Privacy Policy

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "md200m", "we", "us", "our" — the md200m platform operator, including its subsidiaries, affiliates, officers, employees, agents, and authorised processors acting on its behalf.
• "Platform" — the md200m website at https://md200m.net and all associated digital services, interfaces, and APIs operated under the md200m brand.
• "Player", "you", "your" — any natural person who visits, registers on, or otherwise uses any part of the Platform.
• "Personal Data" — any information that identifies or could reasonably be used to identify a living natural person, including but not limited to name, email address, date of birth, national ID number, financial account details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, transmission, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For all Platform-related data, md200m acts as the Data Controller.
• "Data Processor" — a third party that processes Personal Data on behalf of md200m under a binding data-processing agreement.
• "KYC" — Know Your Customer identity verification procedures mandated by md200m's compliance obligations.
• "IDR" / "Rp" — Indonesian Rupiah, the sole currency used on the Platform.

md200m operates as the Data Controller for all Personal Data collected through the Platform. This means md200m determines why your data is collected and how it is used. Where specific processing activities are carried out by third-party Data Processors (such as payment service providers or KYC verification vendors), those parties act under written contractual instructions from md200m and are not permitted to use your data for their own independent purposes.

If you have any questions or concerns regarding the handling of your Personal Data, the primary point of contact is our Data Protection team, reachable at [email protected].

md200m collects Personal Data across several categories depending on your level of engagement with the Platform:

When you create an md200m Account, we collect the information you submit during registration, which includes:

• Full legal name;
• Date of birth (used to verify the 21+ age requirement);
• Email address and contact telephone number;
• Residential address (city, province, country — Indonesia);
• Username and encrypted password hash.

To comply with our anti-money-laundering (AML) and responsible gaming obligations, we collect:

• Government-issued photo identification (national ID / KTP, passport, or driver's licence);
• Proof of residential address (utility bill, bank statement, or official government correspondence dated within three months );
• Bank account statements or e-wallet screenshots confirming ownership of the payment methods linked to your Account;
• Source-of-funds declaration where deposit thresholds defined by our compliance team are exceeded.

When you make deposits or request withdrawals, we collect:

• Bank account number, account holder name, and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI);
• E-wallet identifiers for OVO, DANA, GoPay, ShopeePay, and LinkAja;
• Transaction amounts, timestamps, and reference numbers;
• Deposit and withdrawal history associated with your Account.

We record all gaming and wagering activity conducted through your Account, including game titles played, bet amounts and outcomes, session durations, sportsbook markets selected, and responsible gaming tool settings you have configured (such as deposit limits and session reminders).

When you access the Platform, our servers and analytics systems automatically collect:

• IP address and approximate geographic location (city/region level);
• Browser type, version, and operating system;
• Device type (desktop, mobile, tablet) and screen resolution;
• Referring URL and pages visited within the Platform;
• Session timestamps and duration;
• Cookie identifiers and similar tracking tokens (see Clause 10).

If you contact our support team via live chat or email, we retain records of those communications, including the content of messages, timestamps, and the resolution outcome, for quality assurance, staff training, and dispute-resolution purposes.

md200m collects Personal Data through the following mechanisms:

• Directly from you — when you register an Account, complete KYC verification, make a deposit or withdrawal request, contact support, or update your profile settings;
• Automatically — through server logs, cookies, pixel tags, and analytics tools as you navigate and interact with the Platform;
• From third-party service providers — including payment processors (banks and e-wallet operators), KYC verification vendors, fraud-detection services, and game studio platforms, when they return data about transactions or identity checks initiated by md200m;
• From publicly available sources — where necessary for AML screening or fraud prevention, md200m may cross-reference information against publicly available sanctions lists or court records.

md200m processes your Personal Data on one or more of the following legal bases depending on the specific processing activity:

md200m uses the Personal Data we collect for the following purposes:

To create, maintain, and secure your Account; to verify your identity and age (21+ requirement); to process login requests; and to communicate account-level notifications such as deposit confirmations, withdrawal status updates, and security alerts.

To facilitate deposits and withdrawals via Indonesian bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet channels (OVO, DANA, GoPay, ShopeePay, LinkAja); to reconcile transaction records; and to investigate and resolve payment disputes.

To satisfy our Know Your Customer obligations; to screen transactions against sanctions lists; to detect, investigate, and report suspicious financial activity as required by applicable law; and to maintain audit trails required by our licensing authority.

To monitor wagering patterns for signs of problem gambling; to enforce deposit limits, loss limits, and session-time settings you have configured; to administer cooling-off periods and self-exclusion requests; and to make proactive welfare interventions where our systems flag a concern.

To identify and prevent multi-accounting, bonus abuse, collusion, and other prohibited activities outlined in our Terms and Conditions; to detect automated or bot-driven activity; and to maintain the integrity of game outcomes and betting markets.

To respond to your enquiries and resolve disputes; to route support tickets to the appropriate team; to maintain records of support interactions for quality assurance and staff training; and to provide our 24/7 Indonesian-speaking support service.

Where you have opted in to receive marketing communications, we may use your email address to send you information about promotions, bonuses, and seasonal offers — including campaigns tied to Indonesian cultural occasions such as Ramadhan, Idul Fitri, and Imlek. You may opt out at any time by contacting support or updating your Account notification preferences.

