Privacy Policy — mx888

mx888 ("we", "us", "our", "the Platform") is committed to safeguarding the privacy and personal data of all individuals who access or use the mx888 online gaming platform at mx888.lat and its associated services. This Privacy Policy sets out, in clear and transparent terms, the types of personal data we collect from players registered in Indonesia, the purposes for which that data is processed, the safeguards we apply, the parties with whom data may be shared, and the rights available to you as a data subject.

This Privacy Policy applies to all personal data collected through: (a) the mx888 website at mx888.lat; (b) the account registration, login, and KYC verification processes; (c) real-money gaming activity including sportsbook betting, live casino, slot games, and togel (Indonesia's traditional numbers lottery) products; (d) customer support interactions via live chat or email; and (e) any promotional communications sent by mx888.

This Privacy Policy should be read in conjunction with the mx888 Terms & Conditions, which govern the contractual relationship between you and mx888. By creating an account and using our services, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person ("data subject"), including but not limited to a name, identification number, location data, online identifier, or factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this policy, mx888 is the data controller in respect of all personal data collected from players.
• "Processor" — a third party that processes personal data on behalf of mx888, under a written data-processing agreement, solely on mx888's documented instructions.
• "KYC" — Know Your Customer: the identity and age verification process conducted by mx888 to confirm a player's eligibility, identity, and payment method ownership.
• "Cookies" — small text files placed on your device by the mx888 website in order to store session data, preferences, and aggregate usage analytics.
• "Player" / "you" / "your" — any individual who registers an account on the mx888 platform or accesses any of its services.

mx888 collects the following categories of personal data from players. We collect only the data that is necessary for the purposes described in this policy — we do not collect data speculatively or beyond what is required to deliver our services safely and legally.

mx888 does not intentionally collect sensitive personal data beyond what is strictly required for KYC compliance (such as identity document copies). We do not collect biometric data, health data, or religious or political belief information from players.

mx888 collects personal data through the following channels:

• Directly from you — when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact customer support, respond to a survey or promotion, or update your account profile.
• Automatically via technology — when you visit the mx888 website, our servers and analytics tools automatically record technical data such as your IP address, browser type, pages visited, and session duration through the use of cookies and server logs.
• From payment processors — when you initiate a financial transaction, our payment service partners (including local Indonesian bank transfer aggregators and e-wallet providers) may share transaction confirmation data with mx888 to reconcile your account balance.
• From identity verification providers — where mx888 uses a third-party KYC service to verify the authenticity of identity documents, that provider may return verification results (pass/fail and risk scores) to mx888 alongside your submitted document data.
• From fraud prevention services — mx888 may receive risk signals from third-party fraud detection services about your device, IP address, or transaction patterns to protect the platform from abuse.

mx888 processes your personal data only where we have a lawful basis to do so. The primary purposes for which we process personal data, and the corresponding legal basis for each, are set out below:

• Account creation and management — to create and maintain your player account, authenticate your identity at login, and enable you to access the platform's gaming services. Legal basis: performance of contract.
• KYC and age verification — to verify that you are at least 21 years of age and a resident of Indonesia, as required by our platform eligibility rules. Legal basis: legal obligation and legitimate interests.
• Processing deposits and withdrawals — to facilitate the secure transfer of funds in Indonesian Rupiah (IDR / Rp) between your registered payment methods and your mx888 account Balance. Legal basis: performance of contract.
• Fraud prevention and anti-money-laundering compliance — to detect, investigate, and prevent fraudulent transactions, account abuse, collusion, and money laundering activity on the platform. Legal basis: legal obligation and legitimate interests.
• Responsible gaming monitoring — to monitor gaming patterns for indicators of problem gambling and to enforce any deposit limits, time-out periods, or self-exclusion requests that you have activated. Legal basis: legal obligation and legitimate interests.
• Customer support — to respond to your enquiries, complaints, and support requests submitted via live chat or email. Legal basis: performance of contract and legitimate interests.
• Promotional communications — to send you information about mx888 bonuses, promotions, and seasonal offers relevant to the Indonesian market (e.g., Idul Fitri promotions, Imlek bonus offers) where you have opted in to receive such communications. Legal basis: consent.
• Platform improvement and analytics — to analyse aggregate usage data and understand how players interact with the mx888 platform, in order to improve the user experience, game selection, and service performance. Legal basis: legitimate interests.
• Legal and regulatory compliance — to comply with applicable laws, regulatory requirements, court orders, and law-enforcement requests. Legal basis: legal obligation.

