Privacy Policy — md888

Clause 1 Data Controller

md888 is the data controller responsible for the personal information collected through the md888 Platform at https://md888.vu. As data controller, md888 determines the purposes and means by which your personal data is processed. All inquiries regarding this Privacy Policy, your personal data, or the exercise of your data rights should be directed to our Data Protection contact at [email protected].

md888 operates under an internationally recognized gaming license and is committed to handling all personal data in a manner consistent with globally accepted data protection principles, including purpose limitation, data minimization, storage limitation, integrity, and confidentiality.

Clause 2 Data We Collect

md888 collects several categories of personal data in the course of operating the Platform and delivering its Gaming Services to players in Indonesia. The categories of data we may collect are set out in the table below:

Clause 3 How We Collect Your Data

md888 collects personal data through the following channels and mechanisms:

3.1 Direct Collection

You provide data directly to md888 when you complete the account registration form, submit identity documents for KYC verification, make a deposit or withdrawal request, contact our customer support team via live chat or email, opt in to marketing communications, or configure your account's responsible gaming settings. All data you provide directly is submitted voluntarily, but certain data (such as identity and financial data) is required for us to deliver our Gaming Services to you lawfully.

3.2 Automated Collection

When you access and use the md888 Platform, we automatically collect technical data about your device, browser, network connection, and interaction patterns through server-side logging, session cookies, and analytics instrumentation. This automated collection is essential to the secure and stable operation of the Platform and cannot be disabled without preventing access to core services.

3.3 Third-Party Sources

md888 may receive personal data about you from trusted third-party sources in limited circumstances, including: identity verification bureaus (for KYC document authentication), payment processors and Indonesian banks (for transaction confirmation and fraud screening), and licensed game content providers (for game session data associated with your account). All third-party data sources used by md888 are contractually obligated to share data only for the specified purpose and in compliance with applicable data protection standards.

Clause 4 Legal Basis for Processing

md888 processes your personal data only where a valid legal basis exists. The legal bases we rely upon are as follows:

• Contractual Necessity: Processing that is required to register your account, process your deposits and withdrawals, deliver Gaming Services, and manage your player relationship with md888 is carried out because it is necessary to perform our contract with you.
• Legal Obligation: Processing required to comply with our KYC, anti-money laundering (AML), and responsible gaming obligations under our international gaming license is carried out because we are legally required to do so.
• Legitimate Interests: Processing for fraud detection, platform security, abuse prevention, and service improvement is carried out on the basis of md888's legitimate interest in operating a safe, secure, and commercially sustainable platform — provided that interest is not overridden by your rights.
• Consent: Processing for marketing communications (promotional emails, bonus notifications, seasonal offers such as Idul Fitri and Imlek campaigns) is carried out on the basis of your freely given, specific, and informed consent. You may withdraw your marketing consent at any time via your account settings or by emailing [email protected].

Clause 5 How We Use Your Data

md888 uses the personal data it collects for the following specific purposes:

5.1 Account Management

Your identity and contact data are used to create and maintain your md888 account, verify your identity and age (21+), authenticate your login sessions, and communicate account-related information such as transaction confirmations, security alerts, and policy updates.

5.2 Payment Processing

Your financial data is used exclusively to process deposit and withdrawal transactions through your chosen Indonesian payment method (BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, GoPay, DANA, ShopeePay, or LinkAja), verify that payment methods are registered in your name, and comply with financial crime prevention obligations. md888 does not store full bank account credentials on its own servers; payment data is processed through PCI-DSS-compliant third-party payment gateways.

5.3 KYC and Compliance

md888 is required under its international gaming license to conduct thorough identity verification on all account holders. Your identity documents and financial records are used to confirm your identity, verify your age, screen your name against international sanctions and politically exposed persons (PEP) lists, and report suspicious financial activity to the appropriate regulatory authorities where required by law.

5.4 Responsible Gaming

Your gaming activity data — including session length, deposit frequency, wager volume, and game selection patterns — is monitored by our responsible gaming systems to identify indicators of potentially problematic play behavior. Where our systems detect such patterns, our team may proactively contact you with information about responsible gaming tools, or apply mandatory protective measures in accordance with our responsible gaming policy. For full details, see our Responsible Gaming page.

5.5 Marketing Communications

Where you have provided consent, we use your contact data and preference data to send you promotional offers, bonus notifications, and seasonal campaign communications relevant to Indonesian players (including promotions tied to Idul Fitri, Ramadhan, and other cultural events). You may opt out of marketing communications at any time without affecting your access to the Platform's Gaming Services.

