Privacy Policy

1. Definitions

Throughout this Privacy Policy the following terms carry the meanings set out below:

• "mbs388", "We", "Us", or "Our" — the operator of the website https://mbs388.cam and all associated services.
• "You" or "User" — any individual who visits, registers on, or otherwise interacts with mbs388 services.
• "Personal Data" — any information that identifies or can reasonably be used to identify a natural person, including name, email address, phone number, Indonesian ID (KTP) number, bank account details, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, and transmission.
• "KYC" — Know Your Customer: the identity-verification procedure required before We process Your first withdrawal.
• "Cookies" — small text files placed on your device by a web server to store session information and preferences.
• "Third-Party Service Providers" — companies engaged by mbs388 to deliver specific services (e.g., payment processors, fraud-detection vendors) who process Personal Data on Our behalf under strict data-processing agreements.

2. Information We Collect

mbs388 collects Personal Data in the categories described below. We collect only what is genuinely necessary for the purposes stated in Section 4.

2.1 Account Registration Data

• Full legal name (as it appears on your Indonesian ID card)
• Date of birth (used to verify the 21+ age requirement)
• Email address and mobile phone number
• Residential address in Indonesia (city, province, postal code)
• Username and encrypted password (passwords are never stored in plain text)
• Preferred currency (Indonesian Rupiah / IDR)

2.2 Identity Verification (KYC) Data

• Scanned or photographed copy of Indonesian ID card (KTP), showing both sides
• Selfie photograph of You holding the KTP
• Supporting proof-of-residence document dated within the last three months (bank statement, utility bill, or government correspondence)
• KTP number (processed for AML compliance only; not used for marketing)

2.3 Financial Transaction Data

• Bank account name and account number (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja account references)
• Deposit and withdrawal amounts, timestamps, and transaction reference numbers
• Bonus claims and wagering activity (required for bonus-compliance auditing)

2.4 Technical & Behavioral Data

• IP address and approximate geolocation (country, city)
• Browser type, version, and operating system
• Device type and screen resolution
• Session start/end timestamps, pages visited, and features used
• Clickstream data and in-game betting history

2.5 Customer Support Communications

• Live chat transcripts
• WhatsApp message history relating to support enquiries
• Email correspondence between You and Our support team
• Content of complaints and dispute records

3. How We Collect Your Data

We collect Personal Data through the following mechanisms:

• Direct submission — when You complete the registration form, upload KYC documents, initiate a deposit or withdrawal, or contact our support team.
• Automated technical means — server logs, session cookies, and analytics scripts record technical data automatically when You visit or use our platform.
• Third-party payment processors — when you initiate a bank transfer or e-wallet transaction, our payment gateway partners return transaction confirmation data to us.
• Fraud and AML screening tools — licensed third-party services may cross-reference submitted information against sanction lists, politically exposed persons (PEP) databases, and negative-news sources to meet our compliance obligations.

4. Purpose & Legal Basis for Processing

We process your Personal Data for the following specific purposes, each grounded in a recognised legal basis:

5. Data Sharing & Disclosure

mbs388 does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We share your information only in the limited circumstances described below, and only to the minimum extent necessary.

5.1 Third-Party Service Providers

We engage carefully vetted Third-Party Service Providers who process Personal Data solely on our behalf, under binding data-processing agreements that prohibit them from using your data for any purpose other than delivering the contracted service. These providers include:

• Payment processors — to facilitate deposits and withdrawals through Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
• KYC and identity-verification vendors — licensed providers who cross-check submitted identity documents against authoritative data sources for anti-money-laundering (AML) compliance.
• Fraud-detection and risk-management platforms — automated tools that flag suspicious betting patterns, unusual login activity, or potentially fraudulent transactions.
• Customer-support infrastructure providers — live-chat and ticketing systems that enable our support agents to communicate with you securely.
• Platform analytics providers — aggregated, anonymized behavioral analytics tools used to improve site performance and user experience.
• Game software studios — providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive only the session tokens and bet data necessary to run the games you play.

5.2 Legal Disclosure

We may disclose Personal Data to law-enforcement authorities, regulatory bodies, or courts of competent jurisdiction where We are legally required to do so, or where disclosure is necessary to prevent imminent harm, protect mbs388's legal rights, or respond to a valid legal process. In such cases We will disclose only the information specifically requested and will, where legally permitted, notify you promptly.

5.3 Business Transfers

In the event that mbs388 undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and any material change in privacy practices via email and a prominent notice on our website no less than 30 days before the transfer takes effect.

6. Data Retention

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, and to resolve any outstanding disputes or enforce our agreements.

• Active account holders: Personal Data is retained for the full duration of your relationship with mbs388 plus a mandatory five (5) year post-closure period required by international AML regulations.
• KYC documents: Retained for a minimum of five (5) years following account closure, in line with anti-money-laundering compliance requirements.
• Financial transaction records: Retained for seven (7) years from the date of each transaction to satisfy international financial record-keeping standards.
• Customer-support communications: Retained for three (3) years following the resolution of the relevant enquiry or dispute.
• Server logs and technical data: Retained for a rolling period of ninety (90) days for security and fraud-investigation purposes, then automatically purged.
• Marketing preferences and consent records: Retained until you withdraw consent or close your account, whichever occurs first.

