melbat Privacy Policy

1. Introduction

1.1 melbat is an online betting and casino platform serving Bangladeshi players. We provide cricket sportsbook, live casino, slot games, card games including Dino Hunter and Pool Rummy, and related support services. In the course of providing these services, we necessarily collect and process certain categories of personal data.

1.2 We take our responsibility as a data controller seriously. melbat does not sell, rent, or monetise your personal data for third-party marketing purposes. Data collected by melbat is used exclusively for the purposes described in this policy and for no other purpose without your explicit consent.

1.3 This policy should be read alongside the melbat Terms & Conditions and Responsible Gaming Policy, which together form the complete framework governing your relationship with the platform.

2. Data We Collect

2.1 melbat collects personal data across several categories depending on the nature of your interaction with the platform. The following table summarises the main categories of data we may hold about you:

2.2 We collect only the minimum data necessary for the purposes described in this policy. We do not collect special categories of sensitive personal data — such as health information, racial or ethnic origin, political opinions, or religious beliefs — unless specifically required for a responsible gaming assessment and with your explicit consent.

3. How We Collect Data

3.1 melbat collects personal data through the following channels:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your account profile.
• Automated Technical Collection: Data collected automatically when you access the melbat platform, including IP address, device identifiers, browser information, and session activity logs. This data is collected via server logs and first-party cookies.
• Payment Processors: Transaction confirmation data received from payment partners including bKash, Nagad, Rocket, and Upay when you initiate a deposit or withdrawal through our platform.
• Identity Verification Partners: Where melbat uses a third-party KYC verification service, that service may provide us with a verification result and associated identity metadata. We do not receive raw document scans directly from third-party KYC providers — only the structured verification output.
• Fraud Detection Systems: Automated systems may generate risk scores or behavioural flags based on your activity patterns. These are used internally for platform security and are not shared with third parties.

4. Purposes of Processing

4.1 melbat processes your personal data for the following specific purposes:

• Creating and managing your melbat account, including authentication and account security.
• Processing deposits, withdrawals, and all other financial transactions conducted through the platform.
• Verifying your identity and age as required by our Terms & Conditions and responsible gaming obligations.
• Operating and administering the betting, casino, and gaming services you access on the platform.
• Communicating with you regarding your account, transactions, promotional offers you have opted into, and service updates.
• Detecting, investigating, and preventing fraud , money laundering, and other illegal or prohibited activity on the melbat platform.
• Complying with applicable legal and regulatory obligations, including record-keeping requirements and disclosures to authorities where required by law.
• Administering and enforcing our responsible gaming tools, including deposit limits, self-exclusion, and cool-off periods.
• Improving the performance, security, and user experience of the melbat platform through aggregated analytics and technical monitoring.
• Resolving disputes, handling complaints, and enforcing our Terms & Conditions where necessary.

4.2 melbat will not use your personal data for automated decision-making that produces legal or similarly significant effects without providing you with the ability to request human review of that decision. Where automated fraud detection or age verification tools flag your account for review, a member of our compliance team will conduct a manual assessment before any account action is taken.

5. Legal Basis for Processing

5.1 melbat processes your personal data on the following legal grounds:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the melbat Terms & Conditions — including account management, transaction processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering requirements, age verification obligations, and financial record-keeping rules.
• Legitimate Interests: Processing carried out for melbat's legitimate business interests, including fraud prevention, platform security, and service improvement — provided those interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your explicit, freely given consent — for example, sending you promotional communications or processing sensitive data in connection with a responsible gaming assessment. You may withdraw consent at any time by contacting [email protected].

6. Data Sharing and Third Parties

6.1 melbat does not sell, rent, or trade your personal data. We share data only in the following strictly defined circumstances:

• Payment Processors: We share necessary transaction data with bKash, Nagad, Rocket, Upay, and other approved payment partners solely to process your deposits and withdrawals. These partners operate under their own privacy policies and are contractually prohibited from using your data for any purpose other than payment processing.
• Identity Verification Providers: Where a third-party KYC partner is used to verify your identity or age, we share the minimum required data — typically a document type indicator and a verification reference — with that provider. Document images are processed by the KYC partner directly and are not stored by melbat.
• Fraud Prevention and Security: We may share data with fraud detection service providers or financial intelligence units where we have reasonable grounds to suspect fraudulent or illegal activity.
• Legal Authorities: We will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction when required to do so by applicable law, court order, or regulatory direction. We will notify you of any such disclosure where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of melbat's business assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify registered users via their registered email address prior to any such transfer taking effect.

