mdg199 Privacy Policy

mdg199 (referred to in this Policy as "we", "us", "our", or "the Platform") operates the online gaming platform accessible at mdg199.app. As part of operating this platform and delivering our services to players across Indonesia — including Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, Semarang, and beyond — we collect and process personal data about our players, visitors, and prospective users.

This Privacy Policy applies to all personal data collected through the mdg199 website (mdg199.app), mobile-optimised platform, customer support channels, and any other mdg199 service that links to this Policy. It governs how mdg199 processes personal data and describes the rights available to individuals whose data we hold.

mdg199 acts as the data controller for personal data collected and processed under this Policy. Where mdg199 engages third-party processors — such as payment providers, identity verification services, and game studios — those processors act under our instruction and are bound by data processing agreements consistent with this Policy.

• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. This includes name, email address, date of birth, device identifiers, and IP addresses.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, erasure, or structuring, whether by automated or manual means.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the mdg199 platform, the data controller is mdg199.
• "Data Processor" — a third party that processes personal data on behalf of mdg199 under contractual instruction.
• "KYC" — Know Your Customer — the identity and age verification process required under mdg199's compliance obligations before any withdrawal is processed.
• "Consent" — a freely given, specific, informed, and unambiguous indication of agreement by the data subject to the processing of their personal data for a stated purpose.
• "Player" / "you" — any individual who registers an account with, visits, or uses any service provided by mdg199.

The categories of personal data mdg199 collects about players are set out in the table below. Not all categories are collected from every player — the data collected depends on how you interact with the platform and what stage of the account lifecycle you are at.

mdg199 does not collect special category data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data for identification purposes) except where a liveness check is required as part of KYC — in which case the biometric data is processed solely for identity verification and is not stored beyond the verification event.

mdg199 collects personal data through the following means:

• Directly from you: when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, contact customer support via live chat or WhatsApp, or update your account settings.
• Automatically through your use of the platform: via cookies, session tracking, and server logs that capture technical and usage data each time you access mdg199.app. See Section 10 (Cookies) for full details.
• From third-party identity verification providers: when you submit documents for KYC, mdg199 may engage a licensed identity verification service to authenticate those documents. The result of that verification is shared with mdg199 as a pass/fail determination along with the underlying data you submitted.
• From payment processors: when you initiate a deposit or withdrawal via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, or ShopeePay, transaction confirmation data (including transaction reference numbers, amounts, and timestamps) is shared with mdg199 by the relevant payment processor.
• From fraud prevention and anti-money-laundering (AML) screening tools: mdg199 may run player data against screening databases to comply with its obligations in relation to fraud prevention and AML. The outcome of such screening is held in the player's compliance record.

mdg199 processes personal data for the following purposes:

• Account management: creating, maintaining, and operating your mdg199 player account, including authenticating your identity on login.
• KYC and age verification: verifying that you are at least 21 years of age and confirming your identity in compliance with our responsible gaming and anti-money-laundering obligations. This is mandatory for all withdrawal requests.
• Processing deposits and withdrawals: facilitating Rupiah transactions via local Indonesian banks and e-wallets, reconciling balances, and resolving payment disputes.
• Customer support: responding to your queries, resolving disputes, processing complaints, and maintaining records of interactions for quality assurance purposes.
• Fraud prevention and security: detecting and preventing fraudulent activity, money laundering, account takeovers, bonus abuse, and other prohibited conduct described in the mdg199 Terms and Conditions.
• Responsible gaming compliance: monitoring account activity to identify signs of problem gambling behaviour; enforcing deposit limits, cooling-off periods, and self-exclusion requests; and communicating with players regarding responsible gaming resources.
• Platform improvement: analysing aggregated usage data to improve the performance, design, and content of the mdg199 platform.
• Marketing and promotions: sending promotional emails, push notifications, and bonus offers to players who have opted in to marketing communications. You may withdraw this consent at any time via your account settings or by contacting support.
• Legal and regulatory compliance: retaining records as required by applicable law; responding to lawful requests from regulatory authorities, law enforcement, or courts of competent jurisdiction.

mdg199 processes your personal data on one or more of the following legal bases:

