Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how mdg168 ("we," "us," "our," or "the Platform") collects, uses, stores, discloses, and protects the personal information of users ("you," "your," or "User") who access and use the mdg168 website and all associated services (collectively, the "Service"). mdg168 is committed to respecting your privacy and protecting your personal data in accordance with applicable data protection laws and internationally recognized privacy standards.

By registering for an account, accessing the Service, or otherwise interacting with mdg168, you consent to the data practices described in this Policy. This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gaming Policy. If you do not agree with any part of this Policy, please discontinue use of the Service and close your account.

2. Data We Collect

mdg168 collects personal data only to the extent necessary to provide the Service, comply with legal obligations, and protect the integrity of our platform. The categories of personal data we collect are as follows:

2.1 Data You Provide Directly

• Account Registration Data: Full legal name, date of birth, gender, email address, mobile phone number, residential address (including city, province, and postal code), username, and password.
• Identity Verification (KYC) Data: National identity card number (KTP), passport number, photographs of government-issued identity documents, selfie photographs for liveness verification, and proof of address documents (utility bills, bank statements).
• Payment Data: Bank account details (bank name, account number, account holder name — e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction history. We do not store full credit or debit card numbers; where card payments are processed, they are handled by PCI-DSS-compliant payment processors.
• Communications Data: Records of communications you send us via live chat, email, WhatsApp, or in-app messaging, including the content of those communications, timestamps, and your account details at the time of contact.
• Support and Dispute Data: Information provided when raising a support ticket, dispute, or complaint, including screenshots, betting records, and transaction references.

2.2 Data We Collect Automatically

• Technical Data: IP address, browser type and version, operating system, device type (mobile, desktop, tablet), device identifier, screen resolution, and time zone.
• Usage Data: Pages visited, time spent on each page, betting patterns, game selections, session duration, deposit and withdrawal frequency, and feature interactions.
• Location Data: Approximate geographic location derived from your IP address, used to verify eligibility and apply geographically appropriate settings.
• Cookie Data: Data collected via cookies and similar tracking technologies, described in detail in Section 6 of this Policy.

2.3 Data from Third Parties

• Identity Verification Partners: Where we use third-party identity verification services, we may receive data confirming or supplementing the KYC information you provide.
• Payment Processors: We receive confirmation of successful payment transactions from our banking and e-wallet partners, including transaction reference numbers and status codes.
• Anti-Fraud Services: We may receive risk-scoring and fraud-detection signals from third-party services that help us identify potentially fraudulent account activity.

3. How We Use Your Data

mdg168 uses the personal data we collect for the following purposes:

4. Legal Basis for Processing

mdg168 processes personal data only where a valid legal basis exists. The principal legal bases we rely on are:

• Contract Performance: Processing is necessary to fulfill our contractual obligations to you as a registered user — including account management, bet settlement, deposit processing, and withdrawal payment.
• Legal Obligation: We process certain data (particularly KYC and transaction records) to comply with Indonesian and international anti-money laundering, counter-terrorist financing, and responsible gaming regulatory requirements.
• Legitimate Interests: We process certain data (particularly technical and usage data) for fraud prevention, platform security, and service improvement purposes, where these interests are not overridden by your privacy rights.
• Consent: For marketing communications (email newsletters, promotional SMS), we rely on your explicit consent, which you may withdraw at any time by contacting us at [email protected].

5. Data Sharing and Disclosure

mdg168 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Service Providers: Banks (BCA, BRI, BNI, Mandiri, CIMB Niaga) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum data necessary to process your transactions.
• Identity Verification Partners: Third-party KYC verification providers receive your identity document data to perform automated and manual verification checks.
• Game Content Providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, and Pocket Games Soft may receive your account identifier and session data to deliver game content and calculate results, but do not receive your full personal profile.
• Technology and Infrastructure Providers: Cloud hosting, CDN, and cybersecurity service providers process technical data to operate and protect the platform. All such providers are bound by data processing agreements with security and confidentiality obligations consistent with this Policy.
• Regulatory and Law Enforcement Authorities: We will disclose personal data to competent authorities when required by law, court order, or legitimate legal process, or to protect the rights, property, or safety of mdg168, its users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of mdg168's assets, your data may be transferred to the successor entity, subject to confidentiality obligations and consistent with the protections in this Policy.

