malbat Privacy
Policy & Data Protection

This Privacy Policy ("Policy") is issued by malbat ("malbat," "we," "us," or "our") and applies to all personal data collected, processed, stored, and used by malbat in connection with the operation of the malbat gaming platform accessible at malbat.site (the "Platform").

This Policy applies to all registered players, prospective players who have initiated registration, visitors to the malbat website, and any other individual whose personal data malbat processes in connection with the Platform. It covers personal data collected online via the Platform, submitted through customer support communications, provided during the KYC verification process, and collected through technical means such as cookies and device identifiers.

By accessing the malbat Platform, creating an Account, or otherwise providing personal data to malbat, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. If you do not agree to any aspect of this Policy, you should not use the malbat Platform.

For the purposes of this Privacy Policy, malbat is the data controller — the entity that determines the purposes and means by which your personal data is processed. malbat operates under an international gaming license and its data processing activities are governed by the data protection requirements of its licensing jurisdiction.

Questions, requests, and complaints regarding the processing of your personal data by malbat should be directed to the malbat Data Protection contact at the email address provided in Section 15 of this Policy. malbat is committed to responding to all legitimate data inquiries within a reasonable timeframe, typically not exceeding thirty (30) calendar days from receipt of a valid request.

malbat collects personal data in several categories depending on your relationship with the Platform. The table below sets out the main categories of personal data we collect, the source of that data, and the primary purpose for which it is collected.

malbat does not intentionally collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation) unless this is strictly required for a specific legal purpose, in which case explicit consent or other appropriate legal basis will be obtained.

malbat processes personal data only where we have a valid legal basis to do so. The legal bases we rely upon are as follows:

4.1 Performance of a Contract

The majority of malbat's personal data processing is necessary for the performance of the agreement between malbat and the player — including account registration, processing deposits and withdrawals, operating betting and casino accounts, and providing customer support.

4.2 Legal Obligation

malbat is required to process certain personal data to comply with applicable legal obligations, including KYC identity verification, anti-money laundering (AML) checks, age verification, regulatory reporting, and fraud prevention requirements imposed by our gaming license.

4.3 Legitimate Interests

malbat processes certain personal data on the basis of legitimate interests — including security monitoring, fraud detection, responsible gaming oversight, service improvement, and the internal administration of the Platform — where these interests are not overridden by the fundamental rights and interests of players.

4.4 Consent

Where malbat processes personal data for marketing communications or non-essential cookies, it does so only on the basis of your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

malbat uses the personal data collected from Pakistani players and other users for the following specific purposes:

• Account Registration and Management: To create, maintain, and administer your malbat Account, including verifying your identity and eligibility;
• Service Delivery: To operate the malbat sportsbook, casino, Golden Bank loyalty programme, and all other Platform features;
• Payment Processing: To facilitate deposits via JazzCash, EasyPaisa, HBL, Meezan Bank, UBL, SadaPay, and other approved methods, and to process PKR withdrawal requests;
• KYC and Regulatory Compliance: To verify your age (21+), identity, and the legitimacy of your payment methods as required under applicable gaming regulations;
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, money laundering, and other security threats;
• Responsible Gaming: To monitor gaming activity for indicators of problem gambling behaviour and to enforce responsible gaming tools including deposit limits, session controls, and self-exclusion;
• Customer Support: To respond to your inquiries, resolve disputes, and provide assistance with Account issues;
• Personalisation: To tailor the malbat experience to your preferences and provide contextually relevant promotions, where you have consented to receive them;
• Legal and Regulatory Obligations: To comply with applicable laws, respond to regulatory requests, and fulfil our obligations under our international gaming license;
• Platform Improvement: To analyse usage patterns and technical data for the purpose of improving the performance, reliability, and features of the malbat Platform.

malbat shares personal data only in the following limited and controlled circumstances:

6.1 Essential Service Providers (Data Processors)

malbat engages carefully selected third-party service providers to assist in the operation of the Platform. These providers act as data processors under malbat's instruction and are bound by strict data processing agreements. Categories of processors include: payment processing partners (JazzCash, EasyPaisa, and banking partners); KYC and identity verification service providers; casino game software providers; cloud hosting and infrastructure providers; and customer support platform operators. These providers receive only the minimum personal data necessary to perform their specific function.

6.2 Regulatory and Legal Disclosure

malbat may be required to disclose personal data to competent governmental or regulatory authorities, law enforcement agencies, or courts in response to lawful requests, court orders, or regulatory demands. Where legally permitted, malbat will notify you of such a disclosure. Where malbat is legally prohibited from notifying you (for example, in the context of an active criminal investigation), we will comply with the legal obligation without notification.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of malbat's business or assets, personal data held by malbat may be transferred to the acquiring entity. Any such transfer will be subject to confidentiality obligations and the acquiring entity will be required to honour the terms of this Privacy Policy with respect to pre-existing player data.

malbat is an internationally licensed gaming platform, and the operation of the Platform may involve the transfer of personal data to servers or service providers located in jurisdictions outside Pakistan. malbat takes its responsibility to protect personal data during international transfers seriously.