• Contract performance: processing your identity data, contact data, and financial data is necessary to fulfil our contractual obligations to you under the mdg199 Terms and Conditions — including creating your account, processing deposits and withdrawals, and operating the games and betting markets you access.
• Legal obligation: processing for KYC, AML screening, and record retention is necessary to comply with applicable legal and regulatory obligations.
• Legitimate interests: processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement is carried out on the basis of mdg199's legitimate interest in operating a safe, fair, and compliant platform — provided that interest is not overridden by your rights and interests.
• Consent: processing for direct marketing communications is carried out on the basis of your explicit opt-in consent, which you may withdraw at any time without detriment to your account or access to the platform.

mdg199 does not sell your personal data to any third party. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, and ShopeePay receive the minimum data required to process your deposit or withdrawal instruction (account reference, amount, and currency). These providers operate under their own privacy policies for data processed within their own systems.
• Identity verification providers: licensed third-party KYC service providers receive document images and biometric data (where a liveness check is required) solely for the purpose of verifying your identity. Results are shared with mdg199 in summary form.
• Game providers: Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, Spribe, and other licensed game studios may receive a session token and anonymised player identifier to authenticate your game session. They do not receive your full name, contact details, or financial data.
• Fraud and AML screening services: player data may be checked against commercially operated fraud-prevention and AML databases. These services return a risk score or flag; they do not retain your data beyond the screening event.
• Customer support platforms: live chat and WhatsApp support may be operated through third-party customer service software. Chat transcript data is stored within those systems subject to data retention agreements with mdg199.
• Regulatory and law enforcement authorities: mdg199 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law or pursuant to a valid legal order. We will notify you of such disclosure where permitted by law.
• Corporate restructuring: in the event of a merger, acquisition, or sale of all or part of mdg199's business, player data may be transferred to the acquiring entity. Affected players will be notified in advance of any such transfer and of any change to the applicable privacy policy.

mdg199 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account data (identity, contact, KYC documents): retained for the lifetime of the account plus a minimum of 5 years following account closure, in accordance with AML record-keeping obligations.
• Financial transaction records: retained for a minimum of 5 years from the date of the transaction.
• Customer support communications: retained for 2 years from the date of the last interaction, except where a communication forms part of a dispute or legal proceeding — in which case it is retained until the matter is resolved plus 1 year.
• Technical and usage logs: retained for 12 months from the date of collection, after which they are aggregated and anonymised for analytics purposes.
• Marketing preference records: retained for the lifetime of the account and for 3 years following account closure, to demonstrate compliance with consent obligations.
• Self-exclusion records: retained indefinitely to prevent re-registration by self-excluded individuals.

When personal data is no longer required for any of the purposes described in this Policy and no legal retention obligation applies, it is securely deleted or anonymised so that it can no longer be attributed to any individual.

mdg199 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: all data transmitted between your device and the mdg199 platform is encrypted using 256-bit SSL/TLS encryption. The mdg199.app domain enforces HTTPS at all times.
• Encryption at rest: sensitive data fields — including identity document data, financial account references, and KYC outcomes — are encrypted at rest within mdg199's database infrastructure.
• Access controls: access to personal data within mdg199's systems is restricted on a need-to-know basis. Staff access is controlled via role-based permissions, and all access events are logged and auditable.
• Two-factor authentication (2FA): mdg199 strongly recommends all players enable 2FA on their accounts. 2FA is available via authenticator app and is enabled by default for accounts with withdrawal requests above a defined threshold.
• Suspicious login detection: mdg199's security systems monitor for anomalous login patterns — including logins from new devices, new IP addresses, or unusual geographic locations — and may trigger additional verification steps before granting access.
• Penetration testing and security audits: mdg199 conducts periodic security assessments of its platform infrastructure to identify and remediate vulnerabilities before they can be exploited.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, mdg199 will notify affected players without undue delay and will take all reasonable steps to contain and remediate the breach.

mdg199 uses cookies and similar tracking technologies on the mdg199.app platform. Cookies are small text files placed on your device that help the platform function correctly, improve your experience, and provide us with analytics about how the platform is used.

