mdg388 Privacy Policy

1Overview

This Privacy Policy ("Policy") applies to all personal data processed by mdg388 in connection with the platform accessible at mdg388.app, including all game categories (sportsbook, live casino, slots, Andar Bahar, virtual sports), payment services, customer support interactions, and marketing communications. It applies to all Users who access or use the mdg388 platform, regardless of whether they have completed account registration.

mdg388 is committed to processing personal data in a manner that is lawful, fair, and transparent. This Policy is designed to give you a clear and complete picture of our data practices so that you can make informed decisions about your privacy. If you have any questions that this Policy does not address, you are encouraged to contact our Privacy team at any time using the details provided in Section 15.

2Data Controller

For the purposes of applicable data protection law, mdg388 acts as the data controller in respect of all personal data collected through the mdg388 platform. This means that mdg388 determines the purposes for which, and the means by which, your personal data is processed. As data controller, mdg388 bears full responsibility for ensuring that your data is handled in accordance with this Policy and applicable law.

Where third-party service providers — such as payment processors, KYC verification partners, or game technology providers — process your data on our behalf, they do so as data processors operating under binding contractual instructions from mdg388. They are not permitted to use your data for their own independent purposes.

3Personal Data We Collect

mdg388 collects personal data across several categories depending on your level of engagement with the platform. The categories below describe what data we may hold about you and why it is needed:

mdg388 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data, except where a User voluntarily discloses health-related information in the context of a responsible gaming self-exclusion request, in which case such data is processed solely to give effect to that request.

4How We Collect Your Data

mdg388 collects personal data through the following channels:

4.1 Directly from You

The majority of the data we hold is information you provide directly when you register an account, complete KYC verification, initiate a deposit or withdrawal, contact our support team, or opt in to marketing communications. This includes the identity, contact, and financial data categories described in Section 3.

4.2 Automatically During Platform Use

When you access mdg388.app, our systems automatically record certain technical data about your device and browsing behaviour. This includes your IP address, session timestamps, pages visited, features interacted with, and error logs. This data is collected through server logs, analytics tools, and cookies (described further in Section 10).

4.3 From Third Parties

In limited circumstances, mdg388 may receive personal data about you from trusted third parties, including:

• KYC verification partners: identity document verification services that confirm the authenticity of documents you submit during account verification.
• Payment processors: confirmation of successful deposit or withdrawal transactions from banks and e-wallet providers operating in Indonesia.
• Fraud and AML screening services: automated checks against watchlists and sanctions databases to meet our anti-money-laundering obligations.
• Game technology providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may share session data for dispute resolution purposes.

5Purposes of Processing

mdg388 processes your personal data only for specific, defined purposes. The table below maps each processing purpose to the data categories involved:

6Legal Basis for Processing

mdg388 relies on one or more of the following legal bases when processing your personal data:

• Contractual necessity: Processing is necessary to perform the agreement between you and mdg388 — including account management, game delivery, payment processing, and KYC verification. Without this processing, mdg388 cannot provide its services to you.
• Legitimate interests: mdg388 has legitimate interests in operating a secure, fair, and commercially viable platform. This covers fraud detection, AML screening, platform analytics, and responsible gaming monitoring, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: Certain processing is required to comply with applicable law, including anti-money-laundering regulations, record-keeping obligations, and responses to lawful requests from authorities.
• Consent: Where mdg388 sends you marketing communications or places non-essential cookies on your device, we do so only with your prior, freely given, and specific consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7Data Sharing and Disclosure

mdg388 does not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing purposes. Your data is shared only in the circumstances described below, and only to the minimum extent necessary for the relevant purpose:

7.1 Service Providers (Data Processors)

mdg388 engages carefully selected third-party service providers to support platform operations. These include payment processors connected to BCA, BRI, BNI, Mandiri, and Indonesian e-wallet networks; KYC document verification partners; IT infrastructure and hosting providers; game content licensors (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft); customer support tooling providers; and fraud and AML screening services. All such providers are bound by data processing agreements that restrict their use of your data to the specific services they deliver on mdg388's behalf.

7.2 Legal and Regulatory Authorities

mdg388 may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities when required to do so by applicable law, a lawful court order, or where mdg388 reasonably believes disclosure is necessary to prevent fraud, money laundering, or other criminal activity.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of mdg388's business, personal data held by mdg388 may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material change to this Privacy Policy that results from it.

7.4 With Your Consent

mdg388 may share your data with third parties in circumstances beyond those listed above if you have given your explicit, informed consent to that specific sharing arrangement. You may withdraw such consent at any time.

8Data Retention

mdg388 retains personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, to meet AML record-keeping obligations.
• Financial transaction data: Retained for a minimum of five (5) years from the date of each transaction, consistent with financial record-keeping requirements.
• Gaming activity data: Retained for three (3) years following the date of the relevant gaming session, for responsible gaming monitoring and dispute resolution purposes.
• Customer support communications: Retained for two (2) years from the date of the final communication in each support interaction.
• Marketing preference data: Retained until you withdraw consent or for two (2) years of inactivity, whichever occurs first.
• Technical and log data: Retained for up to twelve (12) months for platform security and fraud prevention purposes.

