At mdu303, we treat your personal data with the same care we apply to every other aspect of our platform. This Privacy Policy explains clearly what information we collect, why we collect it, how we use it, and what rights you hold as a player registered in Indonesia.
Six core principles that govern how mdu303 handles every piece of data you share with us.
mdu303 collects only the personal data that is strictly necessary to operate your account, verify your identity, process transactions, and comply with our licensing obligations. We do not harvest data for its own sake.
All data transmitted between your device and mdu303's servers is protected by industry-standard TLS/SSL encryption. Sensitive data at rest — including payment details and identity documents — is stored using AES-256 encryption protocols.
mdu303 does not sell, rent, or trade your personal data to third-party marketers under any circumstances. Data sharing with external parties is limited strictly to service providers who are contractually bound to protect your information.
You have the right to access, correct, export, and in certain circumstances delete the personal data mdu303 holds about you. Submit a request to our support team at any time and we will respond within 30 days.
mdu303 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable licensing and anti-money laundering regulations. When retention periods expire, data is securely deleted or anonymized.
When mdu303 makes material changes to this Privacy Policy, we will notify registered players via email or in-platform notification and update the effective date at the top of this document. Your continued use of the platform constitutes acceptance of the revised policy.
mdu303 is an online gaming and sports betting platform accessible at https://mdu303.net and through associated mobile applications and subdomains. mdu303 operates under an international gaming licence and serves English-preference players located primarily across Indonesia, including major metropolitan areas such as Jakarta, Surabaya, Bandung, Medan, Semarang, Makassar, and Bali.
For the purposes of this Privacy Policy, mdu303 is the data controller responsible for determining how and why your personal data is processed. Where mdu303 engages third-party processors (such as payment processors, KYC verification providers, or cloud hosting services), those parties act as data processors under contractual data protection obligations consistent with this Policy.
If you have any questions about this Policy or about how your data is handled, please refer to Section 15 (Contact Us) for our contact details.
mdu303 collects personal data in the categories described in the table below. We collect only what is necessary and proportionate for the specific purposes identified in Section 4.
| Category | Examples |
|---|---|
| Identity Data | Full legal name, date of birth, gender, nationality, Indonesian national identity card (KTP) number, passport number. |
| Contact Data | Email address, mobile phone number, Indonesian residential address (city, province, postal code). |
| Account Data | Username, encrypted password, account creation date, account status, preferred currency (IDR), language preference. |
| Financial Data | Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history, deposit and withdrawal records. |
| KYC / Verification Data | Copies of government-issued identity documents, proof of address documents, selfie/liveness-check images submitted for identity verification. |
| Gaming & Betting Data | Bet history, game session records, wagering patterns, bonus usage, win/loss records. |
| Technical Data | IP address, device type and model, operating system, browser type and version, device identifiers, geolocation data (city/province level), session timestamps. |
| Communications Data | Records of live chat conversations, in-app messages, and email correspondence with mdu303 support. |
| Responsible Gaming Data | Deposit limits, session limits, self-exclusion requests, cool-off periods, and any responsible gaming assessments conducted by our team. |
The majority of personal data mdu303 holds about you is provided directly by you during the account registration process, identity verification (KYC), payment method setup, and any communications you initiate with our support team. This includes all identity, contact, account, and financial data categories listed in Section 2.
When you access and use the mdu303 platform — whether through a desktop browser, mobile browser, or the mdu303 app — our systems automatically collect technical data including your IP address, device identifiers, browser characteristics, and session timestamps. This data is collected using server logs, session tracking technology, and cookies as described in Section 7.
mdu303 may receive data about you from third-party service providers engaged to support our operations. This includes identity and document verification providers who return a verification status on submitted KYC documents, payment processors who confirm transaction completion, and fraud detection services that provide risk scores based on anonymized behavioral patterns. In all such cases, third-party data sharing is governed by binding data processing agreements.
In limited circumstances — primarily for enhanced fraud prevention or AML compliance — mdu303 may cross-reference data you provide against publicly available sources such as official government sanction lists and politically exposed persons (PEP) databases.
mdu303 processes your personal data for the following specific purposes. Each purpose is matched to a legal basis as outlined in Section 5.
mdu303 processes your personal data under one or more of the following legal bases:
| Legal Basis | When It Applies |
|---|---|
| Contractual necessity | Processing required to deliver the services set out in our Terms & Conditions — including account management, payments, and game access. |
| Legal obligation | Processing required to comply with applicable laws and regulatory requirements, including KYC, AML obligations, and licensing conditions. |
| Legitimate interests | Processing necessary for mdu303's legitimate business interests — primarily fraud prevention, platform security, responsible gaming monitoring, and business analytics — where those interests are not overridden by your data protection rights. |
| Consent | Processing based on your explicit, freely given consent — primarily marketing communications. Consent can be withdrawn at any time without detriment to your account. |
| Vital interests | Processing that may be necessary to protect the vital interests of a player in a responsible gaming emergency context. |
mdu303 shares personal data with carefully selected third-party service providers who process data on our behalf under binding data processing agreements. Categories of service providers include: identity verification and KYC providers, payment processors and banking partners, cloud infrastructure and hosting providers, fraud detection and AML screening providers, and customer support platform providers. These service providers are permitted to use your data solely for the purpose of delivering the contracted service to mdu303 and are prohibited from using it for their own marketing or commercial purposes.
