karika Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") describes how karika ("karika", "we", "us", "our") collects, uses, stores, shares, and protects the personal data of individuals ("you", "Player", "User") who access or use the karika website at https://karika.vu and all associated services, products, and features (collectively, the "Platform").

This Policy applies to all personal data processed in connection with your use of the karika Platform, including data collected during account registration, identity verification, deposits and withdrawals, game play activity, customer support interactions, and marketing communications. It applies regardless of whether you access the Platform via a desktop browser, mobile browser, or any other compatible device.

This Policy should be read alongside karika's Terms & Conditions and Responsible Gaming Policy, all of which together constitute the full agreement governing your relationship with karika.

2 Data Controller

For the purposes of applicable data protection law, karika is the data controller in respect of all personal data collected and processed through the Platform. As data controller, karika determines the purposes and means by which your personal data is processed.

karika is committed to processing personal data in a manner that is lawful, fair, and transparent. If you have any questions about how your data is handled, or wish to exercise any of your data rights as described in Section 11 of this Policy, you may contact karika's data protection contact point at the email address provided in Section 15.

3 Data We Collect

karika collects several categories of personal data from and about its players. The specific data collected depends on the nature of your interaction with the Platform. The main categories are as follows:

4 How We Collect Data

karika collects personal data through the following means:

• Direct collection: Data you provide directly when creating an account, completing the KYC process, making a deposit or withdrawal, contacting customer support, or responding to a promotion.
• Automated collection: Technical and usage data collected automatically when you access the Platform, via cookies, web beacons, server logs, and similar tracking technologies (see Section 8 for further detail on cookies).
• Third-party sources: Identity and fraud-risk data received from KYC verification partners and payment processors in the course of processing your registration and transactions. karika only receives data from third parties that are themselves bound by appropriate data protection obligations.
• Publicly available sources: In limited circumstances related to fraud prevention and AML compliance, karika may cross-reference data against publicly available databases or sanctions lists.

5 Legal Bases for Processing

karika processes personal data on the basis of one or more of the following legal grounds, depending on the specific processing activity:

• Contractual necessity: Processing is necessary for karika to perform its obligations under the agreement with you — for example, to create and manage your account, process deposits and withdrawals, and deliver game services.
• Legal obligation: Processing is required to comply with applicable legal and regulatory obligations — for example, conducting KYC identity verification, maintaining financial transaction records for AML compliance purposes, and responding to lawful requests from competent authorities.
• Legitimate interests: Processing is necessary for karika's legitimate business interests, provided those interests are not overridden by your rights and freedoms — for example, fraud detection, platform security, improving service quality, and analytics to understand Platform usage patterns.
• Consent: Where karika relies on your consent as a legal basis — for example, for sending direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. Withdrawal of consent may be made by contacting [email protected] or by using the opt-out mechanism in any marketing communication.

6 How We Use Your Data

karika uses the personal data it collects for the following primary purposes:

• To create, verify, and manage your karika player account, including processing your registration application and maintaining your account profile.
• To conduct identity verification (KYC) in accordance with anti-money-laundering best practices and to prevent fraud, money laundering, and other financial crimes.
• To process your deposits, withdrawals, and other financial transactions via bKash, Nagad, Rocket, Upay, bank transfer, Visa, and Mastercard, as applicable.
• To provide you with access to casino games, live dealer games, crash games, slots, and sports betting markets including BPL cricket, T20 fixtures, and football events.
• To provide customer support and to handle any complaints, queries, or disputes you may raise.
• To send you promotional communications about bonuses, seasonal offers (Eid, Pohela Boishakh, Victory Day), and new game launches — where you have consented to receive such communications or where we have a legitimate interest in doing so.
• To monitor Platform activity for signs of fraud, suspicious betting patterns, bonus abuse, multi-accounting, or other prohibited conduct under karika's Terms & Conditions.
• To analyse usage patterns and player behaviour for the purpose of improving the Platform, personalising the gaming experience, and developing new features.
• To comply with applicable legal and regulatory obligations, including responding to lawful requests from competent authorities.
• To enforce karika's Terms & Conditions, including taking action against accounts found to be in breach.

