Your Privacy Matters to mesa

01 Introduction

mesa (operating at mesa.best) is Bangladesh's premier online casino and sports betting platform. We are deeply committed to protecting the privacy and personal data of every player, visitor, and prospective customer who interacts with our platform. This Privacy Policy has been written in plain, professional English to ensure that all players — regardless of their familiarity with data protection concepts — can understand their rights and mesa's obligations.

This Privacy Policy applies to all personal data collected through the mesa website at mesa.best, the mesa mobile platform (if applicable), all communications between mesa and its players (including email, live chat, and support tickets), and all financial transactions processed through the mesa cashier. It applies to all registered players in Bangladesh and to any visitor who browses the mesa platform without registering an account.

This policy should be read alongside the mesa Terms and Conditions and the mesa Responsible Gaming policy, both of which are incorporated by reference into this document. In the event of any conflict between this Privacy Policy and any other mesa document, this Privacy Policy shall govern with respect to all matters relating to the collection and use of personal data.

The data controller responsible for your personal information is mesa, contactable at [email protected]. All data protection enquiries, subject access requests, and privacy complaints should be directed to this address.

02 Data We Collect

mesa collects several categories of personal data in the course of providing its services. The categories and specific data types collected are set out below:

Identity Data

• Full legal name (as it appears on your government-issued ID)
• Date of birth (used for mandatory 21+ age verification)
• Gender (optional, collected during registration)
• Nationality and country of residence
• National ID number, passport number, or driving licence number (collected during KYC verification)
• Copies of identity verification documents (government-issued photo ID, proof of address)

Contact Data

• Email address (primary communication and account recovery channel)
• Mobile phone number (used for two-factor authentication and account security alerts)
• Residential address (city, district, postal code — Bangladesh addresses supported in full)

Financial Data

• bKash, Nagad, Rocket, Upay, or SureCash mobile wallet identifiers used for deposits or withdrawals
• Visa or Mastercard card details (card number is tokenised and never stored in full by mesa)
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method references
• Account balance history and bonus award records

Gaming & Betting Activity Data

• Game session logs: games played, bet amounts, win/loss outcomes, session duration
• Sports betting history: markets wagered on, odds accepted, bet settlement records
• Bonus usage history: bonuses claimed, wagering progress, bonus expiry events
• Responsible gaming settings: deposit limits set, self-exclusion periods, session time limits

Technical & Usage Data

• IP address and approximate geolocation (city/district level)
• Device type, operating system, and browser type and version
• Pages visited on mesa.best, time spent on each page, click paths, and referral sources
• Login timestamps, session duration, and logout events
• Error logs and crash reports generated during your use of the platform

Communications Data

• Content of live chat conversations with mesa support agents
• Email correspondence with the mesa support or compliance team
• Feedback, complaints, and dispute records

03 How We Collect Your Data

mesa collects personal data through the following channels and mechanisms:

• Direct collection at registration: When you create a mesa account, you provide your name, date of birth, email address, phone number, and residential address directly through the registration form.
• Identity verification submissions: When you submit KYC documents in response to a mesa verification request, we collect and store the identity information contained in those documents.
• Transactional collection: Each time you make a deposit or withdrawal, our payment processing systems record the transaction details, including the payment method identifier and the amount transferred.
• Platform activity logging: Our servers automatically log your activity on the mesa platform, including game sessions, bet placements, page views, and all interactions with the site interface.
• Cookies and tracking technologies: mesa uses cookies, web beacons, and similar technologies to collect usage and technical data. See Section 8 for full details of our cookie practices.
• Support interactions: When you contact mesa via live chat or email, the content of your communication is recorded and stored in our customer relationship management system.
• Third-party sources: In limited circumstances, mesa may receive data about you from third-party identity verification service providers, fraud prevention agencies, or payment processors to supplement the information you have provided directly.

