Privacy Policy

The following terms carry the meanings assigned to them throughout this Privacy Policy and all supplementary data notices published on the mdg66 Platform:

• "mdg66", "the Company", "we", "us", "our" — the legal entity operating the mdg66 online gambling platform at https://mdg66.bet.
• "Platform" — the mdg66 website, mobile-optimised web interface, all game environments, the sportsbook, the cashier system, and all associated digital services accessible via mdg66.bet.
• "Member", "User", "you", "your" — any natural person who has registered an Account on the mdg66 Platform or who visits the Platform in any capacity.
• "Personal Data" — any information that directly or indirectly identifies a living natural person, including name, national identity number, contact details, financial account details, IP address, device identifiers, and behavioural data linked to an identifiable individual.
• "Processing" — any operation performed on Personal Data, including collection, storage, organisation, structuring, use, disclosure, transfer, or deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. For all data collected via the mdg66 Platform, the Data Controller is mdg66.
• "KYC Data" — identity verification documents and supporting materials submitted by a Member as part of the Know Your Customer verification process, as described in mdg66's Terms & Conditions.
• "Cookies" — small text files placed on a Member's device by the mdg66 Platform for session management, analytics, and personalisation purposes.

mdg66 acts as the Data Controller for all Personal Data collected through the mdg66 Platform. As Data Controller, mdg66 determines the purposes for which your Personal Data is processed and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently in accordance with this Privacy Policy and applicable data protection legislation.

For all privacy-related enquiries, data access requests, correction requests, or complaints, Members may contact our dedicated data privacy team via the contact details set out in Clause 15 of this Policy.

mdg66 collects Personal Data across several categories. The specific data collected depends on the nature of your interaction with the Platform — casual visitor, registered Member, or Member undergoing KYC verification.

mdg66 collects Personal Data through the following channels and mechanisms:

• Direct submission: Data you provide actively when registering an Account, completing the KYC process, making deposits or withdrawal requests, contacting our support team, or updating your Account profile.
• Automated technical collection: Technical and Usage Data collected automatically through server logs, session tracking, and first-party analytics tools each time you access the Platform — regardless of whether you are logged in.
• Cookies and similar technologies: Session cookies, persistent cookies, and pixel tags placed on your device when you visit mdg66.bet. See Clause 10 for full details on our cookie practices.
• Payment processors: Transaction confirmation data received from our integrated Indonesian banking and e-wallet partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OVO, DANA, GoPay, ShopeePay, LinkAja) to verify deposit and withdrawal status.
• Third-party game providers: Aggregated gameplay and session data shared by licensed game studios (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft) for the purposes of resolving disputes and auditing game outcomes.
• Identity verification providers: Where mdg66 engages a third-party KYC verification service to cross-reference identity documents against official databases, that provider may return a verification status result and associated data flags to mdg66.

mdg66 processes your Personal Data only where a valid lawful basis exists. The primary bases on which we rely are set out below:

• Contractual necessity: Processing your Identity Data, Contact Data, and Financial Data is necessary to fulfil our contractual obligations to you as a registered Member — including operating your Account, processing transactions, and providing access to games and the sportsbook.
• Legal obligation: Processing KYC Data and transaction records is necessary to comply with our licensing authority's anti-money-laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) requirements.
• Legitimate interests: Processing Technical Data and Usage Data is necessary for our legitimate interests in operating a secure, fraud-resistant platform, improving our products and services, and detecting and preventing prohibited conduct.
• Consent: Where we send you optional promotional communications (such as bonus offers, seasonal promotions tied to Indonesian holidays such as Idul Fitri or Nyepi, or event-based offers such as BRI Liga 1 or Champions League match promotions), we do so only where you have affirmatively opted in. You may withdraw this consent at any time through your Account notification settings.

mdg66 uses the Personal Data we collect for the following specific and limited purposes:

