mb33 Privacy Policy — How We Collect, Use, and Protect Your Data

1 About This Policy

This Privacy Policy ("Policy") describes how mb33 ("we", "us", "our") collects, processes, stores, and protects personal data provided by or obtained about users ("you", "your", "the Player") of the mb33 platform, accessible at https://mb33.io and all associated pages, subdomains, and services ("the Platform").

This Policy applies to all registered players, visitors, and any person who interacts with the mb33 Platform in any capacity. It supplements the mb33 Terms & Conditions, which govern the contractual relationship between you and mb33. Where there is any conflict between this Policy and the Terms & Conditions regarding data matters, this Policy prevails.

If you do not agree with any part of this Policy, you should discontinue use of the mb33 Platform and contact [email protected] to request closure of your account and deletion of your personal data where applicable.

2 Data Controller

mb33 acts as the data controller in respect of all personal data collected through the Platform. As data controller, mb33 determines the purposes and means by which your personal data is processed. All data-related enquiries, access requests, correction requests, and deletion requests should be directed to the mb33 Data Privacy team via the contact details provided in Section 15 of this Policy.

Where mb33 engages third-party service providers to process personal data on its behalf — for example, payment processors, identity verification services, and analytics providers — those parties act as data processors and operate strictly in accordance with written data processing agreements that require them to apply appropriate security measures and to process your data only on documented instructions from mb33.

3 Personal Data We Collect

mb33 collects the following categories of personal data from players in Bangladesh. The table below sets out each category, the specific data points within it, and the primary purpose for which that category is collected.

mb33 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data, or health data, unless required to do so by applicable law or with your explicit written consent.

4 How We Collect Your Data

mb33 collects personal data through several channels:

• Direct Collection: Data you provide when registering an account, completing identity verification, making a deposit or withdrawal, contacting customer support, or submitting a complaint.
• Automated Collection: Technical and usage data collected automatically as you navigate the Platform, via server logs, cookies, and similar tracking technologies. See Section 7 for full details on our use of cookies.
• Payment Processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and card payment gateways when you make a deposit or withdrawal. mb33 receives transaction references and status confirmations, not your full payment credentials.
• Identity Verification Services: Where required, mb33 may use third-party identity verification providers to cross-check the documents you submit during KYC (Know Your Customer) verification.
• Fraud Prevention Services: mb33 may receive risk signals from fraud detection systems that analyse patterns across multiple platforms to protect the integrity of the mb33 service.

5 How We Use Your Data

mb33 uses your personal data for the following purposes, each of which corresponds to a lawful legal basis described in Section 6:

• Account Management: Creating and maintaining your mb33 player account, verifying your identity, and ensuring you meet the 21+ age requirement.
• Service Delivery: Providing access to casino games, sports betting markets (including BPL, IPL, T20 World Cup, and cricket betting), and all other features of the mb33 Platform.
• Transaction Processing: Processing deposits and withdrawals in Bangladeshi Taka (BDT) via bKash, Nagad, Rocket, Upay, and supported bank cards, and maintaining accurate financial records.
• Legal and Regulatory Compliance: Fulfilling anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and responding to lawful requests from competent authorities.
• Fraud Prevention and Security: Detecting and investigating suspicious activity, protecting player accounts from unauthorised access, and maintaining the integrity of the Platform.
• Responsible Gaming: Monitoring gaming patterns to identify signs of problem gambling and to facilitate the responsible gaming tools available to every mb33 player, including deposit limits, cooling-off periods, and self-exclusion.
• Customer Support: Responding to enquiries, resolving complaints, and maintaining records of interactions for quality assurance and dispute resolution purposes.
• Service Improvement: Analysing aggregated usage data to improve Platform performance, game selection, and user experience.
• Communications: Sending you account-related notifications, security alerts, and — where you have given consent — promotional communications about mb33 offers and new games.

6 Legal Basis for Processing

mb33 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil the contract between you and mb33, including account creation, game access, and payment processing. Without this processing, mb33 cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML/KYC obligations and responses to lawful authority requests.
• Legitimate Interests: Processing carried out in mb33's legitimate business interests, such as fraud prevention, platform security, and service improvement, provided that such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, informed, and specific consent — principally for marketing communications and for non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Cookies and Tracking Technologies

mb33 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a web server when you visit a website. Cookies allow the Platform to recognise your device on subsequent visits and to maintain session state between page loads.

mb33 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in during your visit. These cookies cannot be disabled without breaking core Platform functionality.
• Performance Cookies: Collect anonymised data about how visitors use the Platform — pages visited, time spent, and error messages encountered — to help mb33 improve the site. No personally identifiable information is collected by these cookies.
• Functionality Cookies: Remember your preferences such as language setting, preferred payment method display, and last visited game category, so you do not need to re-enter these preferences on each visit.
• Analytics Cookies: Used by mb33's internal analytics systems to understand aggregate user behaviour and improve the Platform experience. Data processed by analytics cookies is retained in anonymised form.

mb33 does not use third-party advertising or retargeting cookies. No cookie data from mb33 is shared with external advertising networks.