5.6 Platform Security and Fraud Prevention

Technical data collected during your sessions is used to detect and prevent unauthorized account access, identify and block fraudulent or abusive behavior, and maintain the integrity of our gaming systems. md888 employs automated fraud detection systems that analyze login patterns, device fingerprints, and transaction behavior in real time.

5.7 Customer Support

Support data collected during your interactions with our customer service team is used to resolve your queries, investigate disputes, and continuously improve the quality of our support services. All live chat transcripts and email records related to your account are retained for a minimum period in accordance with our data retention policy described in Clause 7.

Clause 6 Data Sharing & Disclosure

md888 does not sell, rent, or commercially share your personal data with third-party advertisers or data brokers under any circumstances. Your personal data is shared only in the following limited and controlled situations:

6.1 Service Providers

md888 engages a carefully selected group of third-party service providers who process personal data on our behalf, including: KYC and identity verification providers, payment gateway operators (covering BCA, BRI, BNI, and Indonesian e-wallet networks), cloud infrastructure and hosting providers, customer support platform operators, and fraud detection and AML screening services. All service providers are bound by data processing agreements that restrict use of your data to the specific purpose for which it was shared.

6.2 Game Content Providers

Licensed game content studios (including Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft) receive the minimum account data necessary to deliver their game content to your session and record game outcomes against your account. These providers operate under strict data processing agreements consistent with md888's privacy standards.

6.3 Legal and Regulatory Disclosure

md888 may disclose your personal data to law enforcement agencies, regulatory bodies, or government authorities where required to do so by applicable law, a valid court order, or our licensing obligations — including AML reporting obligations under our international gaming license. In such cases, md888 will disclose only the minimum data required to fulfill the legal obligation and will, where legally permitted, notify you of such a disclosure.

6.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or corporate restructuring affecting md888, your personal data may be transferred to the acquiring entity as part of that transaction. md888 will provide advance notice of any such transfer via the email address on your account and will ensure that the recipient entity is bound by privacy commitments consistent with this Privacy Policy.

Clause 7 Data Retention

md888 retains personal data for the minimum period necessary to fulfill the purpose for which it was collected, after which it is securely deleted or anonymized. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is permanently deleted from all active systems and purged from backup storage in the next scheduled backup rotation cycle. Where deletion is not technically feasible, the data is irreversibly anonymized so that it can no longer be attributed to any individual.

Clause 8 Security Measures

md888 implements a comprehensive, layered security framework to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Key technical and organizational security measures in place include:

• Transport Layer Security (TLS 1.3): All data in transit between your device and md888 servers is encrypted using TLS 1.3, the current industry gold standard for web encryption.
• AES-256 Encryption at Rest: All personal data stored on md888 servers is encrypted at rest using AES-256, ensuring that even in the event of unauthorized physical access to storage media, the data remains unreadable.
• Multi-Factor Authentication (MFA): Players are encouraged — and staff members are required — to enable multi-factor authentication on their accounts. MFA significantly reduces the risk of unauthorized access resulting from compromised credentials.
• Role-Based Access Control (RBAC): Access to systems containing personal data is restricted to authorized md888 personnel on a strictly need-to-know basis. All access events are logged and subject to periodic audit review.
• Penetration Testing: md888 engages independent cybersecurity firms to conduct regular penetration tests and vulnerability assessments of the Platform's infrastructure. Critical findings are remediated within defined SLA timeframes.
• Incident Response Plan: md888 maintains a documented data breach incident response plan. In the event of a confirmed breach, our response team is activated within one hour, and affected players are notified within 72 hours in accordance with this Privacy Policy.

While md888 applies rigorous security controls, no digital platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying md888 immediately if you suspect unauthorized access to your account.

Clause 9 Cookies & Tracking Technologies

The md888 Platform uses cookies and similar tracking technologies to ensure the Platform functions correctly, to remember your preferences, to maintain your authenticated session, and to analyze usage patterns for the purpose of improving the user experience.

9.1 Types of Cookies Used

• Strictly Necessary Cookies: These cookies are essential to the operation of the Platform. They maintain your login session, remember your responsible gaming settings, and ensure secure payment flows. These cookies cannot be disabled without preventing access to core Platform features.
• Functional Cookies: These cookies remember your preferences (such as your preferred language setting and time zone — WIB by default) to improve your experience on return visits. They are not required for core functionality but enhance usability.
• Analytics Cookies: md888 uses privacy-focused analytics tools to understand aggregate usage patterns, such as which game categories are most popular or where users commonly encounter navigation difficulties. These cookies do not collect personally identifiable information and are used solely to improve the Platform.
• Security Cookies: These cookies support our fraud detection and bot-prevention systems, helping to distinguish genuine player sessions from automated or malicious traffic.

