Privacy Policy

mdg888, operating the online gaming platform accessible at https://mdg888.app, acts as the data controller in respect of all personal data collected from Members and visitors to the Platform. As data controller, mdg888 determines the purposes for which, and the means by which, personal data is processed.

This Privacy Policy applies to all personal data collected through:

• The mdg888 website and all subdomains associated with mdg888.app
• The mdg888 account registration, login, and KYC verification processes
• All game verticals on the Platform, including the sportsbook, live casino, slots, togel (Indonesia's traditional numbers lottery), Domino QQ, and roulette
• Customer support interactions, including live chat sessions and email correspondence
• Promotional and bonus programme participation

If you have any questions about the identity of the data controller or wish to exercise your data rights, please refer to Section 14 (Contact & DPO) of this Policy.

mdg888 collects only the personal data that is necessary for the legitimate operation of the Platform, fulfilment of legal obligations, and delivery of a secure, personalised gaming experience. The categories of data we collect are set out in the table below.

mdg888 collects personal data through the following channels and mechanisms:

• Direct Submission: Data you provide voluntarily when you register an account, complete KYC verification, make a deposit or withdrawal, participate in a promotion, or contact our support team.
• Automated Technical Collection: Data collected automatically when you access or use the Platform, including IP address, device identifiers, browser characteristics, and session activity logs, collected via cookies, server logs, and similar tracking technologies (see Section 7).
• Payment Processors: Transaction confirmation data received from third-party payment processors handling deposits and withdrawals through supported Indonesian bank transfer and e-wallet channels. mdg888 does not receive or store full bank account credentials — only the identifiers necessary to process transactions.
• Identity Verification Partners: Where mdg888 uses a third-party KYC verification service to validate identity documents, that partner may share verification status and extracted data fields with mdg888 for account approval purposes.
• Third-Party Game Providers: Game session outcome data and stake amounts from Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft are transmitted to mdg888 servers to settle your wallet balance and maintain your account activity record.
• Public Sources: In limited circumstances related to fraud prevention or AML compliance, mdg888 may cross-reference data against publicly available records or licensed third-party data services.

mdg888 processes personal data for the following clearly defined purposes. We do not use personal data for any purpose not listed here without first obtaining your explicit consent or providing advance notice.

• Account Management: Creating, maintaining, and operating your mdg888 account, including processing deposits and withdrawals in IDR and updating your account settings.
• Identity & Age Verification: Confirming that you meet the 21+ age requirement and that your identity matches the details provided at registration, as required before withdrawal processing is enabled.
• Transaction Processing: Executing and recording all financial transactions on the Platform, including deposits via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, and outbound withdrawals to your registered payment method.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent account activity, unauthorised access, money laundering, collusion, and other prohibited conduct described in the Terms & Conditions.
• Regulatory & Legal Compliance: Fulfilling mdg888's obligations under applicable anti-money laundering (AML) regulations, including record-keeping requirements for financial transactions.
• Responsible Gaming: Monitoring behavioural data to identify patterns consistent with problem gambling and to power the responsible gaming tools available in your account dashboard — including deposit limits, session reminders, and self-exclusion.
• Customer Support: Responding to your inquiries, resolving account issues, and maintaining records of support interactions for quality assurance and dispute resolution.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, design, and game offering of the mdg888 Platform.
• Marketing Communications: Sending you promotional offers, bonus notifications, and seasonal promotions (such as Idul Fitri and Ramadhan special offers) by email or push notification — only where you have opted in to receive such communications and only for mdg888's own products and services.

For each category of personal data processing described in Section 4, mdg888 relies on one or more of the following lawful bases:

• Contractual Necessity: Processing that is necessary to perform the contract between you and mdg888 — i.e., operating your account, processing transactions, and delivering the gaming services you have registered to use.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML record-keeping, age verification requirements, and any direction from a competent regulatory or law enforcement authority.
• Legitimate Interests: Processing that serves mdg888's legitimate business interests and is not overridden by your rights and interests — including fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics.
• Consent: Processing for purposes where consent is required by applicable law — principally the sending of direct marketing communications. Where mdg888 relies on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

mdg888 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Data is shared only in the specific circumstances described below, and only to the extent necessary for the stated purpose.

• Payment Processors: Financial data is shared with the third-party processors handling your selected payment method (bank transfer networks for BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata; and e-wallet providers OVO, DANA, GoPay, ShopeePay, LinkAja) to execute deposits and withdrawals.
• KYC & Identity Verification Providers: Identity documents and verification data are shared with licensed KYC partners solely for the purpose of completing identity and age verification. These partners are contractually prohibited from using your data for any other purpose.
• Game Software Providers: Game session data is exchanged with integrated game providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft) to the extent technically necessary to deliver game content and settle outcomes.
• Fraud Prevention & AML Services: Technical and behavioural data may be shared with fraud detection and anti-money laundering screening partners to identify and prevent financial crime on the Platform.
• Legal & Regulatory Authorities: mdg888 will disclose personal data to law enforcement, regulators, or courts when legally compelled to do so, or where disclosure is necessary to protect the rights, property, or safety of mdg888, its Members, or the public.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of mdg888's assets, personal data held by mdg888 may be transferred to the successor entity, subject to the same data protection obligations as set out in this Policy.

International Transfers: Some of mdg888's third-party service providers operate outside Indonesia. Where personal data is transferred internationally, mdg888 ensures that appropriate safeguards are in place — including contractual data protection clauses — to maintain a level of protection equivalent to that described in this Policy.

mdg888 uses cookies and similar tracking technologies (including browser local storage and session storage) to operate and improve the Platform. The following types of cookies are used:

Managing Cookies: You can control optional cookies through your browser settings or the cookie preference centre in your mdg888 account settings. Disabling strictly necessary or security cookies will impair the functionality of the Platform and may prevent you from logging in or placing wagers.

