Privacy Policy
What personal data we handle, in which role, and on what basis. We act as a processor for operator data and as a controller only for our own business contacts.
This document is a working draft. Each clause below states the commitment we intend to make; the binding wording will be settled with counsel before any agreement is signed.
- 01
Two different roles
For player data inside an operator’s environment we are a processor acting on their instructions. For people who contact us about buying the platform, we are the controller. The rest of this policy is separated on that basis.
- 02
Player data we process for operators
Account identifiers, verification decisions, financial transactions and gameplay records — held inside the operator’s own isolated environment and never pooled across customers.
- 03
Identity documents
Verification documents are held encrypted in a sealed vault, scoped to the operator’s environment. Access by our staff requires two named approvers and is recorded.
- 04
Business contact data we control
Name, company, contact details and what we discussed, so we can answer you and keep a record of the commercial relationship.
- 05
Why we can process it
For operator data, the operator’s instructions under the processing terms. For our business contacts, our legitimate interest in responding to enquiries and running the relationship.
- 06
Who else sees it
Sub-processors we name in the processing terms, each under equivalent obligations. We will tell you before we add or change one.
- 07
Where it is held
In the region agreed for the operator’s environment. Data residency is a per-environment setting rather than a global default.
- 08
How long we keep it
Financial records for the period the operator’s regulator requires; everything else on the retention schedule in the processing terms. Deletion is recorded, and a legal hold suspends it with a receipt.
- 09
Rights of individuals
Access, correction, erasure and portability. For player data these are exercised through the operator, and the platform is built to carry the request through every module.
- 10
Security
Isolation per licensed entity, encryption in transit and at rest, dual control on privileged access, and an append-only audit of who did what.
- 11
Breach notification
Our commitment on how quickly we tell an affected operator, and what we will tell them.
- 12
Contact
Reach the privacy contact at privacy@marsolab.com.
Draft — not legal advice and not yet reviewed by counsel. Do not rely on this text.