9.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use the Platform's Gaming Services. For detailed guidance on managing cookies in your specific browser, refer to your browser's help documentation.

Clause 10 Your Data Rights

As a player on the md888 Platform, you have the following rights over your personal data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request". md888 will respond to all verified requests within 30 days.

10.1 Right of Access

You have the right to request a copy of all personal data that md888 holds about you. We will provide this in a structured, commonly used, machine-readable format (such as CSV or JSON) upon receipt of a verified identity confirmation from you.

10.2 Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. For data that you can edit yourself via your account dashboard (such as contact preferences), we encourage you to update it directly rather than submitting a formal rights request.

10.3 Right to Erasure

You may request deletion of your personal data in certain circumstances — for example, if your account has been closed and the applicable retention period under Clause 7 has expired, or if the data was collected without a valid legal basis. Please note that md888 may be required to retain certain data (such as KYC and financial transaction records) for defined periods under its AML and licensing obligations, even after an erasure request is received. In such cases, md888 will explain the specific retention obligation and delete the data as soon as the obligation expires.

10.4 Right to Restrict Processing

You have the right to request that md888 restricts its processing of your personal data in specific circumstances — for instance, while you contest the accuracy of data we hold, or while a legitimate interests balancing assessment is pending. During a restriction period, md888 will continue to store your data but will not actively process it beyond what is necessary for storage.

10.5 Right to Data Portability

Where md888 processes your data on the basis of contract or consent, and that processing is carried out by automated means, you have the right to receive your personal data in a portable format and to request that we transmit it directly to another data controller where technically feasible.

10.6 Right to Object

You have the right to object to md888's processing of your personal data where that processing is based on legitimate interests (see Clause 4). You also have an unconditional right to object to the processing of your data for direct marketing purposes at any time, which will be honored without requiring justification.

10.7 Right to Withdraw Consent

Where md888 processes your personal data on the basis of your consent (principally for marketing communications), you may withdraw that consent at any time via your account settings or by emailing our support team. Withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal.

Clause 11 Minors & Age Restriction

The md888 Platform is strictly intended for adults who are at least 21 years of age. md888 does not knowingly collect personal data from individuals under 21. If md888 becomes aware that a minor has registered an account or provided personal data, the account will be immediately suspended, all personal data associated with the account will be securely deleted, and any deposited funds will be returned to the originating payment method following identity verification of the account holder.

Parents and guardians who believe that a minor in their care has registered an account on md888 are urged to contact our support team immediately at [email protected]. md888 takes underage gambling prevention extremely seriously and cooperates fully with parental controls and third-party age verification services.

Clause 12 International Data Transfers

md888 may transfer your personal data to third-party service providers whose infrastructure is located outside of Indonesia. Such transfers occur only when necessary to deliver the Platform's services (for example, using international cloud infrastructure or routing payments through a global payment gateway network). In all cases, md888 ensures that an appropriate level of data protection is in place before any international transfer occurs, through one or more of the following safeguards:

• Contractual data processing agreements incorporating internationally recognized standard contractual clauses for data transfers.
• Transfer only to jurisdictions or service providers that maintain data protection standards equivalent to or exceeding those described in this Privacy Policy.
• Technical controls such as end-to-end encryption that ensure data remains protected regardless of the jurisdiction in which it is processed or stored.

Clause 13 Changes to This Privacy Policy

md888 reviews this Privacy Policy periodically and will update it whenever required to reflect changes in our data practices, technology, legal obligations, or regulatory guidance. When material changes are made, md888 will notify registered players via the email address on file and post a prominent notice on the Platform homepage, with a minimum of seven (7) days' advance notice before the revised Policy takes effect.

The "Effective Date" shown at the top of this document indicates when the current version came into force. Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. We recommend saving or printing a copy of this document for your personal records.

Clause 14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by md888, please contact our Data Protection team through the following channel:

• Email: [email protected]
• Subject Line: Please use "Privacy Policy Inquiry" or "Data Rights Request" for faster routing to our dedicated data protection team.
• Response Time: General privacy inquiries are responded to within 2 business hours. Formal data rights requests receive a substantive response within 30 calendar days.
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays. Our agents are fluent in both Indonesian and English.