The categories of cookies used by mdg199 are as follows:

• Strictly necessary cookies: required for the platform to operate. These include session cookies that maintain your logged-in state, security tokens, and load-balancing identifiers. These cannot be disabled without breaking core platform functionality.
• Functional cookies: remember your preferences — such as language settings, preferred lobby view, and responsible gaming reminder settings — between sessions.
• Analytics cookies: collect anonymised or pseudonymised data about how players navigate and interact with the platform. This data is used to improve platform performance and content. mdg199 uses privacy-compliant analytics tools for this purpose.
• Marketing cookies: used to track whether you arrived at mdg199 via a specific promotional channel, and to measure the effectiveness of mdg199's advertising campaigns. These are only set if you have consented to marketing communications.

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the mdg199 platform. Disabling functional or analytics cookies will not prevent you from using the platform but may affect your experience and the accuracy of our usage analytics.

As a data subject, you have the following rights in relation to your personal data held by mdg199. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request", or raise the request via live chat.

mdg199 will respond to all data rights requests within 30 days of receipt. Where a request is complex or mdg199 receives a high volume of requests, this period may be extended by a further 60 days — in which case we will notify you within the initial 30-day window. mdg199 does not charge a fee for exercising data rights unless a request is manifestly unfounded or excessive.

The mdg199 platform is strictly intended for adults aged 21 and above. mdg199 does not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory component of the mdg199 KYC process, and all accounts are required to complete this verification before any withdrawal can be processed.

If mdg199 becomes aware that personal data has been collected from an individual who is under 21 years of age, we will immediately suspend the associated account, notify the individual (or their legal guardian where appropriate), void any wagers placed, return any deposits made to the original payment method, and delete the personal data in question from our systems.

mdg199 encourages parents and guardians in Indonesia to use parental control tools to prevent minors from accessing online gaming platforms. If you believe a minor has registered an account on mdg199, contact our support team immediately at [email protected].

mdg199 sends promotional and marketing communications — including bonus offers, tournament announcements, and seasonal promotions tied to events such as Idul Fitri, Imlek (Chinese New Year), and Indonesian Independence Day (17 August) — only to players who have explicitly opted in to receive such communications at the time of registration or subsequently via their account settings.

Marketing communications may be delivered via email and/or push notification, depending on the channel preferences you have selected. mdg199 does not send unsolicited SMS marketing messages.

You may withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in your mdg199 account settings dashboard.
• Clicking the unsubscribe link included in every mdg199 promotional email.
• Contacting mdg199 customer support via live chat or at [email protected] with the subject line "Unsubscribe".

Withdrawing marketing consent does not affect your ability to use the mdg199 platform, receive transactional communications (such as deposit and withdrawal confirmations, KYC status updates, and account security alerts), or access any bonus that you have already claimed and are in the process of wagering.

mdg199 does not send marketing communications to players who are on a cooling-off period or self-exclusion, regardless of their marketing consent status.

mdg199 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or our data processing practices. When material changes are made, mdg199 will notify registered players via email to their registered address at least 14 days before the amended Policy takes effect, and will update the "Last Updated" date displayed at the top of this page.

Your continued use of the mdg199 platform following the effective date of any amendment constitutes acceptance of the revised Privacy Policy. If you do not accept the revised Policy, you must cease using the platform and contact support to close your account.

We recommend bookmarking the Privacy Policy page and reviewing it periodically. The date of the most recent update is always displayed in the header of this document.

For any questions, concerns, or formal requests relating to this Privacy Policy or to the personal data mdg199 holds about you, please contact us through the following channels:

• Email: [email protected] — use the subject line "Privacy Enquiry" for general questions or "Data Rights Request" for formal data subject requests.
• Live Chat: Available 24/7 from your mdg199 account dashboard. For data rights requests via live chat, your identity will first be verified before the request is actioned.
• WhatsApp: Available via the support number listed in your account dashboard.

mdg199's customer support team operates in both English and Indonesian, 24 hours a day, 7 days a week — including Indonesian public holidays. Average first-response time via live chat is under 3 minutes. Data rights requests submitted by email are acknowledged within 2 business days and responded to in full within 30 days.