Privacy Policy

mdg168 (accessible at https://mdg168.pro) is an online casino and sportsbook platform operated by the Company as defined in our Terms & Conditions. The Company acts as the data controller for all personal information collected through the mdg168 platform, its sub-domains, and any associated mobile interfaces.

As a platform primarily serving players based in Indonesia — including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and beyond — mdg168 recognises its responsibility to handle personal data with care, transparency, and in a manner consistent with international best practices for data protection. This Privacy Policy governs all data processing activities undertaken by mdg168 in connection with the provision of its services, including live casino, premium slot games, sabung ayam (cockfighting) arena, and sportsbook betting.

If you have any questions about the data controller's identity or this Privacy Policy, please contact us at the details provided in Section 14.

mdg168 collects personal data across several categories depending on the nature of your interaction with the platform. The following table summarises what we collect and why:

mdg168 collects personal data through the following mechanisms:

• Direct Submission: When you register an account, complete KYC verification, make a deposit or withdrawal, interact with live support, or submit a feedback form, you provide data directly to us.
• Automated Technical Collection: When you visit and interact with the mdg168 platform, our servers automatically record technical data including your IP address, device identifiers, browser fingerprint, and session activity logs. This occurs via server-side logging and client-side tracking scripts.
• Cookie & Pixel Technologies: We use first-party cookies, session storage, and analytics pixels to track usage behaviour within the platform. See Section 7 for full details of our cookie practices.
• Payment Processors: When you initiate a deposit or withdrawal, our integrated payment partners (bank APIs and e-wallet providers) return transaction status data and, in some cases, masked account identifiers that we store for reconciliation purposes.
• Third-Party Identity Verifiers: For KYC purposes, we may use regulated third-party identity verification services that cross-reference documents you submit against authoritative databases. These services return a pass/fail signal along with any data discrepancies noted; we retain this result in your account record.
• Public Sources: In limited circumstances — primarily for fraud prevention and enhanced due diligence — we may consult publicly available information sources, such as politically exposed person (PEP) databases or sanctions screening lists.

Every personal data processing activity carried out by mdg168 rests on at least one of the following lawful bases. Where more than one basis applies, we rely on all applicable bases:

• Contractual Necessity: Processing is necessary to provide the services you have contracted for by accepting our Terms & Conditions — including account management, payment processing, and game delivery.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, KYC obligations, and financial record-keeping rules.
• Legitimate Interests: Processing serves mdg168's legitimate business interests — such as fraud prevention, platform security, product analytics, and responsible gaming monitoring — provided these interests are not overridden by your fundamental rights and freedoms.
• Consent: For non-essential processing activities — such as marketing communications, personalised promotional offers, and non-essential analytics cookies — we rely on your freely given, informed, and revocable consent. You may withdraw consent at any time by contacting [email protected].

mdg168 uses the personal data we collect for the following specific purposes:

• Account Management: Creating, maintaining, and administering your mdg168 member account, including login authentication, session management, and account settings updates.
• Payment Processing: Facilitating deposits and withdrawals via your chosen Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and maintaining accurate transaction records.
• Identity & Age Verification: Confirming that you are at least 21 years of age (21+) and that your identity matches the account registration details provided.
• Fraud Prevention & Security: Detecting and preventing fraudulent transactions, account takeover attempts, multi-accounting, bonus abuse, money laundering, and other prohibited activities as defined in our Terms & Conditions.
• Responsible Gaming: Monitoring betting patterns to identify potential signs of problem gambling, enforcing self-exclusion requests, and delivering responsible gaming interventions where warranted.
• Customer Support: Responding to enquiries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Platform Improvement: Analysing usage data in aggregate and pseudonymous form to improve the design, performance, and feature set of the mdg168 platform.
• Regulatory Compliance: Meeting our obligations under applicable AML, KYC, and financial regulation frameworks, including providing data to competent authorities where legally compelled.
• Personalised Promotions: With your consent, sending you targeted offers, seasonal bonus campaigns (e.g., Ramadhan promotions, Idul Fitri bonuses, Indonesian Independence Day offers), and reload incentives aligned with your gaming preferences.

mdg168 does not sell, rent, or trade your personal data to third parties for their independent marketing use. We share data only in the following circumstances and only to the extent strictly necessary:

• Payment Partners: We share the minimum financial identifiers required to process your transactions with authorised Indonesian bank gateways and e-wallet providers. These processors act as data processors under contractual agreements that prohibit secondary use of your data.
• Game Software Providers: Third-party game studios (such as Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, and Spribe) receive a pseudonymous player session token to facilitate game delivery. They do not receive your full name, national ID, or payment details.
• Identity Verification Services: Our regulated KYC partners receive the document images and identity data you submit solely for the purpose of verification. They are contractually prohibited from retaining or using this data beyond the verification task.
• Analytics Providers: Aggregate, anonymised usage data may be processed by analytics platform providers operating under data processing agreements that prevent re-identification of individual users.
• Legal & Regulatory Authorities: mdg168 will disclose personal data to government bodies, law enforcement agencies, or financial regulators where required to do so by a valid legal order, court order, or regulatory mandate. We will notify you of such disclosure where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, asset sale, or restructuring of the Company, personal data held by mdg168 may be transferred to the acquiring or successor entity as part of the transaction, subject to equivalent data protection commitments.