When retention periods expire, Personal Data is securely deleted or irreversibly anonymized so that it can no longer be linked to any individual. Anonymized, aggregated data may be retained indefinitely for statistical and platform-improvement purposes.

7. Cookies & Tracking Technologies

mbs388 uses cookies and similar tracking technologies to operate and improve our platform. The table below summarizes the categories of cookies we deploy.

mbs388 does not deploy third-party advertising or behavioural-targeting cookies. You may control cookie preferences through your browser settings. Disabling strictly necessary cookies will impair core site functionality including login and payment processing.

8. Data Security

Protecting your Personal Data is a core operational priority at mbs388. We implement a layered security architecture that includes the following measures:

• Encryption in transit: All communications between your browser or device and our servers are encrypted using TLS 1.3 with 256-bit AES encryption. Insecure HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive data fields — including KTP numbers, bank account numbers, and password hashes — are encrypted at the database level using AES-256.
• Password security: User passwords are stored exclusively as salted bcrypt hashes. We never store passwords in plain text or in a reversible format. Our support agents cannot view your password.
• Access control: Internal access to Personal Data is granted on a strict need-to-know basis. Role-based permissions, multi-factor authentication, and comprehensive audit logs govern all staff access to production databases.
• Regular security audits: We conduct scheduled penetration tests and vulnerability assessments with accredited independent security firms. Critical vulnerabilities are patched within 24 hours of discovery.
• Intrusion detection: Automated monitoring systems scan continuously for anomalous access patterns, unauthorized data exports, and other indicators of compromise.
• Data breach response: In the event of a confirmed data breach affecting your Personal Data, mbs388 will notify affected users within 72 hours of discovery, describing the nature of the breach, data categories affected, and steps taken to contain and remediate the incident.

9. Your Data Rights

As a user of mbs388 services, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our support team at the details provided in Section 13. We will acknowledge your request within five (5) business days and complete it within thirty (30) calendar days, unless a legal exception applies.

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request that we correct any inaccurate or incomplete Personal Data. Certain corrections (e.g., name changes) may require supporting documentation.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations (see Section 6).
• Right to Data Portability: You may request a structured, machine-readable export of the Personal Data you have provided to us directly.
• Right to Restrict Processing: You may ask us to suspend processing of your Personal Data while a correction or objection request is being evaluated.
• Right to Object: You may object to processing based on legitimate interest, including processing for direct marketing or platform analytics.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., promotional emails), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

Please note that certain rights are subject to limitations where compliance with legal obligations (such as AML record-keeping requirements) requires us to retain specific data beyond your request. We will explain any such limitations clearly when responding to your request.

10. Minors & Age Restriction (21+)

mbs388 services are strictly intended for adults aged 21 and above. We do not knowingly collect Personal Data from individuals under the age of 21. Our registration process includes an age-declaration requirement, and KYC verification confirms the date of birth provided at registration against government-issued identification.

If we discover or have reasonable grounds to believe that an account has been registered by a person under 21 years of age, we will immediately suspend the account, void all transactions conducted through that account, and permanently delete all associated Personal Data in accordance with applicable law. Any funds deposited by an underage user will not be returned.

Parents and guardians who believe their child may have registered an account with mbs388 are urged to contact our support team immediately so we can investigate and take appropriate action without delay.

11. International Data Transfers

mbs388 operates server infrastructure in jurisdictions outside Indonesia to support global platform availability, redundancy, and performance. As a result, your Personal Data may be transferred to and processed in countries other than Indonesia. These countries may have data-protection laws that differ from those applicable in Indonesia.

Where such transfers occur, mbs388 ensures that appropriate safeguards are in place, including standard contractual clauses, binding corporate rules, or transfers to jurisdictions that provide an adequate level of data protection as recognised by applicable international standards. By using mbs388 services, you consent to these cross-border data transfers as described herein.

12. Changes to This Privacy Policy

mbs388 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, or platform functionality. When we make material changes, we will:

• Update the "Last Updated" and "Version" fields at the top of this page;
• Send an email notification to your registered email address at least 14 days before the changes take effect;
• Display a prominent notice on our platform for a minimum of 30 days following the update.

Your continued use of mbs388 services after the effective date of any revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with a material change, you have the right to close your account before the effective date by contacting our support team.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by mbs388, please contact our Data Protection team using the details below. All enquiries are treated as strictly confidential.

• Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week, through your account dashboard. Average response time: under 5 minutes.
• WhatsApp Support: Native Indonesian-speaking agents available during WIB business hours (08:00–22:00 WIB, Monday–Saturday).

We aim to respond to all privacy-related correspondence within five (5) business days. Complex requests, such as full data exports or erasure requests requiring cross-system review, may take up to thirty (30) calendar days, and we will keep you informed of progress throughout.