Privacy Policy — mdo188

This Privacy Policy ("Policy") governs the collection, processing, storage, and disclosure of personal data by mdo188 ("mdo188", "we", "us", "our") in connection with the operation of the mdo188 platform accessible at https://mdo188.cam, including all subdomains, mobile interfaces, and associated services ("Platform").

mdo188 operates an online sports betting and gaming platform serving English-preference players across Indonesia, offering products including football betting on BRI Liga 1 and international leagues, live dealer casino games, togel (Indonesia's traditional numbers lottery), and a broad library of slots and E-sports betting markets.

This Policy is to be read in conjunction with our Terms & Conditions. By registering an Account and using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

For the purposes of applicable data protection legislation, mdo188 is the data controller responsible for the personal data collected through the Platform. As data controller, mdo188 determines the purposes and means by which your personal data is processed.

All privacy-related inquiries, data subject access requests, and complaints should be directed to our privacy support team at the contact address specified in Section 14 of this Policy.

mdo188 collects personal data across several categories depending on your interactions with the Platform. The following table summarizes the categories of data we collect and the context in which each is gathered:

mdo188 does not intentionally collect any Special Categories of Personal Data (such as health information, racial or ethnic origin, political opinions, or religious beliefs). If you voluntarily disclose such information through support channels or platform interactions, it will be treated with the highest degree of confidentiality.

mdo188 collects personal data through the following channels:

• Direct Interactions: Data you provide directly when completing the account registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting our support team.
• Automated Technologies: Data collected automatically when you access the Platform, including cookies, web beacons, pixel tags, and server-side logging. This data captures Technical Data and Usage Data as defined above.
• Third-Party Payment Processors: When you transact through local bank transfers (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI), e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), or card networks (Visa, Mastercard), we receive confirmation data from those processors to reconcile your transaction.
• Identity Verification Services: We may use a third-party KYC service provider to assist in document authentication. Any data shared with such providers is governed by appropriate data processing agreements.
• Publicly Available Sources: In limited circumstances, and solely for fraud prevention or KYC augmentation purposes, mdo188 may reference publicly available databases or information.

mdo188 processes your personal data only where a lawful basis exists. The following table sets out our primary processing purposes and the applicable legal basis for each:

mdo188 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share data only in the limited circumstances described below, and only to the minimum extent necessary:

• Payment Service Providers: We share transaction-relevant data with Indonesian local banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon), e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja), and card networks (Visa, Mastercard) solely to facilitate deposits and withdrawals on your behalf.
• KYC & Identity Verification Partners: We may engage a third-party identity verification service to authenticate the documents you submit during the KYC process. These partners act as data processors under contractual arrangements and are prohibited from using your data for any other purpose.
• Game Content Providers: Studio partners such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive anonymized or pseudonymized usage data necessary to operate their game software within our Platform. These providers do not receive your full identity data.
• IT Infrastructure & Security Providers: Cloud hosting, content delivery, and cybersecurity service providers who process data on our behalf under strict data processing agreements and are obligated to maintain confidentiality.
• Legal & Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by applicable law, valid legal process, or to protect the rights and safety of mdo188, its members, or the public.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or a material portion of mdo188's assets, your personal data may be transferred to the successor entity as part of that transaction, subject to equivalent privacy protections.

mdo188 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session state, and analyze usage patterns. The following categories of cookies are in use:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies enable core features such as account login session management, security token validation, and page load balancing. They cannot be disabled without significantly impairing your Platform experience.
• Functional Cookies: Store your preferences such as preferred language, last visited game categories, and display settings so the Platform can deliver a personalized experience across sessions.
• Analytical Cookies: Help mdo188 understand how members interact with the Platform — which pages are most visited, which games are most popular, and where technical errors occur. Data collected is aggregated and pseudonymized.
• Security Cookies: Used by our fraud detection and bot-prevention systems to distinguish legitimate human users from automated scripts and detect anomalous login behavior.