6. Cookies and Tracking Technologies

mdg168 uses cookies and similar tracking technologies (collectively, "Cookies") to operate and improve the Service. A cookie is a small text file stored on your device by your browser when you visit a website. The categories of Cookies we use are:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies, load-balancing cookies, and security tokens. You cannot disable these without impairing your ability to use the Service.
• Functional Cookies: Remember your preferences such as language settings, time-zone configuration (defaulting to WIB, UTC+7), and display preferences to provide a personalized experience.
• Analytics Cookies: Collect aggregated, anonymized data on how users interact with the platform — which pages are visited most, how long sessions last, and where users navigate from. This data helps us identify usability issues and optimize the platform.
• Marketing Cookies: Used, only with your consent, to track the effectiveness of promotional campaigns and personalize promotional offers based on your betting history and preferences.

You can manage cookie preferences through your browser settings. Blocking certain cookies may affect the functionality of the Service. For a full list of Cookies used and their retention periods, please contact [email protected].

7. Data Retention

mdg168 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected or as required by applicable law:

• Account and Transaction Records: Retained for a minimum of five (5) years from the date of your last transaction or account closure, in compliance with anti-money laundering regulations.
• KYC Documents: Retained for a minimum of five (5) years following account closure or the completion of the customer relationship, whichever is later.
• Communications Records: Customer support interactions retained for three (3) years, or longer if the communication relates to an unresolved dispute.
• Technical and Usage Data: Retained in identifiable form for up to twelve (12) months; subsequently anonymized and retained indefinitely for aggregated analytics.
• Marketing Data: Retained until you withdraw consent or for two (2) years of inactivity, whichever comes first.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our data destruction procedures.

8. Security Measures

mdg168 takes the security of your personal data seriously and has implemented a comprehensive suite of technical and organizational security measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and mdg168's servers is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Data Encryption at Rest: Sensitive personal data stored in our databases — including payment credentials and identity document scans — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis, with role-based access controls and multi-factor authentication required for all staff who handle personal data.
• Intrusion Detection: Real-time intrusion detection systems and automated anomaly-detection tools monitor our infrastructure for suspicious activity around the clock.
• Regular Security Audits: mdg168 undergoes periodic independent security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: All staff members who handle personal data receive regular data protection and cybersecurity training.

While we apply robust security measures, no method of electronic transmission or storage is 100% secure. In the unlikely event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant authorities in accordance with applicable law.

9. Your Privacy Rights

As a user of mdg168, you have the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to [email protected] with the subject line "Privacy Rights Request" and include your registered username and the specific right you wish to exercise.

10. Children's Privacy

mdg168 is strictly an adult platform. You must be at least 21 years of age to register for and use the Service. We do not knowingly collect personal data from individuals under the age of 21. If you are a parent or guardian and believe that a minor has registered an account with mdg168, please contact us immediately at [email protected]. We will investigate and, where confirmed, close the minor's account and delete all associated personal data without delay.

Our KYC verification process is specifically designed to verify age and prevent underage access. Any account that fails age verification will be suspended immediately, and any funds deposited by an underage user will be returned to the payment source.

11. International Data Transfers

mdg168 operates internationally, and your personal data may be transferred to, stored in, and processed in countries other than Indonesia. This may occur, for example, when data is processed by our cloud infrastructure providers or game content partners located in other jurisdictions. Where such transfers occur, mdg168 takes steps to ensure that your data receives an equivalent level of protection to that which it receives in Indonesia, including through the use of contractual safeguards (standard contractual clauses), data processing agreements, and ensuring that recipient countries have adequate data protection standards in place.

12. Third-Party Services and Links

The Service may display references or content related to third-party game providers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) and payment partners. These third parties operate their own privacy policies and data handling practices, which are independent of mdg168's Policy. mdg168 is not responsible for the privacy practices of third-party providers. We encourage you to review the privacy policies of any third-party services you interact with through the platform.

13. Changes to This Privacy Policy

mdg168 reserves the right to update or modify this Privacy Policy at any time. When we make material changes, we will notify registered users by email (to the address on file) or by posting a prominent notice on the platform at least 14 days before the changes take effect. The "Last Updated" date at the top of this Policy will be revised to reflect the date of the most recent change. Your continued use of the Service after the effective date of any changes constitutes acceptance of the revised Policy. If you do not agree with the changes, you must discontinue use of the Service and request account closure before the changes take effect.

14. Contact Us and Data Controller Details

If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact our Privacy team:

• Email: [email protected]
• Subject Line: Privacy Policy Inquiry / Data Rights Request
• Live Chat: Available 24/7 via your Account dashboard
• Response Time: We aim to respond to all privacy inquiries within 5 business days, and to all formal data rights requests within 30 calendar days.

We take privacy complaints seriously. If you are unsatisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

By continuing to use mdg168, you confirm that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein. This Policy forms part of the mdg168 Terms & Conditions.