madu03 Privacy Policy

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

madu03 acts as the Data Controller for all Personal Data collected through the Platform. The Company is incorporated and licensed in an internationally recognised gaming jurisdiction and processes Personal Data in accordance with the data protection laws of that jurisdiction.

While madu03 primarily serves players resident in Indonesia — across Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, and beyond — the Platform is operated offshore. As a result, Indonesian domestic data protection legislation may not apply directly to all aspects of our data processing. Nevertheless, madu03 voluntarily commits to the privacy standards described in this Policy as a baseline minimum for all Users, regardless of their location.

For all data protection enquiries, please contact our Data Protection Officer through the support channels listed in Section 14 of this Policy.

madu03 collects Personal Data through three primary channels: information you provide directly, information generated automatically by your use of the Platform, and information received from trusted third-party partners.

3.1 Information You Provide Directly

• Registration data: Full legal name, date of birth, residential address (including city and province within Indonesia), email address, and chosen username.
• Identity verification (KYC) documents: Scanned or photographed copies of government-issued identity documents — typically a Kartu Tanda Penduduk (KTP / Indonesian National Identity Card), passport, or driving licence (SIM) — together with proof of residential address.
• Financial data: Bank account numbers (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction amounts in Indonesian Rupiah (IDR / Rp).
• Communications: The content of messages you send to our customer support team via live chat or email, together with associated metadata.
• Responsible gaming data: Self-imposed deposit limits, session time limits, self-exclusion requests, and the outcomes of responsible gaming assessments.

3.2 Information Collected Automatically

• Device and technical data: IP address, browser type and version, operating system, device type (mobile / desktop), screen resolution, and referring URL.
• Usage data: Pages visited, time spent on each page, game titles accessed (including slot gacor (high-RTP slot) titles, live casino tables, and togel (Indonesia's traditional numbers lottery) markets), betting history, odds accepted, and session timestamps recorded in Western Indonesia Time (WIB, UTC+7).
• Cookie and tracking data: See Section 7 for full details.

3.3 Information from Third Parties

• KYC and fraud prevention partners: Identity verification results, watchlist screening outcomes, and risk scores provided by our contracted KYC service providers.
• Payment processors: Transaction confirmation data, payment method validation results, and chargeback notifications from our banking and e-wallet partners.
• Analytics providers: Aggregated, anonymised behavioural analytics used to improve the Platform's user experience.

madu03 uses your Personal Data for the following specific purposes:

madu03 processes your Personal Data only where a valid legal basis exists. The primary legal bases we rely on are as follows:

• Contractual Necessity: Processing that is required to perform the contract between you and madu03 — including account creation, transaction processing, and customer support. Without this processing, we cannot provide the Platform's services to you.
• Legal Obligation: Processing required to comply with applicable laws and regulations — including KYC identity verification, anti-money-laundering screening, and responding to lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out in pursuit of the Company's legitimate business interests — including fraud detection, platform security, and aggregated analytics — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

madu03 does not sell your Personal Data. We share your data only in the specific circumstances described below, and only to the extent strictly necessary for the stated purpose:

6.1 KYC and Identity Verification Providers. To comply with our licensing obligations, we share identity document images and registration data with contracted KYC service providers who conduct identity checks, age verification (21+), and watchlist screening. These providers operate under binding data processing agreements and are prohibited from using your data for any purpose other than the verification service.

6.2 Payment Processors and Banking Partners. To facilitate deposits and withdrawals, we share the minimum necessary financial data with our payment processing partners — including Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). These partners process transaction data under their own privacy policies, to which we recommend you refer.

6.3 Fraud Prevention and Security Services. We share device fingerprints, IP addresses, and behavioural data with fraud detection service providers to identify multi-accounting, bonus abuse, money laundering, and other prohibited conduct. All such providers are contractually bound to process this data solely for fraud prevention purposes.

6.4 Technology and Infrastructure Providers. The Platform relies on third-party cloud hosting, content delivery, and database infrastructure providers. These providers may technically access Personal Data as part of their service delivery but are contractually prohibited from processing it for their own purposes.

6.5 Legal and Regulatory Disclosure. We may disclose Personal Data to regulatory bodies, law enforcement agencies, or courts where we are required to do so by law, court order, or binding regulatory request. Where legally permissible, we will notify you of such a disclosure.

