responsible gaming cookies: Track session duration and display time-limit reminders where you have opted into session time alerts via your account settings.

4.2 Managing Cookies

You can control and delete cookies through your browser settings. Most browsers allow you to block third-party cookies, clear all cookies on exit, or display a warning before a cookie is stored. Note that disabling essential cookies will prevent you from logging in to your kraiya account. For full instructions on managing cookies in your specific browser, consult your browser's help documentation.

5. Data Retention

kraiya retains personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your account plus 5 years after permanent closure, in line with standard financial record-keeping obligations.
• Transaction records: Retained for 7 years from the date of each transaction for audit, tax, and anti-money-laundering compliance purposes.
• KYC / identity verification documents: Retained for 5 years from account closure or from the date of the last transaction, whichever is later.
• Support communications: Retained for 2 years from the date of the last message in each support thread.
• Usage and behavioural data: Retained in identifiable form for 24 months, after which it is anonymised and may be retained indefinitely for aggregate analytics.
• Marketing consent records: Retained until consent is withdrawn, plus 1 year as evidence of the consent record.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. You may request early deletion of your data in certain circumstances — see Section 6 (Your Rights) below.

6. Your Rights

As a kraiya player, you hold a number of rights in relation to the personal data we hold about you. kraiya is committed to honouring these rights in a timely manner. To exercise any of the rights listed below, please email [email protected] with the subject line "Data Rights Request" and include your registered email address and the specific right you wish to exercise.

6.1 Right of Access

You have the right to request a copy of all personal data kraiya holds about you. We will provide this in a structured, commonly used, machine-readable format (typically JSON or CSV) within 30 days of receiving your verified request.

6.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Minor corrections (such as updating a phone number or email address) can be made directly in your kraiya account settings. For changes to identity data, a fresh KYC document submission may be required.

6.3 Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where you object to processing based on legitimate interest. Note that kraiya is legally required to retain certain data (such as transaction records) for defined periods regardless of an erasure request — we will inform you of any such limitations at the time of your request.

6.4 Right to Restrict Processing

You may ask kraiya to pause processing of your personal data in specific circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed. During a restriction period, kraiya may continue to store the data but will not actively use it.

6.5 Right to Object

You have the right to object to processing of your personal data where kraiya relies on legitimate interest as the legal basis. You also have an absolute right to object to your data being used for direct marketing purposes at any time.

6.6 Right to Data Portability

Where processing is based on consent or contract performance and is carried out by automated means, you have the right to receive your personal data in a portable format and to request that it be transmitted directly to another data controller where technically feasible.

7. Data Security

kraiya employs a layered security architecture to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Our technical and organisational security measures include:

• 256-bit SSL/TLS encryption on all connections between your browser and the kraiya servers, ensuring all data in transit is protected.
• Encrypted data storage for all sensitive personal data and identity documents at rest, using AES-256 encryption.
• Password hashing using industry-standard bcrypt with a high work factor — kraiya never stores plain-text passwords.
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis.
• Regular security audits and penetration testing by independent third-party security firms.
• Intrusion detection systems and 24/7 monitoring to identify and respond to suspicious activity in real time.
• Strict vendor vetting — all third-party service providers with access to personal data are assessed against kraiya's security standards before engagement.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, kraiya will notify affected users without undue delay and will take all necessary remedial action.

You are responsible for maintaining the security of your own kraiya account. We strongly encourage you to use a unique, strong password and to enable any available account-security features. Never share your kraiya login credentials with any third party.

8. Policy Updates & Contact

kraiya may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or improvements to the platform. When material changes are made, we will notify you by email to your registered address and by displaying a prominent notice on the kraiya platform for at least 14 days before the updated Policy takes effect.

Your continued use of the kraiya platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the updated Policy, you should discontinue use of the platform and request account closure.

The current version of this Policy is always available at https://kraiya.net/privacy-policy. The version number and effective date displayed at the top of this page confirm which version you are reading.