Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below unless the context requires otherwise:

• "mdg89", "we", "us", "our" — the mdg89 platform, its operating entity, and authorized representatives responsible for processing personal data.
• "Platform" — the mdg89 website at https://mdg89.cam, including all pages, features, games, betting markets, and associated digital services.
• "Member", "you", "your" — any individual who has registered an account on the Platform, is in the process of registering, or accesses the Platform as a visitor.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or in combination with other information. Examples include full name, date of birth, email address, phone number, device identifiers, and payment account details.
• "Processing" — any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, transmission, and deletion.
• "KYC" — Know Your Customer; the identity and payment-method verification process applied by mdg89 in line with internationally accepted anti-money-laundering (AML) standards.
• "Cookies" — small text files placed on your device by the Platform to facilitate session management, analytics, and personalization functions.
• "Third-Party Service Provider" — any external entity engaged by mdg89 to provide specific services in support of Platform operations, including payment processors, KYC verification providers, fraud-prevention systems, and cloud infrastructure operators.
• "Retention Period" — the defined period for which a category of Personal Data is stored before being securely deleted or anonymized.

mdg89 collects Personal Data across several categories, each of which serves a specific, documented purpose. The categories we currently process are set out in the table below:

mdg89 collects Personal Data through the following channels:

• Direct collection at registration: When you create an account, you provide Identity Data and Contact Data directly via the registration form.
• KYC document submission: When you submit identity and address verification documents, mdg89 receives and stores those documents and the data contained within them.
• Financial transactions: Each deposit or withdrawal generates Financial Data and Transactional Data that is logged automatically by our payment systems.
• Platform interaction: As you navigate the Platform, Technical Data and Usage Data are collected automatically via server logs and first-party analytics tools.
• Cookies and similar technologies: Cookies and local storage objects placed on your device collect session and preference data as described in Section 8 of this policy.
• Support communications: When you contact mdg89 customer support via live chat, email, or ticket, the content and metadata of that communication is stored as Communications Data.
• Third-party verification services: Where a KYC or fraud-prevention partner returns a data report as part of an identity check, the output of that report is stored against your account record.

mdg89 does not purchase Personal Data from data brokers, social media platforms, or any other external list provider.

Every instance of Personal Data processing at mdg89 rests on at least one of the following recognized legal bases:

• Contractual necessity: Processing that is required to fulfill the contract we have with you as a registered Member — including account management, deposit and withdrawal execution, and game result settlement. Without this processing, we could not deliver the Platform services to you.
• Legal obligation: Processing required by applicable law or regulatory directive — including AML/CTF record-keeping requirements and any lawful disclosure request from a competent authority.
• Legitimate interests: Processing that serves mdg89's legitimate business interests and does not unreasonably override your privacy rights — including fraud detection, Platform security monitoring, service analytics, and responsible gaming pattern analysis.
• Consent: Processing that is optional and for which you have given clear, specific, informed, and unambiguous consent — including promotional email and SMS communications. You may withdraw this consent at any time by contacting support or updating your account preferences, with effect from the date of withdrawal.

mdg89 uses Personal Data for the following documented purposes only:

• Account creation and management: Setting up, maintaining, and securing your member account throughout the lifecycle of your relationship with mdg89.
• Identity verification (KYC): Confirming your identity, age (21+), and Indonesian residency before processing withdrawal requests or when triggered by transaction thresholds.
• Payment processing: Executing deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja, and processing withdrawal requests to your verified payment methods.
• Fraud and AML prevention: Monitoring transactions and account activity for patterns consistent with fraud, money laundering, collusion, or other prohibited conduct as defined in our Terms & Conditions.
• Responsible gaming monitoring: Analyzing betting patterns to identify signs of problem gambling behavior and, where appropriate, triggering responsible gaming interventions or support outreach in line with our Responsible Gaming policy.
• Customer support: Responding to inquiries, resolving disputes, and maintaining a record of support interactions for quality assurance and training purposes.
• Platform improvement: Using aggregated and anonymized Usage Data and Technical Data to improve Platform performance, navigation, and game selection.
• Regulatory reporting: Fulfilling any mandatory reporting obligations to competent authorities under applicable law, including AML/CTF reporting requirements.
• Marketing communications (consent-based only): Sending promotional offers, bonus notifications, and platform news to Members who have opted in to receive such communications. These messages relate solely to mdg89 services and do not involve third-party promotional content.

mdg89 does not use Personal Data for automated individual decision-making that produces legal or similarly significant effects on Members, other than automated fraud-detection flags that are always subject to human review before any account action is taken.