7 Data Sharing & Third Parties

karika does not sell, rent, or trade your personal data. Data is shared with third parties only in the following circumstances and only to the extent strictly necessary for the relevant purpose:

• Payment processors: karika shares necessary financial and identity data with payment service providers including bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, BRAC Bank, and card network operators Visa and Mastercard, solely for the purpose of processing your transactions.
• KYC and identity verification partners: karika uses specialist third-party services to assist with identity document verification and fraud screening as part of the KYC process.
• Game providers: Game session data is shared with game providers — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi — to the extent necessary for the delivery and auditing of their games on the karika Platform.
• IT and platform infrastructure providers: karika uses third-party cloud hosting, database, and security services. These providers process data on karika's behalf under strict data processing agreements and are not permitted to use the data for their own purposes.
• Legal and regulatory authorities: karika may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other competent authorities where required by law or where karika believes disclosure is necessary to protect its legal rights or to prevent criminal activity.
• Business transfers: In the event of a merger, acquisition, or sale of all or a substantial part of karika's business, personal data held by karika may be transferred to the acquiring entity as part of that transaction. karika will notify registered players of any such transfer via their registered email address.

All third parties with whom karika shares personal data are required to maintain appropriate technical and organisational security measures and to process data only in accordance with karika's instructions and applicable data protection law.

8 Cookies & Tracking Technologies

karika uses cookies and similar tracking technologies (including web beacons and local storage objects) on the Platform to deliver core functionality, improve performance, and understand how players interact with the site. The main categories of cookies used by karika are as follows:

• Strictly necessary cookies: These cookies are essential for the Platform to function and cannot be switched off. They are set in response to actions you take — such as logging in, setting your session preferences, or maintaining your cart during a deposit flow. Without these cookies, the Platform cannot operate correctly.
• Performance and analytics cookies: These cookies collect aggregated, anonymised information about how visitors interact with the Platform — for example, which pages are visited most frequently and whether error messages are received. This data helps karika improve the Platform experience. No personally identifiable information is collected by these cookies.
• Functionality cookies: These cookies allow the Platform to remember choices you make — such as your preferred language or display settings — to provide a more personalised experience. They are set only where you have provided such preferences.
• Targeting and profiling cookies: Where you have consented to marketing, these cookies may be used to build a profile of your interests based on your browsing behaviour on the Platform, to enable karika to deliver more relevant promotional offers. You may withdraw consent for these cookies at any time.

You may manage your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies will affect Platform functionality. Disabling analytics or targeting cookies will not affect your ability to access the Platform or its core features.

9 Data Retention

karika retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account data (identity, contact, and KYC documents): Retained for the duration of the active account relationship and for a minimum of five years following account closure, in accordance with AML record-keeping requirements.
• Financial transaction records (deposits, withdrawals, bet history): Retained for a minimum of five years from the date of each transaction, consistent with applicable financial record-keeping obligations.
• Customer support communications: Retained for three years from the date of the last communication in a support thread, unless the matter relates to an unresolved dispute in which case records are retained until the dispute is finally resolved.
• Technical and usage data (IP logs, session data): Retained for up to 12 months, after which it is aggregated or anonymised for analytics purposes.
• Marketing preference records: Retained for the duration of the account relationship and for 12 months following account closure, to enable karika to demonstrate compliance with marketing consent obligations.

Where data is no longer required for any active purpose and its retention period has expired, karika will securely delete or irreversibly anonymise the data in accordance with its internal data lifecycle procedures.

10 Data Security

karika implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Encryption in transit: All data transmitted between your device and the karika Platform is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all Platform pages, cashier transactions, and API communications.
• Encryption at rest: Sensitive personal data and financial records stored on karika's servers are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data within karika's organisation is restricted on a strict need-to-know basis. Staff who handle personal data are subject to confidentiality obligations and receive regular data protection training.
• Intrusion detection and monitoring: karika's infrastructure is monitored 24/7 for signs of unauthorised access, unusual activity, or security threats. Automated alert systems escalate potential incidents to the security team for immediate review.
• Penetration testing: karika conducts regular vulnerability assessments and penetration testing of its Platform infrastructure to identify and remediate security weaknesses proactively.
• Incident response: karika maintains a documented data breach response procedure. In the event of a confirmed data breach that poses a risk to players' rights and freedoms, karika will notify affected players without undue delay.

While karika takes all reasonable steps to safeguard your personal data, no system connected to the internet can be guaranteed as completely secure. You are responsible for maintaining the security of your own account credentials. If you suspect your karika account has been accessed without your authorisation, please contact [email protected] immediately.