04 How We Use Your Data

mesa uses the personal data it collects for the following specific purposes. For each purpose, we have identified the lawful basis on which we rely to process your data:

05 Data Sharing & Third Parties

mesa does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We share your data only in the specific, limited circumstances described below:

• Payment processors: Your financial data is shared with payment service providers (including mobile financial service operators such as bKash, Nagad, Rocket, and Upay, and card networks such as Visa and Mastercard) to the extent necessary to process your deposit and withdrawal transactions. These providers are bound by their own data protection obligations.
• Identity verification providers: When you submit KYC documents, your identity data may be processed by a third-party verification service provider acting as a data processor on mesa's behalf, subject to a data processing agreement that ensures your data is handled securely and only for the purposes of verification.
• Game studios and content providers: When you play a game provided by a third-party studio (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Ezugi), limited technical data (such as your player session token and bet details) is shared with the relevant game server in order to deliver the game experience. These providers do not receive your full identity or financial data.
• Fraud prevention and compliance agencies: mesa may share data with fraud prevention services and anti-money-laundering databases to screen for prohibited activity. This sharing is carried out under a legal obligation and/or legitimate interest basis.
• Legal and regulatory authorities: mesa may be required to disclose your personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction upon receipt of a lawful order, warrant, or request. mesa will notify you of such a disclosure wherever legally permitted to do so.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of mesa's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and any change in the applicable privacy policy in advance of the transfer taking effect.

All third parties with whom mesa shares personal data are contractually required to process that data only for the specified purpose, to maintain appropriate security standards, and to comply with applicable data protection laws.

06 Data Retention

mesa retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active account data: All personal data associated with an active mesa account is retained for the duration of the account's active status plus a period of five (5) years following permanent account closure. This extended retention period supports our compliance obligations under anti-money-laundering regulations.
• Transaction records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of seven (7) years from the date of the transaction, in line with standard financial record-keeping requirements.
• KYC documents: Identity verification documents are retained for five (5) years following permanent account closure, after which they are securely destroyed.
• Communications records: Support chat transcripts and email correspondence are retained for three (3) years from the date of the communication, unless a longer retention period is required for an ongoing dispute or legal matter.
• Marketing data: If you have opted in to marketing communications, your contact details and communication preferences are retained until you withdraw consent or request deletion, whichever occurs first.
• Technical and usage logs: Server logs and usage analytics data are typically retained for twelve (12) months, after which they are aggregated and anonymised for statistical reporting purposes.

When your personal data is no longer required for any lawful purpose, mesa will securely delete or anonymise it in accordance with our internal data destruction procedures. Anonymised data (data from which all identifying information has been irreversibly removed) is not subject to the retention limits above and may be retained indefinitely for statistical analysis and platform improvement.

07 Data Security

mesa takes the security of your personal data seriously and has implemented a comprehensive set of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption: All data transmitted between your device and the mesa platform is encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 or higher). The mesa.best domain uses HTTPS exclusively.
• Encryption at rest: Sensitive personal data stored on mesa's servers — including identity verification documents and financial records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted to mesa employees and contractors who have a legitimate operational need to access it. All access is governed by role-based access control (RBAC) policies and is subject to audit logging.
• Two-factor authentication: mesa strongly encourages all players to enable two-factor authentication (2FA) on their accounts. 2FA is available via SMS to your registered mobile number.
• Penetration testing: mesa's platform undergoes regular security assessments, including penetration testing by qualified independent security professionals, to identify and remediate vulnerabilities before they can be exploited.
• Incident response: mesa maintains a documented data breach response procedure. In the event of a data breach that poses a risk to your rights and freedoms, mesa will notify affected players promptly and take immediate steps to contain the breach and mitigate its impact.

08 Cookies & Tracking Technologies

mesa uses cookies and similar tracking technologies on the mesa.best website to deliver a functional, personalised, and secure user experience. A cookie is a small text file placed on your device by a website when you visit it. Cookies cannot execute programmes or deliver viruses to your device.

mesa uses the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the mesa platform to function. They enable core functionality such as maintaining your login session, remembering your language preference, and securing your account. These cookies cannot be disabled without fundamentally impairing the functionality of the platform.
• Performance and analytics cookies: These cookies collect aggregated, anonymised data about how visitors use the mesa platform — including which pages are visited most frequently, how long sessions last, and where users navigate from. This data is used to improve platform performance and user experience.
• Functional cookies: These cookies remember choices you make on the mesa platform (such as your preferred deposit method or display settings) and provide enhanced, personalised features during your session.
• Targeting and preference cookies: Where you have opted in to receive personalised promotional communications, these cookies help mesa deliver relevant bonus offers and promotions based on your gaming preferences and activity history. These cookies are only placed with your consent.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, and configure alerts when a new cookie is set. Note that disabling strictly necessary cookies will prevent you from logging in to your mesa account and using core platform features.

mesa does not use cross-site tracking technologies to follow your browsing activity across third-party websites that are not part of the mesa platform.