Most browsers provide options to view, delete, and block cookies. Instructions vary by browser; consult your browser's help documentation for guidance. Note that blocking all cookies will affect your experience across many websites, not just mdg888.

mdg888 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, as described in this Policy, and to comply with applicable legal and regulatory obligations. The following retention periods apply:

• Account & Transaction Records: Retained for a minimum of 5 years from the date of the transaction or the date of account closure (whichever is later), in compliance with AML record-keeping obligations.
• KYC Documentation: Identity documents and verification records are retained for a minimum of 5 years from account closure. Where a longer retention period is required by applicable regulation or law enforcement direction, the longer period applies.
• Support Communications: Live chat transcripts and email correspondence are retained for 2 years from the date of the interaction, unless the communication relates to an unresolved dispute — in which case records are retained until the dispute is fully resolved plus 1 year.
• Marketing Preferences & Consent Records: Opt-in consent records for marketing communications are retained for the duration of the Member's active relationship with mdg888, plus 2 years following account closure.
• Inactive / Closed Accounts: For accounts closed voluntarily by the Member, data is anonymised or deleted after the applicable retention periods described above have elapsed. For accounts closed due to fraud or prohibited conduct, data may be retained indefinitely to support any legal proceedings or regulatory investigations.
• Technical & Behavioural Logs: Server access logs, IP address logs, and raw session data are retained for 12 months before being permanently deleted or anonymised for statistical purposes.

When personal data is no longer required, mdg888 ensures it is securely deleted or irreversibly anonymised so that it can no longer be attributed to an individual.

As a data subject whose personal information is processed by mdg888, you hold the following rights. These rights may be subject to limitations where compliance would interfere with mdg888's legal obligations or legitimate interests in fraud prevention and AML compliance.

How to Exercise Your Rights: Submit your request in writing to our support team via live chat or by email (see Section 14). We will verify your identity before processing any data rights request to protect against unauthorised requests. Most requests will be fulfilled within 30 calendar days; complex requests may take up to 60 days, and we will notify you if an extension is required.

Complaints: If you believe mdg888 has not handled your personal data in accordance with this Policy, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. We encourage you to contact us first so that we can address your concern directly.

The mdg888 Platform is strictly intended for adults aged 21 and over. mdg888 does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step in the account registration process, and KYC checks are required before any withdrawal can be processed.

If mdg888 discovers or is notified that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, void any balance, and permanently delete all associated personal data from our systems without delay.

mdg888 implements a comprehensive, layered approach to information security designed to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security programme includes, but is not limited to, the following measures:

• SSL 256-Bit Encryption: All data transmitted between your browser or device and the mdg888 Platform is encrypted using SSL/TLS 256-bit encryption, the same standard used by major international financial institutions.
• Password Hashing: Account passwords are stored exclusively as salted cryptographic hashes — mdg888 has no access to your plain-text password and will never ask for it.
• Two-Factor Authentication (2FA): Members are strongly encouraged to enable 2FA on their accounts via the security settings dashboard. 2FA adds a second layer of protection against unauthorised login even if credentials are compromised.
• Access Controls: Access to personal data within mdg888's internal systems is restricted on a strict need-to-know basis. Only authorised personnel with a documented business reason may access personal data, and all access is logged and audited.
• Data Minimisation: mdg888 collects and retains only the minimum personal data necessary for each processing purpose, reducing the potential impact of any security incident.
• Incident Response: mdg888 maintains a documented incident response plan. In the event of a personal data breach that poses a risk to Members, affected individuals will be notified promptly, and the relevant supervisory authority will be informed as required.
• Secure Data Centre Infrastructure: All mdg888 data is hosted in secure data centres with physical access controls, redundant power, and geographically distributed backups to protect against data loss.

While mdg888 employs robust security measures, no online platform can guarantee absolute security. You also have a role to play in protecting your account — please review Section 4 (Account Security) of our Terms & Conditions for your responsibilities as a Member.

The mdg888 Platform integrates third-party game content from providers including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft. These providers deliver game software directly within the Platform environment. Their collection and use of technical data necessary to render game content is governed by their respective privacy policies.

mdg888 exercises due diligence in selecting third-party service partners and requires all partners to maintain appropriate data protection standards consistent with the protections described in this Policy. All third-party data processors used by mdg888 are engaged under formal data processing agreements that restrict their use of your data to the purposes mdg888 has authorised.

The mdg888 Platform does not contain links to external third-party websites. Should any external link be included in a particular context (such as a responsible gaming resource), that external site's own privacy policy will govern data collected on that site. mdg888 is not responsible for the privacy practices of any external sites.

mdg888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. The "Last updated" date at the top of this page will be revised to reflect the most recent amendment.

Where a proposed amendment materially changes the way in which we process your personal data, or materially affects your rights as a data subject, mdg888 will notify you by email to your registered address at least 14 days before the amendment takes effect. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy.

We encourage you to review this Privacy Policy periodically. The current version is always accessible at https://mdg888.app/privacy-policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by mdg888, please contact our support team through the following channels:

• Live Chat: Available daily 08:00 – 24:00 WIB via the support widget within your logged-in mdg888 account. This is the fastest route for urgent account-related privacy matters.
• Email: For written privacy requests, data subject rights submissions, or formal complaints, write to us at [email protected] — please copy this address manually; it is not a clickable link.

When submitting a data rights request by email, please include your registered username, a brief description of your request, and a copy of a government-issued ID so that we can verify your identity before processing the request. We will acknowledge receipt within 3 business days and aim to resolve all requests within 30 calendar days.