11 Your Data Rights

As a registered karika player, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact karika's data protection contact point as described in Section 15.

• Right of access: You may request confirmation of whether karika processes personal data about you, and if so, a copy of that data along with information about the purposes of processing, the categories of data involved, and any recipients.
• Right to rectification: You may request correction of any inaccurate personal data karika holds about you, or completion of any incomplete data, by contacting support with the relevant correction and supporting documentation.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw the consent on which processing is based, or where you object to processing on legitimate interests grounds and no overriding legitimate grounds exist. This right is subject to karika's legal obligations to retain certain records.
• Right to restriction of processing: You may request that karika restricts the processing of your personal data in certain circumstances — for example, while a rectification request is being assessed, or while an objection to legitimate-interests processing is being evaluated.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object at any time to processing of your personal data for direct marketing purposes. You may also object to processing based on legitimate interests, in which case karika will assess whether its legitimate interests override your rights and will respond accordingly.
• Rights related to automated decision-making: Where karika makes decisions affecting your account using solely automated means, you have the right to request human review of that decision, to express your point of view, and to contest the outcome.

karika will respond to all verified data rights requests within 30 calendar days. Where a request is complex or involves a large volume of data, this period may be extended by up to two further months, with notification to you of the extension and the reasons for it.

12 Marketing Communications

karika may send you promotional communications — including information about bonuses, new games, seasonal offers (such as Eid promotions, Pohela Boishakh specials, and BPL cricket season offers), and other platform news — via email or SMS, subject to the following:

• Marketing communications will be sent only where you have consented to receive them at the time of registration or subsequently updated your marketing preferences to opt in.
• You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any promotional email, by replying STOP to any promotional SMS, or by contacting karika support at [email protected] with a marketing opt-out request.
• Opting out of marketing communications will be processed within 5 business days. You may continue to receive transactional and service-related communications (such as account notifications, deposit confirmations, and KYC requests) even after opting out of marketing.
• karika does not share your contact details with third-party advertisers for the purpose of sending you their own marketing communications.

13 Children & Minors

The karika Platform is strictly intended for adults aged 18 years and above. karika does not knowingly collect, process, or retain personal data relating to individuals under the age of 18.

During the registration process, applicants are required to confirm that they are aged 18 or above. karika's KYC verification process includes age verification as a mandatory component. Where karika has reasonable grounds to suspect that a registered player is under the age of 18, the account will be suspended immediately pending age verification. Where it is confirmed that the player is under 18, the account will be permanently closed, any balance will be forfeited, and all personal data relating to the minor will be securely deleted (or retained only to the minimum extent required by law to evidence the age-verification failure).

If you are a parent or guardian and you believe that a minor in your care has created a karika account or provided personal data to karika, please contact us immediately at [email protected]. karika will investigate and take prompt action.

14 Changes to This Policy

karika reserves the right to update or amend this Privacy Policy at any time. Where material changes are made — that is, changes that meaningfully affect how your personal data is collected, used, or shared — karika will notify registered players by email to the address associated with their account and will display a prominent notice on the Platform prior to the change taking effect.

Non-material amendments (such as typographical corrections or minor clarifications that do not alter the substance of the Policy) may be made without specific notification, though the "Last Updated" date at the top of this Policy will always reflect when the most recent revision was made.

Where an amendment requires your consent (for example, where karika proposes to use your personal data for a new purpose that was not described in the version of the Policy in effect when the data was collected), karika will seek your explicit consent before commencing that new processing. You will not be required to accept changes as a condition of continued access to the Platform where those changes relate to new optional processing activities.

Your continued use of the karika Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the revised Policy. We encourage you to review this Policy periodically to stay informed about how karika protects your personal data.

15 Contact & Data Requests

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which karika processes your personal data, or if you wish to exercise any of the data rights described in Section 11, please contact karika's data protection team using the details below.

Email: [email protected]
Please use the subject line "Data Protection Request" or "Privacy Enquiry" so that your message is routed to the appropriate team member promptly.

karika aims to acknowledge all data-related enquiries within 5 business days (Bangladesh Standard Time, UTC+6) and to provide a full substantive response within 30 calendar days. For complex or multi-part requests, the response period may be extended by up to a further two months, with written notification to you of the extension and its reasons.

If you are not satisfied with karika's response to your data protection enquiry or data rights request, you have the right to escalate your complaint to an appropriate supervisory authority or to seek a judicial remedy in accordance with applicable law.