md303 Privacy Policy

In this Privacy Policy, the following terms shall have the meanings set out below unless context requires otherwise:

• "md303", "We", "Us", "Our" — refers to the online gaming platform operated at https://md303.vip, including its operating entity, management, staff, and authorised service providers.
• "You", "User", "Player" — refers to any individual who accesses, browses, registers on, or transacts through the md303 platform.
• "Personal Data" — refers to any information relating to an identified or identifiable natural person, including name, date of birth, address, contact details, payment account information, device identifiers, and IP address.
• "Processing" — refers to any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, and deletion.
• "KYC" — refers to Know Your Customer identity verification procedures, including age verification, identity document review, and proof of payment account ownership.
• "Account" — refers to a registered Player account on the md303 platform, which grants access to gaming, betting, and payment services.
• "Cookies" — refers to small text files placed on your device by the md303 platform to maintain session state, store preferences, and collect aggregate usage analytics.
• "Data Breach" — refers to any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data held by md303.
• "WIB" — refers to Western Indonesia Time (UTC+7), the default time zone used for all platform timestamps and data-related correspondence.

md303 collects Personal Data from you in the following categories and through the following means:

2.1 Information You Provide Directly

• Registration Data: Full legal name, date of birth, gender, residential address (including city — Jakarta, Surabaya, Bandung, Bali, Medan, and other Indonesian cities), email address, and mobile phone number.
• Identity Verification Documents: Government-issued photo identification (KTP — Indonesian national identity card — or passport), selfie photographs submitted for facial-match verification, and proof of address documentation where required.
• Payment Account Details: Bank account numbers for BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, or other supported banks; e-wallet account identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja. Note: md303 does not store full card numbers; payment processing is handled by certified third-party processors.
• Support Communications: Any messages, complaints, or documentation you submit to md303's customer support team via live chat or email.

2.2 Information Collected Automatically

• Device & Technical Data: IP address, browser type and version, operating system, device type (mobile/desktop), screen resolution, and time zone setting.
• Usage & Behavioural Data: Pages visited on the md303 platform, games played, bet history, session duration, login timestamps (recorded in WIB), navigation paths, and feature interactions.
• Transaction Data: Deposit and withdrawal amounts, transaction timestamps, payment method used, and transaction status. All monetary values are denominated in Indonesian Rupiah (IDR / Rp).
• Cookie & Session Data: Session tokens, preference cookies, and aggregate analytics data as described in Section 6.

2.3 Information from Third Parties

• Identity Verification Services: md303 may receive verification outcomes (pass/fail) from authorised third-party KYC providers that process your identity documents on our behalf.
• Payment Processors: Transaction confirmation data (status, reference number, timestamp) from bank transfer gateways and e-wallet platforms.
• Fraud Prevention Services: Risk scores and device fingerprint data from third-party fraud detection services used to protect the integrity of the md303 platform.

md303 uses your Personal Data exclusively for the following documented purposes:

md303 processes your Personal Data on one or more of the following legal bases:

• Contract Performance: Processing is necessary to create and maintain your md303 Account, execute deposits and withdrawals, and deliver the gaming services you have requested. Without this processing, md303 cannot provide its services to you.
• Legal Obligation: Processing is required to comply with applicable laws, including anti-money-laundering regulations, age verification requirements, and record-keeping obligations. md303's strict 21+ policy is enforced in part through mandatory KYC data processing.
• Legitimate Interests: md303 processes certain data — including device identifiers, usage patterns, and aggregated analytics — on the basis of its legitimate interest in maintaining platform security, preventing fraud, and improving service quality. Where legitimate interests are the basis, md303 has conducted a balancing assessment confirming that our interests do not override your fundamental rights.
• Consent: Where md303 relies on your consent — primarily for sending promotional communications about bonuses, seasonal promotions (including Idul Fitri and Ramadhan offers), and new game launches — you may withdraw that consent at any time by contacting support or updating your communication preferences in your Account settings. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

md303 does not sell or rent your Personal Data to unaffiliated third parties. We share data only in the following limited circumstances:

