MGLion Privacy Policy — How We Protect Your Personal Data

1. Introduction

This Privacy Policy applies to all services provided by MGLion through the website mglion.click and any associated mobile or web-based applications (collectively, "the Platform"). When this document refers to "MGLion", "we", "us" or "our", it means the company operating mglion.click. When it refers to "you" or "your", it means any person who visits, registers on or otherwise uses the Platform.

MGLion is committed to handling your personal information with transparency and care. This Policy explains what data we collect, the reasons for collecting it, how we use and protect it, and how you can exercise your rights over it. We have written this document in plain, straightforward English rather than dense legal language, because we want Pakistani players to actually understand how their information is being handled — not just tick a box saying they have read a document they could not follow.

This Policy should be read alongside our Terms and Conditions (mglion.click/terms-conditions) and our Responsible Gaming Policy (mglion.click/responsible-gaming). All three documents together form the complete framework governing your relationship with MGLion.

2. Personal Data We Collect

MGLion collects personal data in three main ways: information you provide directly, information generated automatically through your use of the Platform, and information we may receive from third-party verification providers.

2.1 Information You Provide Directly

• Registration details: Full name, date of birth, mobile phone number, email address and chosen username and password.
• Identity verification documents: CNIC (National Identity Card), passport or driving licence number and a copy of the document itself when KYC verification is requested.
• Payment information: Your Easypaisa or JazzCash mobile number, NayaPay or SadaPay account details, bank account number for IBFT transfers, or Visa/Mastercard card details when making deposits or withdrawals. Note: full card numbers are processed by our payment provider and are never stored on MGLion's own servers.
• Support communications: Any information you share with MGLion's support team via live chat, email or messaging platforms in the course of requesting assistance.
• Preferences and settings: Responsible gaming limits, notification preferences and any other settings you configure within your account.

2.2 Information Collected Automatically

• Device information: Device type, operating system and version, browser type and version, screen resolution and device identifiers.
• Connection data: IP address, approximate geographic location derived from IP (city/region level), internet service provider and connection type.
• Session and activity logs: Pages visited on the Platform, games played, bets placed, time and duration of sessions, login and logout timestamps and navigation patterns within the Platform.
• Cookies and similar technologies: Session tokens, preference identifiers and analytics identifiers as described in detail in Section 7 below.

2.3 Information from Third Parties

MGLion may receive information about you from identity verification providers and fraud prevention databases when we carry out KYC checks. This information is used solely to verify the accuracy of the details you have provided and to meet our compliance obligations. We do not purchase marketing data about you from any third-party data broker.

3. How MGLion Uses Your Data

MGLion uses your personal data only for the purposes listed below. We do not use data for any purpose that you would not reasonably expect given the nature of a gaming platform, and we do not use it to make automated decisions about you that produce significant legal effects without human oversight.

4. Legal Basis for Processing

MGLion processes your personal data under the following legal grounds:

• Contract performance: Processing necessary to operate your account, process your payments and provide the gaming services you have signed up for. Without this processing the service simply cannot function.
• Legal obligation: Processing required to comply with identity verification, anti-money laundering, record-keeping and other regulatory requirements applicable to MGLion as an online gaming operator.
• Legitimate interests: Processing for fraud prevention, platform security monitoring, technical performance optimisation and analysis of aggregated usage patterns to improve the Platform. These interests do not override your fundamental privacy rights.
• Consent: Processing for marketing communications, promotional notifications and non-essential cookies. You can withdraw consent at any time without affecting your ability to use the Platform.

5. Sharing Your Data

MGLion does not sell your personal data to any third party, full stop. We share data only with the categories of recipients listed below and only to the extent necessary for the specific purpose stated:

5.1 Payment Processors

When you make a deposit or withdrawal, your payment details are shared with the relevant payment service provider — Easypaisa, JazzCash, NayaPay, SadaPay, your bank (for IBFT) or the card payment gateway (for Visa/Mastercard). These providers are bound by their own privacy and security obligations and receive only the data required to process the transaction.

5.2 Identity Verification Providers

When MGLion conducts KYC checks, your identity information is shared with our verification partner to cross-check against official databases. This partner is contractually bound to use your data solely for verification purposes on MGLion's behalf and to handle it with the same level of security we apply ourselves.

5.3 Software and Game Providers

Live casino and certain RNG games are provided by Evolution Gaming, Pragmatic Play and Playtech through direct integration with the MGLion Platform. These providers may receive limited technical session data (such as a session token and game-specific transaction reference) to operate the game in real time. They do not receive your full personal profile.

5.4 Regulatory and Legal Authorities

MGLion may be required by law or by court order to share certain player information with Pakistani regulatory bodies, law enforcement agencies or financial regulators. MGLion will always act in accordance with applicable law in responding to such requests and, where legally permitted, will notify you of any such disclosure.