mx888 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We may share your personal data with the following categories of recipients, and only to the extent strictly necessary for the purpose stated:

• Payment service providers — Indonesian bank transfer aggregators and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable Indonesian financial regulations.
• KYC and identity verification providers — third-party services engaged by mx888 to verify the authenticity of identity documents submitted during the KYC process. These providers are contractually bound to use your data solely for verification purposes.
• Fraud detection and risk management services — providers that supply device fingerprinting, IP reputation, and transaction risk-scoring services to help mx888 detect and prevent fraudulent activity on the platform.
• Game software providers — studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe may receive your player session token and stake data in order to operate their games within the mx888 platform. These providers do not receive your identity or financial data beyond what is required for game operation.
• Customer support platform providers — the live chat and ticketing software used by mx888's support team to manage and respond to player enquiries. Your chat content and account identifiers may be processed through this software.
• Legal and regulatory authorities — mx888 may disclose your personal data to law-enforcement agencies, regulators, or courts where required to do so by applicable law, or where necessary to protect the legal rights of mx888 or third parties.
• Business successors — in the event of a merger, acquisition, or sale of all or part of mx888's business, player personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections.

mx888 is an internationally operated platform, and some of our service providers — including game studios, fraud detection services, and cloud infrastructure providers — are located outside Indonesia. As a result, your personal data may be transferred to, stored in, or processed in countries other than Indonesia.

Wherever personal data is transferred outside Indonesia, mx888 takes steps to ensure that appropriate safeguards are in place to protect the data and that the transfer complies with applicable data protection standards. Such safeguards include contractual data-processing agreements that impose obligations on the recipient equivalent to those that apply to mx888 under this Privacy Policy.

By using the mx888 platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Indonesia for the purposes described in this policy. If you have questions about specific international transfers, please contact our support team at [email protected].

mx888 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, and to resolve any disputes or enforce our agreements. The following general retention periods apply:

• Account and identity data — retained for the duration of your active account relationship with mx888, and for a minimum of five (5) years following account closure, to comply with anti-money-laundering record-keeping requirements.
• Financial transaction records — retained for a minimum of five (5) years following the date of the transaction, in accordance with applicable financial compliance obligations.
• KYC documents — retained for the duration of your active account and for a minimum of five (5) years following account closure. After this period, document images are securely destroyed.
• Gaming history — retained for the duration of your active account and for a minimum of three (3) years following account closure, for dispute resolution and responsible gaming monitoring purposes.
• Customer support records — retained for two (2) years following the closure of the relevant support interaction, unless the interaction relates to an ongoing dispute, in which case records are retained until that dispute is fully resolved.
• Technical and analytics data — anonymised aggregate usage analytics are retained indefinitely for platform improvement purposes. Raw technical log data containing IP addresses is retained for up to ninety (90) days.
• Marketing preference data — retained until you opt out of marketing communications or close your account, at which point your marketing preference record (including the opt-out) is retained for three (3) years as evidence of your consent status.

When personal data is no longer required and the applicable retention period has elapsed, mx888 will securely delete or anonymise it so that it can no longer be associated with any individual player.

mx888 uses cookies and similar technologies (including session tokens and local storage) to operate the platform, maintain your login session, remember your display preferences, and collect aggregate usage analytics. The following categories of cookies are used on the mx888 platform:

• Strictly Necessary Cookies — essential for the platform to function. They enable core features such as account login session management, security token validation, and balance display. These cookies cannot be disabled without affecting platform functionality.
  • Examples: session ID token, CSRF protection token, language preference cookie.
• Functional Cookies — used to remember your display preferences and personalisation choices across sessions.
  • Examples: preferred game lobby view, remembered username (if enabled), notification preferences.
• Analytics Cookies — used to collect aggregated, anonymised data about how players navigate the mx888 platform, which pages are most visited, and how long sessions last. This data helps us improve the platform experience.
  • Examples: page view counters, session duration tracking, in-lobby navigation heatmaps. These analytics are processed internally — mx888 does not use Google Analytics or any third-party advertising analytics network.

mx888 does not use third-party advertising or retargeting cookies. You will not see mx888 display advertisements follow you around the web as a result of cookies set by the platform.