• Creating, maintaining, and securing your Member Account, including enforcing the one-account-per-person policy and detecting duplicate or fraudulent registrations.
• Processing deposits and withdrawals via your registered Indonesian bank account or e-wallet, and generating transaction confirmation records.
• Conducting KYC identity verification to satisfy regulatory and licensing obligations before processing withdrawals above defined thresholds.
• Detecting, investigating, and preventing fraud, money laundering, bonus abuse, and other forms of Prohibited Conduct as defined in our Terms & Conditions.
• Personalising your Platform experience — for example, surfacing relevant sportsbook markets for Timnas Indonesia fixtures, BRI Liga 1 matches, or badminton events at the Indonesia Open based on your browsing and betting history.
• Delivering customer support through live chat and email, and maintaining a record of support interactions to ensure continuity of service.
• Operating responsible gaming tools — including monitoring Account activity to identify Members who may be exhibiting signs of problem gambling and proactively offering self-exclusion or deposit-limit options.
• Sending transactional notifications (deposit confirmations, withdrawal updates, security alerts, Account suspension notices) to your registered email address and mobile number.
• Sending optional promotional communications where you have provided consent, including bonus offers and seasonal promotions.
• Analysing aggregate, anonymised usage patterns to improve the Platform's functionality, performance, and game catalogue.
• Complying with all applicable legal, regulatory, and licensing obligations, including responding to lawful requests from regulatory authorities.

mdg66 does not share your Personal Data with third parties except in the following strictly defined circumstances:

• Licensed game providers: Game studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Spribe receive only the technical session identifiers necessary to deliver their games within the mdg66 Platform environment. They do not receive your name, financial data, or KYC documents.
• Payment processors: Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive only the transaction data required to execute your specific deposit or withdrawal instruction.
• KYC and identity verification providers: Where mdg66 uses a third-party identity verification service, that provider receives your KYC documents solely for the purpose of verification. All such providers are bound by confidentiality agreements and data processing agreements that restrict use to the verification purpose only.
• Regulatory and law enforcement authorities: mdg66 may be required by our licensing authority, a court order, or a lawful regulatory request to disclose specific Member data. In such circumstances, mdg66 will disclose only the minimum data necessary to satisfy the legal obligation and will, where legally permissible, notify the affected Member in advance.
• Fraud prevention and AML networks: Aggregated fraud indicators (not full Personal Data profiles) may be shared with industry fraud prevention bodies to protect the integrity of the online gambling ecosystem.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of mdg66's assets, Member Personal Data may be transferred to the successor entity, provided that the successor entity agrees to be bound by a privacy policy that offers at least equivalent protections to this Policy. Members will be notified of any such transfer in advance.

mdg66 retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, subject to the minimum retention periods required by our licensing obligations. The following retention schedule applies:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual. Where anonymised aggregate data is retained for analytical purposes, it is no longer considered Personal Data and falls outside the scope of this Policy.

mdg66 implements a layered, defence-in-depth security architecture to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the mdg66 Platform — every page, every session, without exception.
• Encrypted data-at-rest storage for all KYC documents, financial records, and Account credentials held on mdg66 servers.
• Two-factor authentication (2FA) available to all Members via their registered Indonesian mobile number, providing a critical second layer of Account access control beyond username and password.
• Role-based access controls (RBAC) ensuring that mdg66 staff can access Member data only to the minimum extent required for their specific job function — for example, a customer support agent can view Account status and transaction history but cannot access raw KYC document files.
• Real-time anomaly detection on session activity to flag unusual login patterns, geographic anomalies, or rapid successive transactions that may indicate Account compromise or fraudulent activity.
• Regular penetration testing conducted by independent security professionals to identify and remediate vulnerabilities in the Platform infrastructure before they can be exploited.
• Segregated data environments separating production Member data from development and testing environments, ensuring that real Personal Data is never used in non-production systems.