6.1 General Principle. mdg89 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. Data is shared only where strictly necessary to operate the Platform or to comply with legal obligations.

6.2 Permitted Disclosures. Personal Data may be shared with the following categories of recipient:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja receive the minimum data necessary to execute payment instructions (typically account name, account number, and transaction amount).
• KYC and identity verification providers: Specialized third-party verification services receive identity document data and biometric selfie data for the sole purpose of confirming identity and age.
• Fraud prevention and AML screening services: Transactional and identity data may be shared with fraud analytics platforms to detect and prevent financial crime.
• Cloud infrastructure and hosting providers: mdg89's data is stored on secure, access-controlled cloud infrastructure operated by reputable providers under data processing agreements that impose equivalent security obligations.
• Game software providers: Providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive session data necessary to operate their game engines. These providers do not receive your identity or financial data.
• Legal and regulatory authorities: mdg89 will disclose Personal Data to competent authorities — including law enforcement, financial intelligence units, and courts — where required by a lawful order, warrant, or mandatory reporting obligation, or where disclosure is necessary to protect the rights and safety of mdg89 or its members.

6.3 Data Processing Agreements. All Third-Party Service Providers who process Personal Data on mdg89's behalf are required to enter into data processing agreements that: (a) restrict their use of data to the specified service purpose; (b) impose security standards equivalent to those applied by mdg89; and (c) prohibit onward transfer of data without mdg89's prior written consent.

7.1 Cross-Border Processing. As an internationally operated platform serving members in Indonesia, mdg89 may transfer Personal Data to servers or service providers located outside Indonesia. Such transfers may occur in connection with cloud infrastructure hosting, KYC verification, and game software operation.

7.2 Transfer Safeguards. Where Personal Data is transferred internationally, mdg89 ensures that appropriate safeguards are in place to maintain a level of protection equivalent to the standards described in this policy. Safeguards may include:

• Standard contractual clauses incorporated into data processing agreements with Third-Party Service Providers;
• Transfer to jurisdictions that have been recognized as providing an adequate level of data protection by international standards;
• Implementation of supplementary technical and organizational security measures where the legal protections of the destination jurisdiction are assessed as insufficient on their own.

7.3 No Transfer to Unvetted Parties. mdg89 does not transfer Personal Data to any international party that has not entered into an appropriate data processing agreement containing the safeguards described above.

8.1 What Are Cookies. Cookies are small text files stored on your device when you visit the Platform. They allow the Platform to recognize your device across sessions, maintain your login state, and collect usage data to improve performance.

8.2 Categories of Cookies Used. mdg89 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without breaking Platform functionality.
• Functional Cookies: Store your preferences such as language settings, display options, and game lobby filters so that the Platform behaves consistently across sessions.
• Analytics Cookies: First-party analytics cookies collect anonymized and aggregated data about how visitors use the Platform — which pages are visited most, where users drop off, and how features are used. This data is used exclusively to improve Platform design and performance.
• Security and Fraud Prevention Cookies: Used to detect and flag suspicious device behavior, unusual login patterns, and potential bot activity.

8.3 No Third-Party Advertising Cookies. mdg89 does not place or permit third-party advertising network cookies or cross-site tracking cookies on the Platform. We do not participate in behavioural advertising networks.

8.4 Managing Cookies. You may control or delete cookies through your browser settings at any time. Disabling strictly necessary cookies will impair your ability to log in and use the Platform. Disabling functional or analytics cookies will not affect your ability to place bets or access games, but may result in a less personalized experience.

9.1 Retention Principles. mdg89 retains Personal Data only for as long as is necessary to fulfill the purpose for which it was collected or to satisfy applicable legal and regulatory retention obligations. Once the retention period for a data category expires, that data is securely deleted or irreversibly anonymized.

9.2 Retention Schedule. The following retention periods apply to the principal categories of Personal Data held by mdg89:

9.3 Account Closure. When you request account closure, mdg89 will initiate deletion of your Personal Data within 90 days of confirmed closure, subject to any retention obligations in the schedule above that require data to be held for a longer period for regulatory compliance. During any mandatory retention period, access to retained data is restricted to authorized compliance personnel only.

mdg89 recognizes and respects the following rights in relation to your Personal Data. To exercise any of these rights, contact us at the details provided in Section 15.