To analyse aggregated usage patterns; to identify and resolve technical issues; to optimise Platform performance and user experience; and to inform decisions about new product features and game categories.

md200m shares Personal Data with third parties only in the circumstances described below, and only to the minimum extent necessary:

We share necessary transaction and identity data with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) solely for the purpose of processing your deposits and withdrawals. These providers act as Data Processors under contractual obligations to protect your data.

We engage specialist third-party KYC verification and AML screening providers to automate parts of our identity-verification process. These vendors receive only the data necessary to perform the specific verification task and are bound by strict data-processing agreements.

Third-party game studios (including Evolution Gaming, Pragmatic Play, Microgaming, NetEnt, Pocket Games Soft, and Spribe) may receive a session token and limited game-activity data necessary to deliver their games through the Platform. They do not receive your full identity or financial records.

md200m will disclose Personal Data to government bodies, law-enforcement agencies, regulatory authorities, or courts where required by applicable law or a valid legal process, or where we reasonably believe disclosure is necessary to prevent fraud, criminal activity, or threats to safety.

In the event of a merger, acquisition, restructuring, or sale of all or part of md200m's business assets, Personal Data held about Platform players may be transferred to the acquiring entity. You will be notified via email and/or a Platform notice prior to any such transfer, and the acquiring entity will be bound by privacy commitments no less protective than those in this Policy.

md200m retains Personal Data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

When Personal Data is no longer required under the applicable retention period, md200m will securely delete or irreversibly anonymise it so that it can no longer be attributed to an individual.

md200m implements a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. Our technical and organisational security measures include:

• TLS/SSL encryption for all data in transit between your device and our servers;
• AES-256 encryption for sensitive Personal Data and financial records stored at rest;
• Bcrypt hashing for all stored Account passwords — md200m staff cannot read your password in plain text;
• Role-based access controls limiting staff access to Personal Data on a strict need-to-know basis;
• Multi-factor authentication (MFA) enforced for all internal administrative systems;
• 24/7 automated intrusion detection and anomalous-activity monitoring;
• Regular third-party penetration testing and security audits of the Platform infrastructure;
• Staff data-protection training conducted on a mandatory annual basis.

Notwithstanding these measures, no internet-based system can guarantee absolute security. In the event of a data breach that poses a material risk to your rights and freedoms, md200m will notify affected players promptly by email and will take immediate steps to contain and remediate the incident.

md200m uses cookies and similar technologies (pixel tags, local storage) to deliver core Platform functionality, measure performance, and detect fraudulent activity. The categories of cookies we use are as follows:

You can manage optional cookie preferences through your browser settings. Note that disabling functional cookies may affect your experience of the Platform. md200m does not use third-party advertising cookies or behavioural retargeting pixels.

As a player on the md200m Platform, you hold the following rights in relation to your Personal Data. To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receiving a verified request.

• Right of Access: Request a copy of all Personal Data md200m holds about you, along with information about how it is used and with whom it has been shared.
• Right to Rectification: Request correction of any inaccurate or incomplete Personal Data we hold about you.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations (see Clause 8).
• Right to Restriction of Processing: Request that we limit the processing of your data while a dispute about its accuracy or legitimacy is being resolved.
• Right to Data Portability: Receive a machine-readable copy of Personal Data you have provided to md200m, in a structured, commonly used format.
• Right to Object: Object to processing carried out on the basis of legitimate interests (including direct marketing), where you consider your individual circumstances to outweigh md200m's legitimate grounds.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Age verification is a mandatory step in the Account registration process. md200m will not activate an Account or process any wager for a person who cannot demonstrate they meet the 21+ age threshold through our KYC process. If md200m discovers that Personal Data has been collected from a person under 21, all data associated with that Account will be immediately and permanently deleted, the Account will be closed, and any funds held in the Account will be returned to the verified source payment method where practicable.

If you are a parent or guardian and believe that a minor has registered on the md200m Platform, please contact us immediately at [email protected] so we can investigate and take appropriate action without delay.

md200m's primary operations and data infrastructure are designed to serve the Indonesian market. Some of the third-party service providers we engage — including certain game studio platforms and cloud infrastructure providers — may be located outside Indonesia and may process Personal Data in other jurisdictions.

Where Personal Data is transferred internationally, md200m takes appropriate steps to ensure an adequate level of protection is maintained, including through the use of standard contractual clauses, data-processing agreements with binding security obligations, and transfers only to jurisdictions or service providers that md200m's compliance team has assessed as providing equivalent data-protection standards.

md200m may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will notify you by email to the address registered on your Account and/or by displaying a prominent notice on the Platform at least 7 days before the updated Policy takes effect.

The "Last Updated" date at the top of this page reflects when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the Platform after any amendment takes effect constitutes acceptance of the revised Policy. If you do not agree with the revised terms, you may close your Account by contacting our support team.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your Personal Data, please reach out to the md200m Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly on the Platform. Indonesian-speaking agents are available at all hours.
• Email: [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" for prioritised routing.
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a full response within 30 calendar days.
• Support Hours: 24 hours a day, 7 days a week (WIB / UTC+7).