• Payment Processors: We share necessary payment account details with our partner banks and e-wallet platforms (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals. These partners receive only the minimum data required to execute the transaction.
• Identity Verification Providers: We share your identity document data and registration details with authorised KYC service providers who perform verification on our behalf. These providers operate under strict data processing agreements with md303 and are prohibited from using your data for any purpose beyond the verification service.
• Game Content Providers: Game studios — including Pragmatic Play, Evolution Gaming, PG Soft, NetEnt, Microgaming, Habanero, and Spribe — may receive session identifiers and bet amounts for the purpose of game delivery and fairness auditing. Studios do not receive your full identity or payment data.
• Fraud Prevention Services: Aggregated device data and risk indicators are shared with fraud detection partners to protect the platform from financial crime. No personally identifiable information beyond what is strictly necessary for risk scoring is shared.
• Legal and Regulatory Authorities: md303 will disclose Personal Data to law enforcement agencies, regulatory bodies, or courts when required to do so by a valid legal order, court judgment, or applicable law. md303 will, where legally permitted, notify affected Players of any such disclosure request.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of md303's assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified via email and/or a prominent platform notice prior to such a transfer, and you will have the option to close your Account before the transfer takes effect.

md303 uses cookies and similar technologies (including local storage and session tokens) to operate the platform efficiently and improve your experience. We do not use third-party advertising cookies or cross-site tracking pixels.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling strictly necessary or security cookies will impair your ability to use the md303 platform. For full instructions on managing cookies in your specific browser, please refer to your browser's help documentation.

md303 retains your Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable laws and regulations. The following standard retention periods apply:

• Active Account Data: All registration data, KYC documents, and account preferences are retained for the full duration of your Account's active lifetime.
• Transaction Records: Deposit, withdrawal, and betting transaction records are retained for a minimum of 5 years following the date of the transaction, in compliance with standard anti-money-laundering record-keeping requirements.
• KYC Documents: Identity documents submitted for verification are retained for a minimum of 5 years following Account closure, or for a longer period if required by a specific legal obligation or ongoing investigation.
• Support Communications: Customer support tickets and associated correspondence are retained for 3 years following resolution of the relevant issue.
• Closed Account Data: Following voluntary Account closure, md303 will anonymise or delete personal profile data within 90 days, subject to the retention requirements above for financial records and KYC documents.
• Suspended/Terminated Account Data: Where an Account is closed due to a breach of Terms & Conditions — including fraud, bonus abuse, or underage access — associated data may be retained indefinitely to prevent re-registration and to support any ongoing legal or compliance proceedings.
• Analytics Data: Aggregated, anonymised analytics data that cannot be linked back to an individual Player is not subject to the retention periods above and may be retained indefinitely for platform improvement purposes.

md303 implements a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction:

• Transport Encryption: All data transmitted between your device and md303's servers is encrypted using TLS 1.2 or higher, with 256-bit SSL certificates. The md303 platform enforces HTTPS across all pages and rejects unencrypted HTTP connections.
• At-Rest Encryption: Sensitive stored data — including KYC documents, identity verification results, and payment account references — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to systems containing Personal Data is restricted to md303 staff who require it to perform their job functions. All staff with data access are subject to confidentiality obligations and regular security training. Access is governed by role-based permissions and reviewed quarterly.
• Infrastructure Security: md303's platform infrastructure is hosted in data centres that maintain physical security controls, 24/7 monitoring, and regular third-party penetration testing. Firewall, intrusion detection, and DDoS-mitigation systems are in place at the network layer.
• Incident Response: In the event of a confirmed Data Breach that affects your Personal Data, md303 will notify affected Players via email within 72 hours of becoming aware of the breach, to the extent technically feasible. The notification will describe the nature of the breach, the data categories affected, and the steps md303 has taken or plans to take to address it.

As a Player on the md303 platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to [email protected] from the email address registered to your Account. md303 will respond within 30 calendar days.