Where personal data is transferred outside of the player's home country to a jurisdiction that may not provide an equivalent level of data protection, malbat implements appropriate safeguards to protect that data, which may include: standard contractual clauses approved by relevant regulatory authorities; data processing agreements with appropriate security and confidentiality obligations; and technical and organisational security measures designed to protect data at rest and in transit.

If you wish to obtain information about the specific safeguards in place for any particular international transfer of your personal data, please contact the malbat Data Protection team at the email address provided in Section 15.

malbat invests substantially in technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• Encryption in Transit: All data transmitted between your device and malbat's servers is encrypted using TLS 1.3 / 256-bit SSL encryption;
• Encryption at Rest: Personal data and financial records stored on malbat's servers are encrypted using AES-256 encryption;
• Access Controls: Access to player personal data within malbat is restricted on a strict need-to-know basis, with role-based access controls, multi-factor authentication for system access, and comprehensive access logging;
• Intrusion Detection: malbat's systems are monitored continuously for intrusion attempts, anomalous access patterns, and other security threats;
• Penetration Testing: Regular third-party penetration testing and security audits are conducted to identify and remediate vulnerabilities;
• Data Segmentation: Financial data, identity data, and gaming activity data are stored in logically segregated systems with separate access control frameworks.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is completely secure. Players are reminded that they also have an important role in securing their malbat Account — through use of a strong, unique password and enabling two-factor authentication. If you believe your malbat Account or personal data has been compromised, please contact the malbat security team immediately.

malbat retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The following general retention periods apply:

At the expiry of the applicable retention period, malbat will securely delete or irreversibly anonymise the personal data in question, such that it can no longer be associated with any identified or identifiable individual. Where data is anonymised rather than deleted, it may be retained indefinitely for statistical and analytical purposes without restriction.

The malbat Platform uses cookies and similar tracking technologies (collectively, "cookies") to operate certain essential functions, improve the player experience, and gather analytical data. A cookie is a small text file that is placed on your device when you visit the malbat Platform.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: These are essential for the Platform to function and cannot be disabled. They include session management cookies that maintain your logged-in state, security cookies that support fraud detection and CSRF protection, and cookies that store your cookie consent preferences;
• Functional Cookies: These enable enhanced functionality such as remembering your language preferences, display settings, and responsible gaming configurations. Disabling these may affect certain Platform features;
• Analytical Cookies: These allow malbat to understand how players navigate and use the Platform, helping us identify areas for improvement. Where analytical cookies involve third-party processors, they are deployed only with your consent;
• Marketing Cookies: These are used to deliver promotional content relevant to your interests and to measure the effectiveness of malbat marketing campaigns. Marketing cookies are deployed only with your explicit consent and can be withdrawn at any time.

You may manage your cookie preferences at any time through the Cookie Settings option available in the Platform's footer. Withdrawing consent for non-essential cookies will not affect the lawfulness of processing carried out before withdrawal, nor will it affect your ability to access essential Platform features that rely on strictly necessary cookies.

As a malbat player, you have the following rights in relation to your personal data. These rights may be subject to certain conditions or limitations prescribed by applicable law, but malbat is committed to facilitating their exercise in a clear, accessible, and timely manner.

To exercise any of these rights, please submit a written request to the malbat Data Protection contact as provided in Section 15. malbat will respond within thirty (30) calendar days of receiving a valid, verifiable request. We may need to verify your identity before actioning any data rights request.

If you are a parent or guardian and believe that your child may have accessed or registered for the malbat Platform, please contact the malbat support team immediately at the contact details provided in Section 15 of this Policy. malbat takes child protection extremely seriously and will act swiftly upon any such notification.

malbat may send promotional communications — including information about new games, PSL season promotions, Golden Bank offers, and other malbat campaigns — to players who have expressly opted in to receive them. Marketing communications are sent via the channel(s) you have consented to, which may include email to your registered address and/or SMS to your registered Pakistani mobile number.

You may withdraw your consent to marketing communications at any time by: (a) clicking the unsubscribe link included in any marketing email; (b) updating your marketing preferences in your malbat Account settings; or (c) contacting the malbat support team directly. Withdrawal of marketing consent will be processed within five (5) business days. Note that transactional communications — such as deposit confirmations, withdrawal notifications, and account security alerts — are not marketing communications and will continue regardless of your marketing consent status.

malbat reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made to this Policy, malbat will notify registered players via the email address associated with their Account and/or by a prominent notice displayed on the Platform, providing a minimum of seven (7) days' notice before the revised Policy takes effect.

The most current version of this Privacy Policy will always be accessible on the malbat Platform at malbat.site/privacy-policy. The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. We encourage players to review this Policy periodically.

Your continued use of the malbat Platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the changes. If you have material objections to any amendment, you should cease using the Platform and may request Account closure and withdrawal of your Real Money Balance.

For all enquiries, requests, and complaints relating to the processing of your personal data by malbat, please contact the malbat Data Protection team. All communications should be submitted in writing to ensure a clear record.

malbat is committed to resolving all data-related queries and complaints fairly, transparently, and within a reasonable timeframe. If you believe malbat has not adequately addressed your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in the applicable jurisdiction.