Privacy Policy

Arena Kingdom Privacy Policy

IMPLEMENTATION DEPENDENCY: This policy must be reconciled against the final data map, vendors, hosting locations, analytics tools, identity-verification provider, payment processors and retention schedule before publication.

1. Scope and controller

Nkiza Ltd is the controller of personal data processed for Arena Kingdom's own purposes. This Policy is issued under, and is intended to comply with, Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, which designates the National Cyber Security Authority (NCSA) as the supervisory authority in Rwanda. This Policy applies to visitors, users, creators, guests, buyers, sellers and applicants. Separate notices may apply to employees or contractors.

2. Data collected

• Account data: name, username, date of birth or age status, country, email, telephone number, password hash, profile and preferences.
• Identity and compliance data: government identity information, selfie or liveness results, tax details, seller/business records, sanctions and fraud results.
• Content and communications: livestreams, recordings where disclosed, videos, images, audio, comments, messages, reports, appeals and customer support.
• Transaction data: purchases, coins, gifts, refunds, chargebacks, creator attribution, payout accounts, invoices, taxes and seller transactions. Full card data should be handled by authorised payment providers, not stored by Arena Kingdom unless expressly disclosed.
• Technical data: IP address, device identifiers, browser, operating system, app version, logs, crash data, cookies, approximate location and security events.
• Activity and inference data: follows, views, watch time, searches, interactions, rankings, interests, recommendations, moderation and fraud signals.
• Third-party data: login-provider data, payment confirmations, app-store data, referrals, public sources and reports from other users.

3. Purposes and legal bases

We process data to provide accounts and streams; perform purchases and payouts; personalise discovery; operate competitions and rankings; verify identity and age; prevent fraud; moderate content; protect safety; provide support; comply with law; establish or defend claims; improve the Services; measure performance; and send permitted communications.

Depending on jurisdiction, processing relies on performance of contract, compliance with legal obligations, legitimate interests, consent, protection of vital interests or another lawful basis. Consent is used only where appropriate and may be withdrawn without affecting prior lawful processing.

Purpose	Typical data	Primary basis
Provide accounts and features	Account, content, device and activity data	Contract
Purchases and creator payouts	Transaction, identity, tax and fraud data	Contract; legal obligation
Safety and fraud prevention	Content, reports, identifiers, logs and transactions	Legitimate interests; legal obligation
Recommendations and analytics	Activity, device and inferred interests	Legitimate interests or consent where required
Marketing	Contact and preference data	Consent or legitimate interests where permitted
Legal claims and requests	Relevant account, content, identity and logs	Legal obligation; legitimate interests

4. Automated systems

We may use automated systems to recommend content, rank streams, detect fraud, identify prohibited content, estimate age risk and prioritise reports. Significant adverse actions should receive human review where required by law. Users may challenge qualifying decisions through the appeal process.

5. Sharing

• Other users and the public, according to the feature and privacy settings.
• Hosting, livestream, security, analytics, communications, identity-verification, moderation, payment and support providers under appropriate contracts.
• Creators, sellers, delivery providers and transaction counterparties to complete requested interactions.
• Professional advisers, auditors, insurers and financing parties subject to confidentiality.
• Authorities or affected parties where legally required or reasonably necessary to address danger, fraud, rights violations or legal claims.
• A buyer, successor or affiliate in a corporate transaction, subject to lawful safeguards.

6. International transfers

Data may be processed outside the user's country. Arena Kingdom will use legally required safeguards for transfers, including contractual clauses, adequacy mechanisms, approvals or other lawful measures. Launch must not occur in a territory until required transfer arrangements are implemented.

7. Retention

We retain data only as long as reasonably necessary for stated purposes, including account operation, tax and payment records, fraud prevention, safety evidence, disputes, legal obligations and backups. Retention depends on data sensitivity, legal periods, risk and technical cycles.

Indicative schedule: active account data for account duration; transaction/tax records for the legally required period; routine security logs for 90 days; unresolved safety or fraud evidence until the matter and applicable limitation periods end; deleted content through backup cycles of up to 90 days, unless longer retention is lawful and necessary. Final periods require counsel and technical confirmation.

8. Security

We use risk-appropriate administrative, technical and organisational measures, including access control, encryption where appropriate, logging, vendor controls, backups and incident response. No system is completely secure. Users must protect credentials and report compromise immediately.

We will assess and notify qualifying personal-data breaches to authorities and affected people within legally required periods.

9. User rights

Depending on applicable law, users may request access, correction, deletion, restriction, objection, portability, withdrawal of consent and review of certain automated decisions. Requests may require identity verification and may be limited by lawful exceptions, the rights of others, fraud prevention and recordkeeping duties.

Submit requests to contact@nkiza.com. Users may complain to the National Cyber Security Authority (NCSA), Rwanda's supervisory authority under Law N° 058/2021, or another authority with jurisdiction.

10. Children

Arena Kingdom accounts are not intended for persons under 18. If we reasonably believe an account belongs to a minor, we may restrict it, request verification and delete or preserve data as law and safety require. Parents or guardians may report suspected minor accounts to contact@nkiza.com.

11. Public content and recordings

Public livestreams and profiles may be viewed, captured or redistributed by others despite contractual restrictions. Private Live Sessions are subject to Part XII. Arena Kingdom does not promise absolute confidentiality. We may retain limited recordings or excerpts where disclosed and necessary for moderation, fraud, safety, quality or legal defence. See the Terms of Service, Part X §10 for how trust-and-safety personnel may observe a public livestream in real time as part of moderation and safety review.

12. Contact and changes

Controller: Nkiza Ltd, Rwanda. Privacy contact/DPO: contact@nkiza.com. Material changes will be notified as required. The effective version and archived versions should remain accessible.