Most web browsers are configured to accept cookies by default. You may adjust your browser settings to block or delete cookies at any time; however, disabling strictly necessary cookies may prevent you from logging into your Account or using certain Platform features. For detailed instructions on managing cookies, refer to your browser's official support documentation.

mdo188 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is not immediately technically feasible, data is placed in a restricted archive and flagged for deletion at the earliest practicable opportunity.

mdo188 implements a layered security architecture to protect your personal data against unauthorized access, accidental loss, alteration, and unlawful disclosure. Our principal security measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser or mobile device and the mdo188 servers is encrypted in transit using TLS 1.3 protocol, indicated by the HTTPS padlock in your browser.
• AES-256 Encryption at Rest: Stored personal data — including KYC documents, financial records, and account credentials — is encrypted at rest using AES-256, an industry-standard symmetric encryption algorithm.
• Access Controls & Role-Based Permissions: Access to personal data within mdo188 is restricted on a strict need-to-know basis. Internal staff access is governed by role-based access controls, and all access events are logged and regularly audited.
• Two-Factor Authentication (2FA): mdo188 offers optional two-factor authentication for member accounts, and mandates 2FA for all internal administrative access to systems holding personal data.
• Regular Security Audits: Our platform and infrastructure undergo periodic penetration testing and vulnerability assessments conducted by independent security professionals.
• Incident Response Plan: mdo188 maintains a documented data breach response plan. In the event of a security incident that materially affects your personal data, we will notify you as promptly as is practicable in accordance with applicable notification obligations.

As a data subject, you hold the following rights in relation to your personal data held by mdo188. To exercise any of these rights, please contact our privacy team using the details provided in Section 14:

mdo188 will acknowledge all data subject requests within 72 hours and aim to fulfill them within 30 calendar days. In cases of complexity or high volume, this period may be extended by a further 30 days with prior written notice to you. We reserve the right to verify your identity before processing any request.

mdo188 operates a globally distributed infrastructure, which means that your personal data may be transferred to, stored in, or processed in countries outside of Indonesia. Where such cross-border transfers occur, mdo188 ensures that an equivalent level of data protection is maintained through one or more of the following mechanisms:

• Binding contractual clauses (data processing agreements) that impose equivalent data protection obligations on the receiving entity.
• Transfer to entities in jurisdictions that have been assessed as providing an adequate level of data protection by relevant regulatory authorities.
• Application of organizational and technical safeguards that ensure the security and confidentiality of transferred data consistent with the standards described in this Policy.

By using the mdo188 Platform and agreeing to this Privacy Policy, you acknowledge and consent to the transfer of your personal data to countries outside Indonesia, including countries whose data protection laws may differ from those applicable in Indonesia.

mdo188 is strictly an adults-only (21+) platform. We do not knowingly collect personal data from individuals under the age of 21. Our registration process includes age verification steps and our KYC procedures are specifically designed to identify and prevent underage access.

If mdo188 becomes aware that personal data has been collected from an individual under the age of 21 without appropriate parental consent, we will take immediate steps to delete that data and permanently close the associated Account. If you believe that a minor has registered on mdo188, please notify us immediately at the contact address provided in Section 14.

mdo188 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. When material changes are made, we will revise the "Last Updated" date at the top of this page and, where practicable, provide direct notification to registered members via the email address associated with their Account.

We encourage all members to review this Policy periodically to remain informed of how mdo188 protects their personal data. Your continued use of the Platform following the publication of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you must cease using the Platform and may request Account closure in accordance with our Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a complaint about how mdo188 has handled your personal data, please contact our privacy support team. We are committed to resolving all privacy-related concerns promptly and transparently.

mdo188 endeavors to resolve all privacy complaints internally. If you are not satisfied with our response, you may have the right to escalate your complaint to the relevant supervisory authority in your jurisdiction. For Indonesian residents, general consumer data concerns may be directed to the relevant national authority overseeing electronic information and transactions.