kiriya Casino – Privacy Policy

1. Introduction

kiriya is committed to protecting the privacy and personal data of every Filipino player who uses our platform. This Policy is drafted in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). It is also consistent with the regulatory requirements of the Philippine Amusement and Gaming Corporation (PAGCOR) as they relate to player data and identity verification.

By registering an account, logging in, or otherwise accessing the kiriya Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please do not use the kiriya Platform.

This Policy should be read together with kiriya's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Data Controller

For the purposes of the Data Privacy Act of 2012 and this Policy, kiriya acts as the Personal Information Controller (PIC) with respect to the personal data collected through the Platform. kiriya determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

3. Personal Data We Collect

kiriya collects personal data that is necessary, adequate, and not excessive in relation to the purposes for which it is collected. The categories of personal data we collect include:

3.1 Identity & Registration Data

• Full legal name as it appears on a valid government-issued ID;
• Date of birth (for age verification — players must be 21 years or older);
• Gender;
• Nationality and country of residence;
• Government-issued identification number (e.g., PhilSys ID, passport, driver's license, SSS/GSIS number).

3.2 Contact Data

• Email address;
• Philippine mobile number;
• Residential address (barangay, city/municipality, province, ZIP code).

3.3 Financial Data

• Payment method details (GCash account number, PayMaya/Maya account, bank account details, debit card details);
• Transaction history including deposits, withdrawals, and bonus activity;
• Source of funds documentation where required for AML compliance.

3.4 Gaming & Behavioral Data

• Game history, bet amounts, win/loss records, and session durations;
• Responsible gaming tool usage (deposit limits, self-exclusion requests, cooling-off periods);
• Bonus and promotion activity.

3.5 Technical & Device Data

• IP address and geolocation data;
• Device type, operating system, and browser information;
• Cookie identifiers and session tokens;
• Referring URLs and navigation patterns within the Platform.

3.6 Communications Data

• Records of your communications with kiriya's customer support team, including chat logs and email correspondence;
• Survey responses and feedback submitted through the Platform.

4. How We Collect Your Data

kiriya collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or participate in promotions;
• Automatically — through cookies, web beacons, log files, and similar tracking technologies when you access and navigate the Platform;
• From third parties — including identity verification service providers, payment processors (GCash, PayMaya, banks), fraud detection services, and PAGCOR where required by regulation;
• From publicly available sources — such as government databases, credit reference agencies, and sanctions screening lists, where necessary for AML and KYC compliance.

5. Purposes of Processing

kiriya processes your personal data for the following specific, legitimate purposes:

kiriya will not process your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise permitted by law.

6. Legal Basis for Processing

Under the Data Privacy Act of 2012, kiriya processes your personal data on the following legal bases:

• Consent — where you have given clear, informed, and freely given consent, such as for marketing communications;
• Contractual Necessity — where processing is necessary to perform our obligations under the Terms & Conditions you have accepted, including account management and payment processing;
• Legal Obligation — where processing is required to comply with applicable Philippine laws, PAGCOR regulations, AML obligations, and NPC directives;
• Legitimate Interests — where processing is necessary for kiriya's legitimate business interests, such as fraud prevention, platform security, and responsible gaming monitoring, provided these interests are not overridden by your rights and freedoms.

Where kiriya relies on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7. Sharing Your Personal Data

kiriya does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• PAGCOR and Regulatory Authorities — as required by our operating license and applicable Philippine gaming regulations;
• Law Enforcement and Government Agencies — where required by law, court order, or to prevent, detect, or investigate criminal activity including money laundering;
• Payment Service Providers — GCash, PayMaya/Maya, BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank, and other Philippine payment processors, solely for the purpose of processing your transactions;
• Identity Verification Providers — third-party KYC and AML screening services engaged by kiriya to verify player identities and screen against sanctions lists;
• Technology and Hosting Providers — cloud infrastructure, platform software, and cybersecurity service providers engaged by kiriya under strict data processing agreements;
• Game Content Providers — game studios and software providers whose games are available on the kiriya Platform, to the extent necessary for game operation and fairness auditing;
• Professional Advisors — lawyers, auditors, and accountants engaged by kiriya, subject to professional confidentiality obligations.

All third parties with whom kiriya shares personal data are required to process that data only for the specified purpose, in accordance with kiriya's instructions, and subject to appropriate technical and organizational security measures.

8. Data Retention

kiriya retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, kiriya will securely delete or anonymize your personal data in accordance with NPC guidelines and industry best practices.

9. Security Measures

Our security measures include, but are not limited to:

• Encryption — all data transmitted between your device and the kiriya Platform is encrypted using TLS (Transport Layer Security) protocols;
• Access Controls — strict role-based access controls ensure that only authorized kiriya personnel can access personal data, on a need-to-know basis;
• Data Minimization — kiriya collects only the personal data that is strictly necessary for the stated purposes;
• Regular Security Audits — kiriya conducts periodic security assessments and penetration testing of its platform infrastructure;
• Incident Response — kiriya maintains a documented data breach response procedure and will notify affected data subjects and the NPC in accordance with the Data Privacy Act's breach notification requirements;
• Staff Training — all kiriya personnel who handle personal data receive regular data privacy and security training.

While kiriya takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your kiriya account credentials and for notifying us immediately if you suspect any unauthorized access to your account.

10. Cookies & Tracking Technologies

kiriya uses cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage patterns, and support security functions. The types of cookies we use include:

• Strictly Necessary Cookies — essential for the Platform to function correctly, including session management and security tokens. These cannot be disabled;
• Functional Cookies — remember your preferences such as language settings and responsible gaming limits;
• Analytics Cookies — help kiriya understand how players use the Platform so we can improve performance and game offerings. Data collected is aggregated and anonymized where possible;
• Security Cookies — used for fraud detection, bot prevention, and account protection purposes.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the kiriya Platform. kiriya does not use cookies to serve third-party advertising or to track your activity on other websites.

11. Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by kiriya. You may exercise any of these rights by contacting kiriya's Data Protection Officer at [email protected].

kiriya will respond to all data subject requests within thirty (30) calendar days of receipt. If your request is complex or numerous, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reasons for it. If you are not satisfied with kiriya's response, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

12. Minors & Age Restriction

If you are a parent or guardian and believe that your child under the age of 21 has provided personal data to kiriya, please contact us immediately at [email protected] so that we can take appropriate action.

13. Cross-Border Data Transfers

kiriya primarily processes and stores personal data within the Republic of the Philippines. In certain circumstances, personal data may be transferred to or processed by service providers located outside the Philippines — for example, cloud infrastructure providers or game software vendors operating internationally.

Where such transfers occur, kiriya ensures that appropriate safeguards are in place in accordance with the Data Privacy Act of 2012 and NPC guidelines, including:

• Contractual clauses requiring the recipient to apply data protection standards equivalent to those required under Philippine law;
• Transfers only to countries or organizations that provide an adequate level of data protection as recognized by the NPC;
• Your explicit consent where required by applicable law.

14. Changes to This Privacy Policy

kiriya reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, kiriya will notify registered players via email or through a prominent notice on the Platform at least seven (7) days before the changes take effect, where practicable.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. Your continued use of the kiriya Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically.

15. Contact Us & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or kiriya's data processing practices, please contact our Data Protection Officer (DPO):

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated.