Privacy Policy

mdg99 (referred to in this Policy as "we", "us", "our", or "the Company") is the internationally licensed entity that owns and operates the online gaming platform accessible at mdg99.one. The Company acts as the data controller in respect of all personal information collected from players who register, access, or use the mdg99 platform.

This Privacy Policy applies to all products and services offered through mdg99.one, including but not limited to: slot games, live casino tables, sports betting markets, roulette, esports betting, account management, customer support interactions, and promotional communications. It covers personal data processed regardless of whether you access the platform via a desktop browser or a mobile device.

If you have questions about how mdg99 handles your personal data, or if you wish to exercise any of the rights described in this Policy, please contact us using the details in Section 14.

mdg99 collects personal data in the following categories:

We do not collect or store full payment card numbers. Any card-based payment flows are processed entirely by certified third-party payment processors; mdg99 receives only a masked card reference and transaction confirmation.

mdg99 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technical collection: Data gathered automatically when you use the platform, including IP address, device fingerprint, session logs, and cookie data (see Section 8 for full cookie details).
• Third-party providers: Identity verification bureaus and payment processors may return data to mdg99 as part of transaction confirmation or fraud screening. This data is used solely for the purposes described in Section 5.
• Publicly available sources: In limited circumstances where required by our AML (anti-money laundering) compliance programme, we may consult publicly available sanctions lists, politically exposed persons (PEP) databases, and adverse media sources.

mdg99 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contract performance: Processing your registration data, payment details, and betting records is necessary to fulfil the service contract between mdg99 and you as a registered player.
• Legal obligation: Collecting and retaining identity documents and transaction records is required by our international licensing conditions and by applicable anti-money laundering regulations.
• Legitimate interests: Analysing gameplay patterns for fraud prevention, maintaining platform security, and improving service quality represent legitimate interests that do not override your fundamental privacy rights.
• Consent: Where we send optional marketing communications (promotions, seasonal offers aligned with Indonesian holidays such as Idul Fitri, Nyepi, or Independence Day), we rely on your prior opt-in consent. You may withdraw this consent at any time by contacting support or updating your account notification preferences.

mdg99 uses personal data for the following purposes:

• Account creation and management: Creating your account, authenticating logins, maintaining account settings, and enabling password resets.
• Payment processing: Executing deposits via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and e-wallets including OVO, DANA, GoPay, ShopeePay, and LinkAja; processing withdrawals; and maintaining transaction records.
• Identity verification (KYC): Confirming your identity, age, and payment method ownership in compliance with our licensing obligations and AML programme.
• Service delivery: Providing access to all mdg99 products — slots, live casino, sportsbook, roulette, and esports betting — and personalising your gaming experience based on account preferences.
• Customer support: Responding to enquiries, resolving disputes, processing responsible gaming requests, and maintaining records of support interactions.
• Fraud and security: Detecting and preventing fraudulent activity, unauthorised account access, multi-accounting, money laundering, and other prohibited conduct described in our Terms & Conditions.
• Responsible gaming: Monitoring gameplay patterns for indicators of problem gambling and administering self-imposed limits, cooling-off periods, and self-exclusion elections.
• Legal compliance: Meeting record-keeping, reporting, and audit requirements under our international licence and applicable law.
• Marketing communications (consent-only): Sending promotional emails and notifications about bonuses, new games, and seasonal offers — but only where you have opted in and have not subsequently withdrawn consent.

mdg99 does not sell, rent, or trade your personal data. We share it only in the limited circumstances described below:

• Service providers: We share necessary data with carefully vetted third-party providers who support platform operations — payment processors, identity verification bureaus, cloud infrastructure providers, fraud screening tools, and email delivery services. These providers are contractually bound to process data only on mdg99's instructions and to maintain appropriate security standards.
• Game providers: When you play a game hosted by a third-party studio (such as Pragmatic Play, Evolution Gaming, Microgaming, or Spribe), your player session token and account identifier are passed to that provider's gaming engine. No additional personal data beyond what is required to run the game session is transmitted.
• Regulatory and legal authorities: We may disclose personal data to licensing regulators, financial intelligence units, law enforcement agencies, or courts when required by law, by our licence conditions, or pursuant to a valid legal order. Where permitted by law, we will notify you of such disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of the business or its assets, player data may be transferred as part of that transaction. You will be notified of any such transfer and any material change to data processing practices that results from it.

mdg99 integrates with a range of third-party service providers to deliver its platform. The principal categories of third-party providers, and the nature of the data they receive, are outlined below:

All third-party providers are subject to data processing agreements with mdg99. They are prohibited from using mdg99 player data for any purpose other than performing the contracted service.

mdg99 uses cookies and similar tracking technologies (local storage, session storage, pixel tags) to operate the platform and improve the player experience. The cookies we use fall into the following categories:

• Strictly necessary cookies: These cookies are required for the platform to function. They manage your login session, maintain your wallet state during a gaming session, and protect against cross-site request forgery (CSRF). These cookies cannot be disabled without breaking core functionality.
• Performance cookies: These cookies collect anonymised data about how players navigate the platform — which pages are visited most often, session durations, and error frequencies. This data helps us identify performance bottlenecks and improve the user experience.
• Functional cookies: These cookies remember your preferences, such as your last-visited game category, display language, and notification settings, so you do not need to re-configure them on every visit.
• Analytics cookies: mdg99 uses server-side analytics to understand aggregate player behaviour patterns. Where client-side analytics tools are used, they are configured to anonymise IP addresses and to avoid cross-site tracking.

mdg99 does not use third-party advertising cookies or tracking pixels that report your browsing behaviour to advertising networks. You may manage cookie preferences through your browser settings; disabling strictly necessary cookies may impair your ability to use the platform.

mdg99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by our licensing and legal obligations:

On expiry of the applicable retention period, data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual player.

mdg99 applies a layered, defence-in-depth approach to data security. The principal technical and organisational measures in place include:

• Transport encryption: All data exchanged between players and our servers is encrypted using TLS 1.3. HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive personal data fields (including identity document references, payment method identifiers, and KYC data) are encrypted at rest using AES-256.
• Password security: Passwords are never stored in plain text. They are hashed using a modern, computationally expensive hashing algorithm (bcrypt or Argon2) with unique per-user salts.
• Access controls: Internal access to player personal data is restricted on a strict need-to-know basis. Role-based access controls are enforced across all internal systems, and access logs are monitored.
• Two-factor authentication (2FA): Staff access to administrative systems that contain player data requires 2FA. Players are encouraged to enable 2FA on their own accounts for enhanced protection.
• Penetration testing: mdg99 commissions independent security assessments of its platform infrastructure on a regular basis. Identified vulnerabilities are remediated according to a defined severity-based schedule.
• Incident response: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in significant risk to affected players, we will notify impacted players and relevant regulatory authorities within the timeframes required by applicable law.

As a player on mdg99, you have the following rights in relation to your personal data. You may exercise any of these rights at any time by contacting our support team via live chat or at [email protected].

We will respond to all verified data subject requests within 30 days of receipt. Where a request is complex or we have received a large volume of requests, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window.

We reserve the right to verify your identity before acting on a data subject request, to ensure that we do not disclose or delete data in response to a request made by someone other than the account holder.

mdg99 is strictly an adults-only platform. No person under the age of 21 years is permitted to register an account or access any mdg99 product or service.

We apply age verification controls at registration and during KYC review. Where we discover that an account has been registered by or on behalf of a person under 21, we will:

• Immediately suspend and permanently close the account;
• Void all bets placed and bonuses claimed during the period the account was held by a minor;
• Return net deposits (deposits minus withdrawals) to the payment method used, subject to our standard AML verification procedures.

We do not knowingly collect or retain personal data from individuals under 21. If you believe that a minor has registered an account on mdg99, please notify us immediately at [email protected] so that we can take prompt action.

If you are a parent or guardian and are concerned about a minor's access to online gaming platforms, we recommend installing parental control software that restricts access to gambling websites. Information about parental control options is available on request from our support team.

mdg99 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law or licensing requirements, or improvements to our platform and services.

When material changes are made — that is, changes that affect your rights or the way we use your personal data in a meaningful way — we will notify registered players by email to the address on record at least 14 days before the revised Policy takes effect. The "Effective Date" at the top of this document will be updated accordingly.

For non-material updates such as typographical corrections or clarifications that do not alter the substance of the Policy, we may make changes without advance notice, though the Effective Date will still be updated. We encourage you to review this page periodically. Continued use of the mdg99 platform after the effective date of any revision constitutes acceptance of the updated Policy.

For any questions, concerns, or requests relating to this Privacy Policy or mdg99's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 on the mdg99 platform. Indonesian-speaking agents are available during WIB peak hours. Average first response time: under 5 minutes. This is the fastest channel for urgent data requests such as immediate account closure or urgent KYC queries.
• Email: [email protected] — for formal data subject access requests, erasure requests, or written privacy complaints. We will acknowledge your email within 24 hours and provide a substantive response within 30 days.

When submitting a privacy-related request by email, please include your registered username, the email address associated with your mdg99 account, a clear description of your request or concern, and — for identity verification purposes — confirmation of your registered mobile number or a reference to your most recent deposit. We cannot action requests from individuals whose identity we are unable to verify.