The mdg66 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure experience. The following cookie categories are used:

You can control cookie settings at any time through your browser's privacy controls. Note that disabling Strictly Necessary cookies will impair the Platform's core functionality, including the ability to log in and maintain a session. Disabling Functional or Analytics cookies will not prevent you from using the Platform but may result in a less personalised experience.

As a Member of mdg66, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team via live chat or at [email protected]. mdg66 will respond to all data rights requests within 30 days of receipt.

• Right of Access: You have the right to request a copy of all Personal Data mdg66 holds about you, including the categories of data held, the purposes for which it is used, and the third parties with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held on your Account. You may update many data fields directly through your Account profile settings without needing to contact support.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to mdg66's legal obligations to retain certain data categories (see Clause 8). Note that data we are required by law to retain — such as KYC records and transaction history — cannot be deleted before the applicable retention period expires.
• Right to Restriction of Processing: You have the right to request that mdg66 restrict the processing of your Personal Data in certain circumstances — for example, while a dispute about the accuracy of your data is being resolved.
• Right to Data Portability: You have the right to request that mdg66 provide your Personal Data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
• Right to Object: You have the right to object to the processing of your Personal Data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though mdg66 may override such an objection where it can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent (for example, receiving promotional communications), you may withdraw that consent at any time through your Account notification settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The mdg66 Platform is strictly restricted to adults aged 21 years and older. mdg66 does not knowingly collect Personal Data from any person under the age of 21. Our KYC verification process is specifically designed to identify and exclude underage applicants by verifying date of birth against government-issued identity documents.

If mdg66 discovers or is notified that Personal Data has been collected from an individual under the age of 21, the following steps will be taken immediately: the Account will be suspended, any deposited funds will be returned to the source payment method after verification, all Personal Data associated with the Account will be deleted as soon as permitted by our legal retention obligations, and the matter will be referred to our compliance team for review.

The mdg66 Platform serves Members based primarily in Indonesia. Our primary data storage infrastructure is located in data centres with certified physical and environmental security controls. In certain limited circumstances — for example, where mdg66 uses a third-party KYC verification provider or a globally distributed game provider's system — your Personal Data may be transferred to and processed in a jurisdiction outside Indonesia.

In all such cases, mdg66 ensures that adequate safeguards are in place before making the transfer. These safeguards include contractual data protection clauses (equivalent to standard contractual clauses recognised by leading data protection authorities), binding corporate rules where applicable, and verification that the recipient jurisdiction provides an adequate level of data protection for the purpose of the transfer.

You may request details of the specific safeguards applied to any international transfer of your Personal Data by contacting our privacy team at [email protected].

mdg66 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform functionality. When material changes are made, mdg66 will publish the revised Policy on this page with an updated "Last Updated" date at the top of the document.

Where changes are significant — for example, where mdg66 introduces a new purpose for processing Personal Data, or begins sharing data with a new category of third party — registered Members will be notified via their registered email address or via a prominent in-platform notification, no less than 14 days before the changes take effect.

Your continued use of the mdg66 Platform after the effective date of any amended Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you disagree with any changes to this Policy, you must discontinue your use of the Platform and may request Account closure and data deletion in accordance with Clause 11.

For all privacy-related matters — including data access requests, correction requests, erasure requests, complaints about our data handling practices, or general questions about this Privacy Policy — please contact mdg66 through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly from your Account dashboard after logging in. Indonesian-speaking agents are available at all hours. Average response time under 90 seconds. Suitable for routine data enquiries and Account-level data corrections.
• Support Email: [email protected] (plain text — not a clickable link). Use this address for formal data rights requests, written complaints, and notices requiring a documented response trail. Response within 5 business days for acknowledgment; substantive response within 30 calendar days.

All formal data rights requests must be submitted in writing (via email or in-platform written message) and must include sufficient information to verify your identity as the registered Account holder — this is to protect you against unauthorised third-party access to your data. mdg66 does not accept verbal-only data rights requests via live chat for formal erasure or portability requests; these must be confirmed in writing.