• Right of Access: You have the right to request a copy of the Personal Data we hold about you, together with information about how it is being processed. We will respond to access requests within 30 days of receipt.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. For standard profile data (email address, phone number), you may update this directly within your account settings. For KYC-verified data (name, date of birth, ID number), please contact support with supporting documentation.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing has been unlawful. This right is subject to regulatory retention obligations; we will clearly communicate which data must be retained and for how long.
• Right to Restriction of Processing: You may request that we restrict processing of your Personal Data in certain circumstances — for example, while a rectification request is being assessed, or while an objection is being considered.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible.
• Right to Object: You have the right to object to processing based on legitimate interests (see Section 4). You also have an unconditional right to object to processing for direct marketing purposes, which will take effect immediately upon receipt of your objection.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time with immediate effect on future processing. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

11.1 21+ Platform. The mdg89 Platform is strictly for adults aged 21 and over. We do not knowingly collect Personal Data from persons under the age of 21. The registration process includes an age declaration, and KYC verification is used to confirm age before withdrawal processing is enabled.

11.2 Discovery of Underage Data. If mdg89 discovers or is notified that Personal Data has been collected from a person under 21 — whether through a falsified registration or through unauthorized access to an adult member's account — we will take the following steps immediately: (a) suspend the account; (b) delete all data associated with the underage user to the extent legally permissible; (c) refund any net deposited funds to the original payment method; and (d) refer the matter to our compliance team for further review.

11.3 Parental Responsibility. mdg89 encourages parents and guardians in Indonesia to make use of device-level parental control tools and to secure gambling platform credentials against access by minors. If you believe a minor has accessed or registered on the Platform using your details, contact support immediately at [email protected].

12.1 Technical Controls. mdg89 implements a layered set of technical security controls to protect Personal Data against unauthorized access, disclosure, alteration, and destruction. Key measures include:

• TLS 1.3 encryption for all data in transit between your device and the Platform;
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial account details;
• Multi-factor authentication options for member accounts;
• Intrusion detection and prevention systems monitoring network traffic 24/7;
• Regular penetration testing of Platform infrastructure by independent security specialists;
• Automated anomaly detection for unusual login locations, device changes, and transaction patterns.

12.2 Organizational Controls. Access to Personal Data within mdg89 is governed by a strict need-to-know principle. Personnel with access to member data undergo background screening, receive data protection training, and are bound by confidentiality obligations. Access logs are maintained and reviewed regularly.

12.3 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, mdg89 will notify affected Members without undue delay once the breach has been confirmed and contained. Notification will be sent to the email address registered to your account and will include: a description of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.

13.1 Scope. The Platform integrates with third-party services to deliver core functionality, including live casino games from Evolution Gaming, slot titles from Pragmatic Play, NetEnt, Microgaming, Spribe, and Pocket Games Soft, and payment infrastructure supporting BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.

13.2 Third-Party Privacy Practices. While mdg89 contractually requires all Third-Party Service Providers to maintain data protection standards consistent with this policy, those providers operate under their own privacy policies in respect of data they independently process. mdg89 is not responsible for the privacy practices of third-party providers operating outside the scope of their data processing agreement with mdg89.

13.3 No External Links. The mdg89 Platform does not include links to third-party websites for general browsing purposes. Where links to third-party resources are necessary for operational reasons, they are clearly identified. mdg89 is not responsible for the content or privacy practices of any external website.

14.1 Right to Update. mdg89 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data processing practices, Platform features, applicable law, or regulatory requirements.

14.2 Notification of Material Changes. Where a change to this policy is material — meaning it affects the categories of data we collect, the purposes for which we use data, the parties with whom we share data, or the rights available to you — mdg89 will notify active Members via email to their registered address at least 14 days before the revised policy takes effect.

14.3 Continued Use as Acceptance. Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acknowledgment of and agreement to the updated terms. If you do not accept the revised policy, you should cease using the Platform and request account closure before the revised policy takes effect.

14.4 Version History. The effective date of the current version of this Privacy Policy is stated in the page header. Prior versions are available upon written request to [email protected].

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or want to raise a concern about how mdg89 handles your Personal Data, please contact our privacy team using the details below.

When submitting a privacy-related inquiry or rights request, please include your registered email address, a clear description of your request or concern, and any relevant reference numbers (such as a transaction ID or support ticket number) to help us locate your records efficiently.

15.1 Complaints. mdg89 takes all privacy complaints seriously. Upon receipt, your complaint will be logged, assigned to a dedicated team member, and acknowledged within 3 business days. We aim to resolve all complaints within 30 days. Where resolution requires more time — for example, where a complaint involves a third-party service provider — we will keep you informed of progress at regular intervals.

15.2 Escalation. If you are not satisfied with mdg89's response to your complaint, you may wish to seek independent advice or escalate the matter to a relevant data protection authority or consumer protection body in your jurisdiction. mdg89 will cooperate fully with any such authority in the handling of a legitimate complaint.