To deliver live casino, slots, and other game content, mdu303 integrates with licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. These studios may receive anonymized session and game-outcome data necessary for game operation, but do not receive your full personal profile or financial data.
mdu303 may be required to disclose personal data to regulatory bodies, gaming authorities, financial intelligence units, or law enforcement agencies where required by applicable law or mdu303's licensing obligations. Such disclosures will be made in accordance with applicable legal requirements and, where permissible, mdu303 will notify affected players of any such disclosure.
In the event of a merger, acquisition, restructuring, or sale of all or part of mdu303's business, personal data may be transferred as part of that transaction. mdu303 will notify registered players of any such transfer via email or in-platform notification and will ensure that the acquiring entity adopts data protection standards consistent with this Privacy Policy.
mdu303 does not sell, rent, lease, or otherwise commercially exploit your personal data to third parties. This commitment is absolute and unconditional.
Cookies are small text files stored on your device when you visit a website. mdu303 uses cookies and similar technologies (including local storage and session tokens) to ensure the platform functions correctly, to maintain your login session, and to analyze platform performance.
You may manage or disable non-essential cookies through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the mdu303 platform. For detailed guidance on managing cookies in major browsers (Chrome, Firefox, Safari, Samsung Internet — the most commonly used browsers among Indonesian mobile users), please refer to your browser's help documentation.
mdu303 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, after which it is securely deleted or irreversibly anonymized. The key retention periods that apply to player data are set out below:
| Data Category | Retention Period |
|---|---|
| Account & Identity Data | For the duration of the active account, plus 5 years from account closure — to satisfy licensing and AML record-keeping obligations. |
| Financial & Transaction Data | 7 years from the date of each transaction, in line with standard financial record-keeping requirements. |
| KYC Documents | 5 years from account closure or from the date the document was submitted, whichever is later. |
| Communications Data | 3 years from the date of the communication, for quality assurance and dispute resolution purposes. |
| Technical & Log Data | Up to 13 months, used for security monitoring, fraud detection, and platform performance analysis. |
| Responsible Gaming Records | 5 years from account closure — to support self-exclusion enforcement and regulatory audits. |
| Marketing Consent Records | Until consent is withdrawn, plus 3 years thereafter as evidence of prior consent. |
When data reaches the end of its retention period, mdu303 will delete it from active systems and ensure it is purged from backup systems within a reasonable subsequent period.
mdu303 implements robust technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Key security measures include:
As a player registered on mdu303, you hold the following rights in respect of your personal data. To exercise any of these rights, contact our support team using the details in Section 15. mdu303 will respond to all valid rights requests within 30 days.
mdu303 will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive. Where a request is particularly complex or there are numerous requests, mdu303 may extend the response period by a further 30 days, with written notification provided to you.
mdu303 implements age verification as a mandatory step of the registration and KYC process. Players must confirm that they are at least 21 years of age during registration and must provide a valid government-issued identity document confirming their date of birth before any real-money gaming activity is permitted.
If you believe that a minor has registered on the mdu303 platform, please contact our support team immediately at [email protected]. Such reports are treated as the highest priority and investigated within 24 hours.
As an internationally licensed platform, mdu303 may transfer your personal data to servers or service providers located outside Indonesia. When such transfers occur, mdu303 ensures that appropriate safeguards are in place to protect your data to a standard consistent with this Privacy Policy. Safeguards may include standard contractual clauses, binding corporate rules, or transfers to jurisdictions that maintain adequate data protection standards.
By registering on mdu303, you acknowledge that your data may be transferred to and processed in countries outside Indonesia. mdu303 will not transfer personal data to jurisdictions that lack adequate data protection safeguards without your consent or a legitimate legal basis for doing so.
The mdu303 platform may contain references to third-party game studios, payment partners, and sporting organizations. These references do not constitute active external hyperlinks within mdu303's own pages; however, where third-party interfaces load within the platform (such as game launch windows from Pragmatic Play or Evolution Gaming), those interfaces are governed by the respective studio's own privacy policies.
mdu303 is not responsible for the data practices of any third-party studio or payment provider operating within their own interface. We encourage you to review the privacy policies of any third-party services you interact with through the mdu303 platform.
mdu303 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or our platform's features. When material changes are made, mdu303 will:
Your continued use of the mdu303 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with any updated terms, you must cease using the platform and contact support to close your account and request data deletion where applicable.
If you have any questions, concerns, or requests relating to this Privacy Policy or the way mdu303 handles your personal data, please contact us through any of the following channels:
mdu303 aims to respond to all privacy-related enquiries within 5 business days. For formal data subject rights requests (access, deletion, portability), please allow up to 30 days for a full response, as set out in Section 10.
All privacy correspondence should be directed to the attention of the mdu303 Data Protection team. Please include your registered username and the email address associated with your account so that we can locate your records promptly and respond accurately.
Now that you understand how mdu303 protects your personal data, explore everything our platform has to offer — from live sports betting and slots to a full live casino experience, all secured with SSL encryption and backed by 24/7 support.
Licensed & Regulated Internationally · SSL Encrypted · Provably Fair Games · Adults 21+ Only