09 Your Data Rights

As a player on the mesa platform, you have the following rights in relation to your personal data. mesa is committed to honouring these rights promptly and without placing unnecessary obstacles in your way:

• Right of access: You have the right to request a copy of the personal data that mesa holds about you. This is commonly known as a Subject Access Request (SAR). mesa will respond to a valid SAR within 30 days of receipt.
• Right to rectification: If any of the personal data mesa holds about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update most of your account information directly within your mesa account settings. For corrections to verified identity data, please contact [email protected].
• Right to erasure: You have the right to request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn your consent and there is no other lawful basis for processing. Note that this right is not absolute; mesa may be required to retain certain data for legal and regulatory compliance purposes even after you have requested erasure.
• Right to restriction: You have the right to request that mesa restricts the processing of your personal data in certain circumstances, for example while a dispute about the accuracy of your data is being resolved.
• Right to data portability: Where mesa processes your personal data on the basis of your consent or a contract, and by automated means, you have the right to receive a copy of your data in a structured, commonly used, machine-readable format, and to request that it be transmitted to another controller where technically feasible.
• Right to object: You have the right to object to the processing of your personal data where mesa relies on legitimate interests as its lawful basis. You also have an absolute right to object to the processing of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where mesa processes your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of the above rights, please contact the mesa data protection team at [email protected] with the subject line "Data Rights Request". Please include your registered username and the email address associated with your mesa account so that we can locate your records efficiently. mesa will acknowledge your request within 48 hours and respond in full within 30 days.

10 Minors & Age Restriction

The mesa platform is strictly for adults aged 21 and above. mesa does not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory step in the mesa account registration process, and all accounts are subject to ongoing age verification checks.

If mesa discovers or has reasonable grounds to suspect that personal data has been collected from a person under the age of 21, it will immediately suspend the relevant account, delete the personal data collected, and — where applicable — refund any deposits made to the originating payment method after deduction of any bonuses received.

If you are a parent or guardian and believe that your child under the age of 21 has created a mesa account or provided personal data to mesa, please contact us immediately at [email protected]. We will investigate and take prompt action to address the situation, including account closure and data deletion.

11 International Data Transfers

mesa's primary operations serve players in Bangladesh, and the majority of your personal data is processed and stored on servers located in the Asia-Pacific region. However, in some cases, your personal data may be transferred to and processed by third-party service providers (such as game studios, payment processors, or identity verification providers) whose servers are located in other countries.

Wherever mesa transfers personal data outside of the region in which it was originally collected, we ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Privacy Policy. These safeguards may include:

• Contractual clauses in our agreements with third-party service providers that require them to protect your data to a standard consistent with this policy.
• Transfers only to service providers in countries or jurisdictions that maintain an adequate level of data protection as assessed by mesa's compliance team.
• Technical measures such as encryption of data in transit and at rest to minimise the risk of unauthorised access during cross-border transfers.

If you would like more information about the specific safeguards that apply to a particular international transfer of your personal data, please contact us at [email protected].

12 Changes to This Policy

mesa reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law, or changes in the services we offer. The effective date of the current version of this policy is stated at the top of this document and in the table of contents sidebar.

When mesa makes material changes to this Privacy Policy — changes that meaningfully affect your rights or the way we use your personal data — we will notify registered players by email to the address registered on their account, and by posting a prominent notice on the mesa platform for a period of at least 30 days following the change.

Non-material changes, such as corrections to typographical errors, clarifications of existing provisions that do not alter their substantive meaning, or formatting updates, may be made without prior notice. Your continued use of the mesa platform following any update to this policy constitutes your acknowledgement of the revised terms.

We encourage you to review this Privacy Policy periodically to stay informed about how mesa protects your personal data. Previous versions of this policy are available on request by contacting [email protected].

13 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 9, please contact the mesa data protection team using the following details:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" as appropriate
• Live Chat: Available within your logged-in mesa account, 24 hours a day, 7 days a week, in English
• Response time: mesa aims to acknowledge all privacy-related enquiries within 48 hours (Bangladesh Standard Time, UTC+6) and to provide a full response within 30 calendar days.

mesa takes all privacy complaints seriously. If you submit a complaint, it will be logged, assigned to a member of our compliance team, and investigated thoroughly. You will receive a written response setting out mesa's findings and any remedial action taken.

If you are not satisfied with mesa's response to your privacy complaint, you have the right to escalate your complaint to the relevant data protection authority or seek independent legal advice. mesa will always cooperate fully with any such process.