Privacy Policy — How mb33 Protects Your Data

1 Information We Collect

When you register and use the mb33 platform, we collect several categories of personal data. We only collect information that is necessary for the purposes described in this Privacy Policy. The categories of data we collect are as follows:

1.1 Registration & Identity Data

When you create an mb33 account, we collect your full legal name, date of birth, residential address, email address, and mobile phone number. This information is required to verify your identity, confirm your eligibility to use the platform, and maintain your account.

1.2 KYC Verification Documents

As part of our mandatory Know Your Customer (KYC) process, we may collect copies of government-issued photo identification (such as a National ID card or passport), proof of residential address (such as a utility bill or bank statement dated within 90 days), and confirmation of your payment method ownership. These documents are used solely for identity verification and fraud prevention purposes.

1.3 Financial & Transaction Data

We record details of all financial transactions conducted through your mb33 account, including deposit amounts, withdrawal requests, payment method identifiers (such as your registered bKash or Nagad mobile number), transaction timestamps, and account balances. We do not store full bank account numbers or complete card numbers on our servers.

1.4 Gaming Activity Data

We collect records of your gaming activity on the mb33 platform, including the games you play, bet amounts, game outcomes, session durations, and wagering history. This data is used for account management, bonus eligibility, responsible gaming monitoring, and dispute resolution.

1.5 Technical & Device Data

We automatically collect certain technical information when you access mb33, including your IP address, device type, operating system, browser type and version, screen resolution, language settings, time zone (Bangladesh Standard Time, BST UTC+6), and pages visited within the platform. This data helps us maintain platform security and optimise the user experience.

1.6 Communication Data

If you contact the mb33 support team via email or live chat, we retain records of that correspondence. This includes the content of your messages, timestamps, and any attachments you submit. These records are kept to track support request history and ensure consistent service quality.

2 How We Use Your Data

mb33 uses the personal data we collect for the following specific purposes. We do not use your data for any purpose that is incompatible with those described here without first notifying you and, where required, obtaining your consent.

• Account Management: Creating, maintaining, and operating your mb33 player account, processing deposits and withdrawals, applying bonuses, and managing your account preferences and communication settings.
• Identity Verification & KYC Compliance: Verifying your age, identity, and residential address as required under our responsible gaming obligations and anti-money laundering procedures.
• Payment Processing: Facilitating deposit and withdrawal transactions through your chosen payment method (bKash, Nagad, Rocket, Dutch-Bangla Bank, City Bank, BRAC Bank, or other supported providers).
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in the mb33 Terms & Conditions.
• Responsible Gaming: Monitoring gaming behaviour to identify potential problem gambling patterns and, where appropriate, triggering responsible gaming interventions such as account alerts, cool-off suggestions, or self-exclusion notices.
• Customer Support: Responding to your queries, complaints, and support requests, and maintaining a record of your support history for continuity of service.
• Legal & Regulatory Compliance: Meeting our obligations under applicable data protection, anti-money laundering, and financial compliance requirements.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience. This analysis does not identify individual players.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform news where you have given explicit consent to receive marketing communications. You may withdraw this consent at any time by contacting [email protected].

3 Legal Basis for Processing

mb33 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing your registration data, KYC information, and transaction records is necessary to perform the contract between you and mb33 — namely, operating your player account and providing access to the platform.
• Legal Obligation: Certain processing activities, including age verification, identity verification, and transaction monitoring, are required by applicable anti-money laundering and responsible gaming standards.
• Legitimate Interests: We process technical and device data, fraud signals, and gaming behaviour data on the basis of our legitimate interests in maintaining a secure, fair, and sustainable platform. We have assessed that these interests are not overridden by your fundamental rights and freedoms.
• Consent: Where we send marketing communications or use non-essential cookies, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without detriment to your account.

4 Data Sharing & Third Parties

mb33 does not share your personal data with third parties except in the specific circumstances described below. In all cases where data is shared, we require recipients to maintain appropriate technical and organisational security measures and to use the data only for the stated purpose.

4.1 Game Studio Providers

To deliver live casino games, slots, and sports betting markets, mb33 works with certified third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi, among others. These studios receive only the minimum data necessary to operate game sessions and process game-level transactions. They do not receive your full identity documents.

4.2 Payment Service Providers

To process deposits and withdrawals, mb33 shares transaction-specific data with payment partners including bKash, Nagad, Rocket (Dutch-Bangla Bank), Upay, and participating banks. This data exchange is limited to what is technically required to complete the transaction and is governed by each provider's own data protection standards.

4.3 Identity Verification Services

mb33 may use trusted third-party KYC and identity verification service providers to assist with document authentication and sanctions screening. These providers process your identity documents under strict contractual confidentiality obligations and in accordance with applicable data protection standards.

4.4 Legal and Regulatory Disclosure

mb33 may disclose personal data to law enforcement agencies, regulatory authorities, or other competent bodies where we are legally required to do so, or where disclosure is necessary to prevent or investigate fraud, money laundering, or other criminal activity. We will notify you of any such disclosure where legally permitted to do so.

4.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of mb33's business assets, player data may be transferred to the acquiring entity as part of that transaction. In such circumstances, mb33 will take reasonable steps to ensure that your data continues to be handled in accordance with this Privacy Policy, and you will be notified of any material change in data controller.