6.2 All third parties with whom melbat shares data are required to implement appropriate technical and organisational security measures to protect that data and are contractually prohibited from using it for any purpose beyond the specific task for which it was shared.

7. Data Retention

7.1 melbat retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law.

7.2 When your data reaches the end of its retention period, it is either securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes.

8. Security Measures

8.1 melbat implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the melbat platform.
• Encrypted storage of all personal and financial data at rest using industry-standard encryption protocols.
• Password hashing using modern cryptographic algorithms — passwords are never stored in plain text and are inaccessible even to melbat staff.
• Role-based access controls ensuring that only authorised personnel with a specific business need can access personal data.
• Two-factor authentication available for all melbat user accounts as an optional security enhancement.
• Regular internal security audits and penetration testing to identify and remediate vulnerabilities.
• Strict data minimisation practices ensuring that each internal team accesses only the data necessary for their specific function.

8.2 In the event of a personal data breach that poses a risk to your rights and freedoms, melbat will notify affected users via their registered email address within a reasonable timeframe and will take all necessary steps to contain and remediate the breach.

9. Cookies and Tracking Technologies

9.1 melbat uses first-party cookies and similar tracking technologies to operate the platform, maintain your session, and improve your user experience. We do not use third-party advertising cookies or cross-site tracking technologies.

9.2 The following categories of cookies are used on the melbat platform:

• Strictly Necessary Cookies: Required for the platform to function — including session authentication, security tokens, and load balancing. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your account preferences, language settings, and responsible gaming configurations so you do not need to re-enter them on each visit.
• Analytics Cookies: First-party analytics data used internally to understand how users navigate the platform and to identify areas for improvement. This data is aggregated and not linked to your personal identity for analytical reporting purposes.

9.3 You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the melbat platform. Disabling functional cookies will mean your preferences are not saved between sessions.

10. Your Privacy Rights

10.1 As a melbat user, you have the following rights regarding your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Rights Request":

• Right of Access: You may request a copy of all personal data melbat holds about you. We will respond within 30 days of receiving a valid request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. Minor corrections (such as a phone number update) can be made directly in your account dashboard.
• Right to Erasure: You may request deletion of your personal data in certain circumstances — for example, if the data is no longer necessary for the purposes for which it was collected. This right is subject to our legal retention obligations; some data must be retained by law regardless of an erasure request.
• Right to Restriction: You may request that we restrict the processing of your data — for example, while a dispute regarding data accuracy is being resolved.
• Right to Data Portability: You may request a structured, machine-readable copy of personal data you have provided to us, for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing of your data based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

10.2 melbat will respond to all privacy rights requests within 30 calendar days. In complex cases, we may extend this to 60 days and will notify you of the extension and the reason for it.

11. Minors and Age Verification

11.1 The melbat platform is strictly intended for adults aged 18 and above. We do not knowingly collect personal data from individuals under the age of 18. If you are under 18, you must not attempt to register, access, or use any part of the melbat platform.

11.2 melbat conducts age verification checks during registration and at additional points in the account lifecycle. If we discover that a registered account is held by a person under 18, we will immediately close the account, return any deposited funds to the originating payment method, and delete all personal data associated with that account to the extent permitted by our legal obligations.

11.3 If you believe a person under 18 has accessed the melbat platform, please notify us immediately at [email protected] so that we can take appropriate action.

12. International Data Transfers

12.1 melbat's primary data processing infrastructure is located in secure data centres serving the Asia-Pacific region. In some cases — for example, where a third-party KYC or fraud prevention partner is involved — your data may be processed in a jurisdiction outside Bangladesh.

12.2 Where international transfers of personal data occur, melbat ensures that appropriate safeguards are in place, including contractual data protection clauses with the receiving party that provide protections equivalent to those described in this policy.

13. Changes to this Privacy Policy

13.1 melbat may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform functionality. When we make material changes, we will notify registered users via their registered email address at least 14 days before the changes take effect.

13.2 The effective date shown in the hero section of this page reflects the date of the most recent update. We encourage you to review this policy periodically. Continued use of the melbat platform after a revised policy takes effect constitutes your acceptance of the updated terms.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way melbat handles your personal data, please contact our data protection team. All privacy-related enquiries receive a response within 30 calendar days.