As a player using the mx888 platform, you have the following rights with respect to your personal data. To exercise any of these rights, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and include your registered account username.

• Right of Access — you have the right to request a copy of the personal data that mx888 holds about you, along with information about how it is being processed. We will respond to access requests within thirty (30) calendar days.
• Right to Rectification — if any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may also update certain account details (such as your contact email) directly through your account profile settings.
• Right to Erasure ("Right to Be Forgotten") — you may request that mx888 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and there is no other lawful basis for processing), or where the data has been processed unlawfully. This right is subject to our legal retention obligations — we cannot delete financial records that we are required to keep by law.
• Right to Restriction of Processing — you may request that mx888 restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested, or while you object to processing based on legitimate interests.
• Right to Data Portability — where processing is based on your consent or on a contract, you have the right to receive the personal data you have provided to mx888 in a structured, commonly used, machine-readable format, and to transmit that data to another controller.
• Right to Object — you have the right to object at any time to the processing of your personal data for direct marketing purposes. You may opt out of promotional emails by clicking the unsubscribe link included in any marketing email, or by contacting support directly.
• Right to Withdraw Consent — where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal.

mx888 will respond to all valid privacy rights requests within thirty (30) calendar days of receipt. In complex cases, we may extend this period by a further thirty (30) days, in which case we will notify you of the extension and the reason for the delay within the initial thirty-day window.

mx888 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit TLS (Transport Layer Security) encryption for all data transmitted between your browser or device and the mx888 platform, ensuring that your login credentials, financial data, and account information cannot be intercepted in transit.
• Encryption of sensitive data fields at rest, including stored passwords (hashed using a modern algorithm), identity document data, and financial account details.
• Role-based access controls ensuring that mx888 staff can only access the player data necessary for their specific job function. No single employee has unrestricted access to all data categories.
• Regular independent security audits and penetration testing of the mx888 platform infrastructure to identify and remediate vulnerabilities before they can be exploited.
• Intrusion detection and anomaly monitoring systems that generate alerts for unusual login patterns, bulk data access, or transaction irregularities.
• Two-factor authentication (2FA) available to players and mandatory for all mx888 staff accounts with access to player data systems.
• Secure deletion procedures for personal data that has reached the end of its applicable retention period.

While mx888 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is completely secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, mx888 will notify affected players without undue delay and will take all necessary steps to contain the breach and mitigate its impact.

The mx888 platform is strictly intended for adults aged 21 and over. mx888 does not knowingly collect personal data from individuals under the age of 21. Our registration process includes an age declaration requirement, and all accounts are subject to KYC age verification before withdrawals are permitted.

If mx888 becomes aware that personal data has been collected from a player who is under 21 years of age, we will immediately suspend the relevant account, void any associated balance, and permanently delete the personal data collected. If you believe that an individual under the age of 21 has created an account on the mx888 platform, please contact us immediately at [email protected] so that we can take appropriate action.

mx888 may update this Privacy Policy from time to time to reflect changes in our data processing practices, new legal or regulatory requirements, new services or features added to the platform, or other operational developments. When we make material changes to this Privacy Policy, we will notify registered players by email to their registered address and will update the "Last Updated" date at the top of this page.

For non-material changes — such as minor editorial clarifications that do not alter the substantive rights or obligations of players — mx888 will update the page and the "Last Updated" date without individual email notification. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Your continued use of the mx888 platform after notification of a material change to this Privacy Policy constitutes your acceptance of the revised policy. If you do not accept the changes, you should stop using the platform and contact support to close your account and request deletion of your data.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which mx888 processes your personal data, please contact us using the following details. Our team aims to respond to all privacy-related enquiries within 48 hours (WIB, UTC+7).

For urgent matters including suspected unauthorised access to your account or a potential data breach, please use the 24/7 live chat function available on the mx888 platform so that our Indonesian-speaking support team can assist you in real time and escalate security matters immediately.

This Privacy Policy was last updated in January 2026 and is effective from that date. The current version of this Privacy Policy is always available at mx888.lat/privacy-policy.