5 Cookies & Tracking Technologies

mb33 uses cookies and similar tracking technologies to operate and improve the platform. A cookie is a small text file placed on your device when you visit mb33.app. The following categories of cookies are used:

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies will prevent you from logging in or using core platform features. mb33 does not use third-party advertising cookies or cross-site tracking pixels.

6 Data Retention

mb33 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The general retention periods we apply are as follows:

• Active Account Data: Retained for the full duration of the player account plus a minimum of 5 years following account closure, to satisfy anti-money laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of 5 years from the date of account closure or the date of the last transaction, whichever is later.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction in accordance with financial compliance obligations.
• Support Correspondence: Retained for 3 years from the date of the most recent interaction, unless the correspondence relates to a formal complaint or dispute, in which case it is retained for 5 years.
• Marketing Consent Records: Retained for the duration of your consent plus 3 years to demonstrate compliance with applicable requirements.
• Technical & Device Logs: Retained for up to 12 months from the date of collection, after which they are anonymised or deleted.

When personal data is no longer required, mb33 securely deletes or anonymises it using industry-standard data destruction procedures. Anonymised data that cannot be linked back to any individual may be retained indefinitely for statistical and analytical purposes.

7 Your Privacy Rights

As a player on the mb33 platform, you have the following rights with respect to your personal data. To exercise any of these rights, please submit a written request to [email protected]. We will acknowledge your request within 5 business days and aim to fulfil it within 30 calendar days.

• Right of Access: You may request a copy of the personal data mb33 holds about you, along with information about how it is being used and shared.
• Right to Rectification: If any of the personal data we hold about you is inaccurate or incomplete, you may request that we correct or update it.
• Right to Erasure: You may request that mb33 delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations. Note that we cannot erase data that we are legally required to retain (e.g., KYC records and transaction logs).
• Right to Restrict Processing: In certain circumstances, you may request that mb33 limit the processing of your personal data — for example, while a dispute about its accuracy is being resolved.
• Right to Data Portability: You may request a structured, machine-readable copy of the personal data you have provided to mb33 directly, for transfer to another service provider.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as our legal basis, and to the use of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where we process your data on the basis of your consent (e.g., marketing communications), you may withdraw that consent at any time by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

8 Data Security Measures

mb33 takes the security of your personal data seriously and maintains a comprehensive set of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the mb33 platform is encrypted using industry-standard TLS protocols. You can verify this by checking for the padlock icon and "https" in your browser address bar when visiting mb33.app.
• Encrypted Data Storage: Sensitive personal data, including KYC documents and financial records, is stored in encrypted form on secure servers with strict access controls limiting which staff members can view this data.
• Access Control: Access to player personal data is restricted to mb33 staff who have a genuine operational need to access it. All staff with data access are subject to confidentiality agreements and receive regular data security training.
• Fraud Detection Systems: mb33 employs automated fraud detection and anomaly monitoring systems that analyse platform activity in real time to detect and block suspicious behaviour, including unauthorised account access attempts.
• Regular Security Audits: The mb33 platform and data infrastructure are subject to periodic security reviews and vulnerability assessments to identify and remediate potential weaknesses before they can be exploited.
• Incident Response: In the event of a data security incident that affects your personal data, mb33 will notify affected players and take immediate remediation action. Notifications will be sent to your registered email address.

9 Children's Privacy

The mb33 platform is strictly intended for adults aged 18 and over. mb33 does not knowingly collect personal data from individuals under the age of 18. Our registration process includes mandatory age declaration and date-of-birth verification, and we conduct KYC checks to confirm player age before processing any withdrawal.

If mb33 discovers or is notified that personal data has been collected from a minor, we will immediately suspend the relevant account, delete all associated personal data, and where applicable reverse any transactions associated with that account. If you believe that a minor may have created an mb33 account, please notify us immediately at [email protected].

We strongly encourage parents and guardians in Bangladesh to use parental control software to prevent minors from accessing online gambling platforms. Resources for parental controls and underage gambling prevention are available via the mb33 Responsible Gaming page.

10 Updates to This Policy

mb33 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, updates to applicable legal requirements, or improvements to our platform. The "Effective Date" displayed at the top of this document reflects the date on which the current version came into force.

Where changes to this Privacy Policy are material — meaning they significantly alter the way in which we collect, use, or share your personal data — mb33 will notify registered players via the email address on file at least 14 days before the changes take effect. For minor or administrative updates, such as correcting typographical errors or clarifying existing language, changes may take effect immediately upon publication.

We encourage you to review this Privacy Policy periodically, particularly before providing new categories of personal data or enabling new platform features. Continued use of the mb33 platform following the effective date of any update constitutes your acknowledgment of the revised Privacy Policy.

11 Contact & Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by mb33, please contact us using the details below. All privacy-related enquiries are handled by the mb33 data team and are treated with strict confidentiality.

• Email: [email protected] — use subject line "Privacy Enquiry" for fastest routing
• Response Time: Acknowledgement within 24 hours; full response within 30 calendar days
• Operating Hours: 24 hours a day, 7 days a week — Bangladesh Standard Time (BST, UTC+6)

For formal rights requests (access, erasure, portability, objection), please include your full name, your mb33 registered email address, and a clear description of your request. We may need to verify your identity before processing the request to ensure we do not disclose data to an unauthorised party.