Your Privacy Matters to mlweb

mlweb collects personal data through several channels: directly from you when you register an account, deposit funds, or contact our support team; automatically through your use of the platform; and in certain cases from third-party identity verification or payment processing partners. The categories of information we collect are described in the table below.

We do not intentionally collect data from individuals under the age of 18. If we become aware that personal data has been submitted by a minor, that data will be deleted immediately and the associated account will be closed. If you believe a minor has registered on the platform, please notify us promptly at [email protected].

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where identity documents provided during KYC may incidentally contain such information. In those cases, the relevant fields are not processed, stored, or used for any purpose beyond confirming identity and age.

In the course of operating the mlweb platform, your personal data may be shared with the following categories of third parties:

• Payment Processors: When you deposit or withdraw funds using bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, or Mastercard, necessary transaction data (such as your wallet number, transaction reference, and BDT amount) is shared with the relevant payment provider to process the transaction. These providers operate under their own privacy policies and are independent data controllers for the payment transaction itself.
• Identity Verification Services: To fulfil KYC obligations, mlweb may share identity documents or data points with third-party verification service providers. These providers are contractually bound to process your data only for the purpose of identity verification and may not use it for any other purpose.
• Game Technology Providers: Game providers such as Pragmatic Play, Evolution Gaming, Ezugi, Spribe, NetEnt, and Microgaming may receive session-level technical data (such as player ID, game round ID, wager amount, and game outcome) in order to deliver the game service. These providers do not receive your full personal profile.
• IT Infrastructure & Security Providers: mlweb uses third-party hosting, cloud infrastructure, and cybersecurity service providers to maintain platform availability and security. These providers act as data processors under contract and may not independently access or use player data.
• Legal & Regulatory Authorities: mlweb will disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, court order, or where we reasonably believe disclosure is necessary to prevent a serious crime or protect the safety of any individual.

All third-party service providers engaged by mlweb are required to enter into written data processing agreements that oblige them to maintain the confidentiality and security of any player data they handle on our behalf. mlweb remains responsible for ensuring that such agreements are in place and adhered to.

mlweb does not transfer personal data to recipients outside of the jurisdictions where adequate data protection standards apply, unless appropriate contractual safeguards are in place to protect the data during that transfer.

mlweb retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active account data: Retained for the full duration of your account's active status, plus a minimum of five (5) years after account closure to satisfy financial record-keeping and fraud investigation obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission, or longer if required by applicable anti-money laundering regulations.
• Transaction records: All deposit and withdrawal records, including BDT amounts and payment method references, are retained for a minimum of five (5) years from the date of the transaction.
• Support communications: Email, chat, and ticket records are retained for three (3) years from the date of the last communication in a given thread.
• Marketing consent records: Records of your consent to (or withdrawal of consent from) marketing communications are retained for the duration of your account and for three (3) years thereafter.
• Technical and usage logs: Server logs and session data are retained for up to twelve (12) months, after which they are anonymised or deleted.

When personal data is no longer required for any of the above purposes, mlweb will securely delete or anonymise it. Secure deletion means overwriting data on storage media to the extent that it cannot be recovered. Anonymisation means stripping all identifiers from data records so that they can no longer be linked back to any individual player.

Player data is stored on servers located in secure data centres. Access to these servers is restricted to authorised personnel, and all data at rest is encrypted. mlweb conducts regular reviews of its data storage infrastructure to ensure that security standards remain current and effective.

The security of your personal data is taken seriously at mlweb. We have implemented a multi-layered security framework designed to protect your data against unauthorised access, disclosure, alteration, and destruction. Key measures in place include:

• Transport Layer Security (TLS): All data in transit between your device and mlweb servers is encrypted using TLS 1.2 or higher. The padlock icon in your browser's address bar confirms this encryption is active during your session.
• Encryption at Rest: Sensitive data fields — including identity document references, payment method identifiers, and account passwords — are encrypted at rest using strong symmetric encryption algorithms. Passwords are stored as salted cryptographic hashes and can never be retrieved in plain text, even by mlweb staff.
• Access Controls: Access to player data within mlweb's systems is strictly role-based. Staff members can only access the data categories relevant to their specific job function. All access events are logged and subject to periodic audit.
• Two-Factor Authentication (2FA): Players are encouraged to enable SMS-based two-factor authentication on their accounts. This adds a second layer of protection beyond a password, requiring a one-time PIN sent to your registered Bangladeshi mobile number at each login.
• Intrusion Detection & Monitoring: mlweb employs continuous network monitoring and intrusion detection systems to identify and respond to suspicious activity in real time. Our security operations team operates around the clock.
• Regular Security Audits: We conduct periodic internal and third-party security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.

Despite our best efforts, no digital platform can guarantee absolute security. In the unlikely event of a data breach that poses a material risk to your rights, mlweb will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach. You will be informed of the nature of the data affected, the likely consequences, and the measures mlweb is taking in response.

You also have a role in keeping your account secure. Never share your password with anyone, use a strong and unique password for your mlweb account, and contact [email protected] immediately if you suspect any unauthorised access to your account.