6. How MGLion Keeps Your Data Secure

Data security is not something MGLion treats as a cost to be minimised — it is a fundamental operational requirement. The measures we have in place include:

• SSL/TLS encryption: All communications between your browser or device and mglion.click are encrypted using 256-bit SSL/TLS. Any data intercepted in transit is unreadable without the encryption key.
• Database segmentation: Personal data, financial data and gaming activity logs are stored in separate databases with separate access controls. A breach of one does not automatically expose all three.
• Access control: MGLion staff access to player data is role-based and limited to what each team member genuinely needs to do their job. Support agents can see what they need to help you; they cannot see full payment card details.
• Password hashing: Your MGLion password is stored as a one-way cryptographic hash. Even MGLion's own engineers cannot see what your password is — only you know it.
• Two-factor authentication: Available for all player accounts. Strongly recommended — enable it in your account security settings.
• Regular security audits: MGLion's platform and infrastructure are subject to periodic security reviews and penetration testing by qualified security professionals.
• Incident response: In the event of a data breach that affects your personal information, MGLion will notify you without undue delay and will take immediate steps to contain and remediate the breach.

While MGLion takes all reasonable steps to protect your data, no system is 100% impenetrable. You also play a role in your own security — choosing a strong unique password, enabling two-factor authentication and not sharing your credentials with anyone significantly reduces your personal risk.

7. Cookies and Tracking Technologies

MGLion uses cookies — small text files stored on your device — and similar technologies to operate the Platform correctly and to understand how players use it. We use three categories of cookies:

7.1 Essential Cookies

These are required for the Platform to function at all. They manage your login session, maintain your game state if you navigate between pages, and preserve your security tokens. You cannot opt out of essential cookies without disabling core functionality.

7.2 Analytics Cookies

These help MGLion understand how players navigate and use the Platform — which pages are most visited, where players encounter difficulties, and how the platform performs on different device types. Data collected is aggregated and anonymised; it does not identify you individually. You may opt out of analytics cookies through your browser settings.

7.3 Preference Cookies

These remember choices you have made on the Platform — your preferred language, display settings and notification preferences — so you do not have to reset them every visit. They contain no personal financial data.

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging in or playing games. Disabling analytics and preference cookies will not affect your ability to use the Platform's core features.

8. Data Retention

MGLion retains your personal data only for as long as it is necessary for the purposes for which it was collected, subject to legal retention obligations that may require us to keep certain records for a minimum period regardless of account status.

When retention periods expire, data is securely deleted or anonymised so that it cannot be reconnected to your identity. If you request deletion of your account and data (see Section 9), MGLion will delete all data that is not subject to a mandatory legal retention obligation, and will inform you clearly which categories of data must be retained and for how long.

9. Your Privacy Rights

As a player on MGLion, you have the following rights over your personal data. To exercise any of them, contact us at support@mglion.click with "Privacy Request" in the subject line. We will respond within 30 days. Requests are free of charge unless they are manifestly repetitive or unfounded.

10. Marketing Communications

MGLion may send you promotional notifications, bonus offers and platform updates by SMS, WhatsApp, email or in-app notification — but only with your explicit consent, which you provide by opting in during registration or at a later date through your account settings.

You can withdraw your consent for marketing communications at any time by:

• Updating your notification preferences in your MGLion account settings page.
• Clicking the unsubscribe link at the bottom of any MGLion marketing email.
• Contacting MGLion support at support@mglion.click and requesting removal from all marketing lists.

MGLion does not send marketing communications on behalf of any third party. The only marketing communications you will ever receive from mglion.click are about MGLion's own products, promotions and features. We will never pass your contact details to a third party for their own marketing purposes.

11. Protection of Minors

The MGLion Platform is strictly for adults aged 18 and over. MGLion does not knowingly collect personal data from individuals under 18 years of age. If we become aware that a minor has registered on the Platform or has provided personal data through any means, we will immediately suspend the relevant account, delete the data and refund any deposits made.

If you are a parent or guardian and believe that your child has registered on MGLion or provided their personal information to us, please contact us immediately at support@mglion.click. We will investigate and take appropriate action within 24 hours of receiving a credible report.

MGLion also maintains technical and procedural age verification measures as described in our Terms and Conditions to prevent underage registration at the point of sign-up. These measures are not infallible, which is why MGLion also relies on ongoing account monitoring and KYC verification to identify and remove any accounts opened by persons below the legal age.

12. Changes to This Privacy Policy

MGLion may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements or platform features. When we make material changes — changes that significantly affect how we use or share your personal data — we will notify registered players by posting a prominent notice on the Platform and, where practicable, by sending a notification to your registered contact details.

The updated Privacy Policy will take effect seven days after the date of notification for existing players, and immediately for new registrations completed after that date. If you continue using the Platform after the seven-day notice period, you are considered to have accepted the updated Policy.

We encourage you to review this page periodically. The "Last Updated" date at the top of this document always reflects the date of the most recent revision. If you have concerns about any change before it takes effect, please contact us — we are happy to explain what changed and why.

13. How to Contact MGLion About Privacy

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how MGLion has handled your personal information, please contact us through any of the following channels:

• Email: support@mglion.click — please use "Privacy Request" or "Data Rights" in the subject line for faster routing.
• Live Chat: Available 24/7 at mglion.click — start a chat and mention you have a privacy enquiry.
• Written requests: For formal data access or erasure requests, email is preferred as it creates a clear record of your request and our response.

MGLion commits to acknowledging your privacy-related request within 3 working days and completing the requested action within 30 days. If a request is particularly complex or we have received a high volume of requests simultaneously, we will notify you of the delay and provide an updated timeline. There is no fee for exercising your privacy rights under this Policy.