8 Third-Party Data Sharing

mb33 does not sell your personal data. We share personal data with third parties only in the following circumstances, and only to the minimum extent necessary for the specific purpose:

• Payment Processors: bKash, Nagad, Rocket, Upay, and card payment gateway providers receive the transactional data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and are subject to applicable financial sector regulations in Bangladesh.
• Game Providers: Certified game suppliers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe may receive a session token and anonymised player identifier to initialise game sessions. Game providers do not receive your full name, contact details, or financial data.
• Identity Verification Partners: Where KYC verification is required, your identity documents may be shared with our contracted identity verification service provider. This provider processes documents solely for verification purposes and does not retain copies beyond the verification process.
• Fraud Prevention Services: Anonymised technical data (IP address, device fingerprint) may be shared with fraud prevention systems to detect and prevent abuse of the Platform.
• Legal Authorities: mb33 will disclose personal data to law enforcement, regulatory bodies, or other competent authorities when required to do so by applicable law, court order, or in response to a lawful formal request. mb33 will notify you of such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of the mb33 business, your personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections remaining in place.

9 International Data Transfers

The mb33 Platform is operated from servers located in jurisdictions that may differ from Bangladesh. When your personal data is transferred outside Bangladesh for processing — for example, to a game provider's servers or to a cloud-based infrastructure provider — mb33 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection principles.

Such safeguards may include contractual clauses requiring the recipient to apply appropriate technical and organisational security measures, restrictions on the further transfer of your data, and obligations to notify mb33 of any data breach affecting your information.

10 Data Retention

mb33 retains your personal data for as long as your account remains active and for a defined period thereafter, as set out below:

• Active Account: Personal data is retained for the full duration of your account's active status to allow you to access your history, request withdrawals, and receive support.
• Closed or Inactive Accounts: Following account closure or a continuous period of inactivity, mb33 retains your identity, financial, and gaming records for a period of five (5) years from the date of closure. This retention period supports our AML, KYC, and legal compliance obligations.
• Support Communications: Records of customer support interactions are retained for three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Technical and Usage Data: Anonymised technical and usage data may be retained indefinitely for analytical and platform improvement purposes, as it cannot be linked back to any individual player once anonymised.

On expiry of the applicable retention period, your personal data will be securely deleted or irreversibly anonymised. mb33 does not retain personal data beyond the period for which a clear and legitimate purpose exists.

11 Data Security

mb33 applies a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• SSL/TLS encryption for all data transmitted between your device and the mb33 Platform.
• Encryption at rest for sensitive personal and financial data stored on mb33 servers.
• Strict access controls limiting employee access to personal data on a need-to-know basis, with access activity logged and audited.
• Regular security assessments and vulnerability testing of the Platform infrastructure.
• Multi-factor authentication mechanisms for internal systems that handle personal data.
• Incident response procedures that include notification protocols in the event of a data breach affecting player data.

No security system is impenetrable. In the unlikely event of a data breach that poses a risk to your rights, mb33 will notify affected players and relevant authorities in a timely manner in accordance with its legal obligations.

12 Your Rights

As a player in Bangladesh whose personal data is processed by mb33, you hold the following rights in relation to your data. To exercise any of these rights, contact the mb33 Data Privacy team at [email protected] with the subject line "Data Privacy Request". mb33 will respond to all valid requests within 30 days of receipt.

• Right of Access: You may request a copy of the personal data mb33 holds about you, along with information about how it is used and with whom it is shared.
• Right to Rectification: You may request that inaccurate or incomplete personal data be corrected or updated. For minor corrections (e.g., mobile number or email), you may update these directly in your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. Note that mb33's legal retention obligations (see Section 10) may limit the scope of deletion requests.
• Right to Restriction: You may request that mb33 restrict the processing of your personal data in certain circumstances — for example, while a dispute about accuracy is resolved.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that mb33 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on mb33's legitimate interests, and you may withdraw marketing consent at any time. Withdrawal of marketing consent does not affect the lawfulness of prior processing.

13 Children and Minors

The mb33 Platform is strictly restricted to adults aged 21 years and above. mb33 does not knowingly collect, store, or process personal data from persons under the age of 21. If mb33 becomes aware that personal data has been collected from a person under 21, that data will be deleted immediately and the associated account will be closed in accordance with the mb33 Terms & Conditions.

If you are a parent or guardian and believe that a minor in your care has registered an mb33 account or provided personal data to the Platform, please contact [email protected] immediately. mb33 will investigate and take appropriate action without undue delay.

14 Changes to This Policy

mb33 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. When material changes are made, mb33 will notify registered players via their registered email address or via a prominent notice on the Platform at least 7 days before the changes come into effect.

The "Last updated" date at the top of the legal document section of this page reflects the date on which the current version of this Policy became effective. We encourage you to review this Policy periodically to stay informed about how mb33 handles your personal data. Your continued use of the Platform following the publication of a revised Policy constitutes your acceptance of the updated terms.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way mb33 processes your personal data, please contact the mb33 Data Privacy team using the details below. All privacy-related communications will be handled with strict confidentiality.

Please include your registered mobile number or username in all privacy-related correspondence so that our team can locate your account records promptly. Do not include your account password or full payment details in any email communication.