• Right of Access: You have the right to request a copy of all Personal Data that md303 holds about you, including the categories of data, the purposes for which it is processed, and the third parties with whom it has been shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete Personal Data held by md303. For account-registered data such as address or contact details, you may update this directly through your Account settings; for KYC documents, contact support.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been unlawfully processed. Note that this right is subject to md303's legal retention obligations — we cannot delete transaction records or KYC data that we are legally required to retain.
• Right to Restrict Processing: You may request that md303 restrict processing of your Personal Data in certain circumstances — for example, while the accuracy of data is contested, or where you have objected to processing pending verification of md303's legitimate interests.
• Right to Data Portability: You have the right to receive a copy of the Personal Data you have provided to md303 in a structured, commonly used, machine-readable format (such as JSON or CSV), and to request that this data be transmitted directly to another service provider where technically feasible.
• Right to Object: You have the right to object to processing of your Personal Data carried out on the basis of md303's legitimate interests, including profiling. You also have the right to opt out of promotional communications at any time. Objections to strictly necessary processing (such as fraud prevention and KYC) cannot be honoured without affecting your ability to maintain an Account.
• Right Not to be Subject to Automated Decisions: You have the right to request human review of any decision made by md303 that is based solely on automated processing and that produces significant effects on you — including any account restriction resulting from automated fraud-risk scoring.

md303 operates a strict 21+ policy. The md303 platform is not directed at, and does not knowingly collect Personal Data from, any person under the age of 21.

• If md303 becomes aware that a person under 21 has provided Personal Data during registration, we will immediately suspend the Account, delete the associated data as far as legally permissible, and notify relevant parties as required by law.
• Age verification (KYC) is conducted on all accounts prior to the processing of withdrawal requests. Submission of false date-of-birth information by a minor constitutes fraud and may be referred to the relevant authorities.
• md303 strongly encourages parents and guardians to install parental control software to prevent minors from accessing online gambling platforms. Widely used filtering solutions include those available from Indonesian internet service providers and third-party tools.
• If you have reason to believe that a minor has registered an Account on md303, please contact us immediately at [email protected]. We will investigate and act promptly.

md303's primary user base is in Indonesia, and we design our data flows with Indonesian Players in mind. However, some of the third-party service providers we use — including identity verification platforms, fraud detection services, and certain game studio infrastructure providers — may be located in jurisdictions outside Indonesia.

• Where Personal Data is transferred to a third party in another jurisdiction, md303 ensures that appropriate safeguards are in place — including contractual data processing agreements that impose standards equivalent to those described in this Privacy Policy.
• md303 does not transfer Personal Data to jurisdictions that do not provide an adequate level of data protection without first implementing additional contractual or technical protections.
• All third-party providers that receive Personal Data are required to process that data exclusively for the purposes for which it was shared, and are prohibited from retaining or using it for their own commercial purposes.

The md303 platform may reference third-party services — including payment platforms such as OVO, DANA, GoPay, and ShopeePay — in an informational context. Where a Player is redirected to a third-party platform to complete a payment transaction, the following applies:

• md303 is not responsible for the privacy practices of third-party platforms. Once you leave the md303 domain, this Privacy Policy no longer applies.
• md303 recommends that you review the privacy policies of any third-party service — including your bank or e-wallet provider — before submitting personal information on those platforms.
• Game content delivered within the md303 platform by third-party studios (Pragmatic Play, Evolution Gaming, PG Soft, etc.) is served within md303's secure environment. Game studios do not have access to your full Personal Data through the game delivery interface.

md303 reserves the right to update or revise this Privacy Policy at any time. Changes will take effect upon posting of the revised policy on this page, together with an updated effective date. For material changes — those that meaningfully affect your rights, the scope of data collection, or the categories of third parties with whom data is shared — md303 will provide a minimum of 14 calendar days' advance notice via email to your registered address before the changes take effect.

• Continued use of the md303 platform after a revised Privacy Policy has taken effect constitutes your acceptance of the updated terms.
• If you do not agree with a revised Privacy Policy, you should cease using the platform and request Account closure before the revised policy's effective date.
• Minor clarifications, typographical corrections, or updates that do not materially affect your rights may be applied immediately without advance notice.
• md303 maintains an internal version log of all Privacy Policy revisions. You may request a copy of a previous version by contacting support.

For all privacy-related enquiries, data subject access requests, or concerns about how md303 handles your Personal Data, please contact our support team using the details below. All privacy requests are treated with priority and handled by a dedicated team member.

Our customer support team is available 24 hours a day, 7 days a week including all Indonesian public holidays (Idul Fitri, Idul Adha, Indonesian Independence Day, Nyepi, Christmas, and others). Support agents are available in both English and Indonesian to ensure that all Players can communicate their privacy concerns effectively.

If you are not satisfied with md303's response to your privacy request, you have the right to escalate your complaint to the relevant data protection authority or dispute resolution body in your jurisdiction.