Where mdg388 is required by law to retain data beyond these periods, the data will be archived securely and accessed only for the purpose of meeting that legal obligation. At the end of the applicable retention period, data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

9Security Measures

mdg388 implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your browser or app and the mdg388 platform.
• Encryption at rest for all databases storing sensitive personal and financial data.
• Role-based access controls ensuring that only authorised mdg388 personnel can access personal data, and only to the extent required for their specific role.
• Multi-factor authentication required for all internal system access by mdg388 employees.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Intrusion detection systems that monitor platform traffic in real time for anomalous patterns indicative of unauthorised access attempts.
• Staff training on data protection obligations and secure data-handling procedures, conducted upon onboarding and refreshed annually.

10Cookies & Tracking Technologies

mdg388 uses cookies and similar tracking technologies to operate the platform, improve your experience, and — with your consent — deliver relevant marketing communications. A cookie is a small text file placed on your device by a web server. It allows the platform to recognise your device across multiple sessions without requiring you to log in repeatedly.

10.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for core platform functionality, including maintaining your logged-in session, processing transactions, and enforcing security settings. These cookies cannot be disabled without significantly impairing your ability to use the platform.
• Functional cookies: Remember your preferences such as language settings, notification preferences, and last-visited game categories, so the platform behaves consistently across sessions.
• Analytics cookies: Collect aggregate, anonymised data about how Users interact with mdg388.app — such as which pages are visited most frequently and where Users exit the site — to help us improve platform design and performance.
• Marketing cookies: Placed only with your explicit consent. Used to deliver promotional content relevant to your gaming preferences and to measure the effectiveness of marketing campaigns. No marketing cookies are placed before you provide consent.

10.2 Managing Cookies

You can manage your cookie preferences at any time through your browser settings. Most modern browsers allow you to block all cookies, accept only first-party cookies, or delete cookies stored on your device. Note that disabling strictly necessary cookies may prevent you from accessing certain features of the mdg388 platform. Detailed browser-specific instructions for managing cookies are available via the "Help" section of your browser.

11Your Privacy Rights

As a User of the mdg388 platform, you hold the following rights with respect to your personal data. mdg388 is committed to honouring these rights promptly and without unnecessary obstacles:

• Right of access: You have the right to request a copy of the personal data mdg388 holds about you, along with information about how it is being processed. We will provide this within 30 days of a verified request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
• Right to erasure ("right to be forgotten"): You may request that mdg388 delete your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where you object to processing and there are no overriding legitimate grounds. Note that erasure requests may be declined where retention is required by law (e.g., AML record-keeping obligations).
• Right to restriction of processing: You may request that mdg388 suspend the processing of your data in certain circumstances — for example, while the accuracy of data is being contested or while an objection is being assessed.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request that your personal data be provided to you in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on mdg388's legitimate interests. mdg388 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for marketing communications, use the unsubscribe link in any marketing email or contact support directly.

12Minors

The mdg388 platform is strictly intended for adults aged 21 and above. mdg388 does not knowingly collect or process personal data belonging to any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC process, and mdg388 employs automated screening tools as well as manual review to detect and prevent underage registration.

If mdg388 becomes aware — through any channel — that personal data has been collected from a person under 21, the relevant account will be immediately suspended, the data will be reviewed, and, following the resolution of any compliance obligations, the data will be permanently deleted. If you believe that a minor has registered on mdg388, please notify us immediately at [email protected].

13International Data Transfers

mdg388 operates an internationally distributed technology infrastructure. As a result, your personal data may be transferred to, stored in, or processed in countries other than Indonesia. This may occur, for example, when game content is served by a provider's servers located outside Indonesia, or when our cloud hosting infrastructure processes data across multiple geographic regions.

Whenever personal data is transferred outside Indonesia, mdg388 takes steps to ensure that an adequate level of protection is applied. These steps include entering into standard contractual clauses with the receiving entity, verifying that the destination country provides a level of data protection substantially equivalent to that required by applicable Indonesian data protection principles, or relying on other legally recognised transfer mechanisms.

If you would like further information about the specific safeguards applied to any particular international transfer of your data, please contact us at [email protected].

14Amendments to This Policy

mdg388 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, mdg388 will notify registered Users by email and by displaying a prominent notice on the platform for a reasonable period prior to the revised Policy taking effect.

The "Last Updated" date at the top of this page indicates when the most recent revision was made. We encourage you to review this Policy periodically to stay informed about how mdg388 protects your data. Continued use of the mdg388 platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

15Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to mdg388's data practices, please reach out through any of the following channels. All privacy-related enquiries are handled by mdg388's dedicated Privacy team:

• Email: [email protected] — use subject line "Privacy Enquiry" for fastest routing
• WhatsApp: +62 811 0388 388 (plain text — not a clickable link)
• Live Chat: Available daily from 09:00 to 24:00 WIB via the support widget on the platform

mdg388 aims to acknowledge all privacy-related enquiries within 24 hours and to provide a substantive response within five (5) business days. For complex requests — such as subject access requests requiring data compilation across multiple systems — we will notify you if additional time is required, and in all cases will respond within 30 days.