All third parties with whom mdg168 shares personal data are required to maintain appropriate technical and organisational security measures and are contractually prohibited from using your data for purposes beyond those for which it was shared.

mdg168 uses cookies and similar client-side storage technologies to operate the platform, maintain your session, and understand how players interact with our services. The following categories of cookies are in use:

You can manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the mdg168 platform from functioning correctly. Disabling analytics or marketing cookies will not affect your ability to play games, make deposits, or request withdrawals.

mdg168 retains personal data for only as long as is necessary to fulfil the purpose for which it was collected, or to comply with applicable legal and regulatory obligations. The table below sets out our standard retention periods by data category:

Upon expiry of the applicable retention period, personal data is either securely deleted from our systems or anonymised in such a way that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and product research purposes.

mdg168 implements a layered information security programme designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• TLS 1.3 Encryption in Transit: All data transmitted between your browser or device and our servers is encrypted using Transport Layer Security (TLS) 1.3. Connections using older, less secure protocols are automatically rejected.
• AES-256 Encryption at Rest: Sensitive data fields stored in our databases — including identity documents, payment method identifiers, and KYC records — are encrypted at rest using AES-256 standard encryption.
• Password Hashing: Account passwords are never stored in plain text. We use bcrypt with a high work factor to ensure that even in the unlikely event of a database exposure, passwords remain computationally infeasible to reverse.
• Multi-Factor Authentication (MFA): mdg168 supports optional MFA for member accounts. We strongly encourage all players to enable this feature via their account security settings.
• Access Control: Internal access to personal data is restricted to authorised personnel on a strict need-to-know basis. All internal access events are logged and subject to periodic audit review.
• Penetration Testing: mdg168 conducts regular third-party security assessments and penetration tests to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response: In the event of a personal data breach that poses a risk to your rights, mdg168 will notify affected members and relevant authorities within the timeframes required by applicable law.

As a member of mdg168, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at [email protected] with a clear description of your request. We will respond within 30 days and may need to verify your identity before processing your request.

Please note that certain rights are subject to limitations where legal obligations require us to retain data — for example, AML laws require us to keep transaction records for a minimum period regardless of a deletion request. In such cases, we will explain the applicable limitation clearly in our response.

mdg168 does not knowingly collect personal data from individuals under the age of 21. During the registration process, all members are required to declare their date of birth and consent to our Terms & Conditions. Where we have reasonable grounds to suspect that a member may be under 21, we will immediately suspend the account and initiate age verification procedures.

If a member is confirmed to be under 21, their account will be permanently closed, all funds will be handled in accordance with our Terms & Conditions, and any personal data collected in connection with that account will be retained only to the extent required by law before being securely deleted.

Parents and guardians who believe a minor may have registered an account on mdg168 are encouraged to contact us immediately at [email protected]. We take all such reports seriously and will act swiftly to investigate and resolve the matter.

The mdg168 platform may contain references to or integrations with third-party game providers, payment processors, and technology partners. While we carefully vet all partners for security and reliability, mdg168 is not responsible for the privacy practices of external third-party services or websites.

Each third-party provider operates under its own privacy policy and data protection framework. We encourage you to review the privacy policies of any third-party services you interact with. mdg168 assumes no liability for the data practices of third parties operating independently of our platform.

mdg168 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When material changes are made, we will:

• Update the "Last Updated" date displayed at the top of this page.
• Display a prominent notice on the mdg168 platform homepage and login page for a minimum of 14 days following the change.
• Where the changes materially affect how we use your personal data, send a direct notification to the email address registered on your account.

Your continued use of the mdg168 platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with the updated terms, you must discontinue use of the platform and may request account closure by contacting [email protected].

We encourage you to review this Privacy Policy periodically. The current version is always accessible at https://mdg168.pro/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mdg168 handles your personal data, please contact our Data Protection team using the details below. All privacy-related enquiries are handled confidentially and responded to within 30 days of receipt.

When submitting a data rights request, please include your registered username, the email address associated with your account, a clear description of your request, and a copy of a valid identity document for verification purposes. This helps us process your request accurately and without unnecessary delay.