6.6 Corporate Transactions. In the event of a merger, acquisition, or sale of all or part of the Company's assets, Personal Data held by madu03 may be transferred to the acquiring entity, subject to equivalent privacy protections. Users will be notified of any such transfer via their registered email address.

madu03 uses cookies and similar tracking technologies — including web beacons and local storage — to operate and improve the Platform. The cookies we deploy fall into the following categories:

You may manage cookie preferences through your browser's built-in settings. Please note that disabling strictly necessary cookies will impair or prevent access to the Platform. madu03 does not use third-party advertising cookies or cross-site tracking cookies for the purpose of serving targeted advertisements on external websites.

madu03 retains Personal Data for only as long as is necessary for the purposes for which it was collected, subject to any longer retention period required by our gaming licence conditions or applicable law. The following retention periods apply as a general framework:

• Account data and transaction records: Retained for a minimum of 5 years following account closure to satisfy anti-money-laundering record-keeping requirements under our licensing jurisdiction's regulations.
• KYC identity documents: Retained for a minimum of 5 years from the date of verification or from the date of last transaction, whichever is later.
• Customer support communications: Retained for 3 years from the date of the last communication in a given support thread, after which they are securely deleted.
• Marketing consent records: Retained for as long as your marketing consent remains active, and for 3 years following withdrawal of consent to demonstrate compliance.
• Session and usage logs: Retained for 13 months on a rolling basis, after which they are automatically purged or anonymised.
• Fraud and security investigation records: Retained for up to 7 years where a confirmed or suspected fraud, money laundering, or prohibited conduct incident has been recorded.

Upon expiry of the applicable retention period, Personal Data is either securely deleted using industry-standard data destruction methods or irreversibly anonymised such that it can no longer be linked to any identifiable individual.

As madu03 operates as an internationally licensed online betting platform, Personal Data collected from Users in Indonesia and other jurisdictions is stored and processed on servers located outside Indonesia. This means that your data may be transferred to and processed in countries whose data protection laws differ from those of Indonesia.

Where Personal Data is transferred to a third-party Data Processor located in a jurisdiction that does not provide an equivalent level of data protection, madu03 implements appropriate safeguards — including standard contractual clauses, data processing agreements, and technical security measures — to ensure that your data receives a consistent level of protection regardless of where it is processed.

By registering an Account on the madu03 Platform, you acknowledge and consent to the transfer of your Personal Data to our servers and contracted third-party processors located outside Indonesia, subject to the protections described in this Policy.

Subject to applicable law and our licensing obligations, madu03 recognises the following rights for all registered Users with respect to their Personal Data:

• Right of Access: You have the right to request a copy of the Personal Data we hold about you, together with information about how it is processed. We will respond to access requests within 30 days of receipt.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Minor corrections — such as updating your contact email address — can be made directly within your Account settings.
• Right to Erasure: In certain circumstances, you have the right to request that we delete your Personal Data. This right is subject to limitations where retention is required by our licensing obligations, anti-money-laundering regulations, or for the establishment, exercise, or defence of legal claims.
• Right to Restriction of Processing: You may request that we temporarily suspend the processing of your Personal Data while the accuracy of the data or the legitimacy of the processing is being assessed.
• Right to Data Portability: You have the right to receive a copy of the Personal Data you have provided to us in a structured, commonly used, machine-readable format (such as JSON or CSV), and to request that it be transmitted to another controller where technically feasible.
• Right to Object: You have the right to object to the processing of your Personal Data where that processing is based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (primarily for marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our support team via live chat or the email address listed in Section 14. We may require you to verify your identity before processing a data subject request. We will acknowledge your request within 5 business days and aim to fulfil it within 30 days.

The madu03 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect, store, or process Personal Data relating to individuals under the age of 21. If we become aware that Personal Data has been collected from a person under the age of 21, we will immediately suspend the associated Account, delete all related Personal Data, and — where required — notify the appropriate authorities.

If you are a parent or guardian and believe that a person under your care has registered an account on madu03 or has otherwise provided us with Personal Data, please contact our support team immediately using the contact details in Section 14. We will take prompt action to investigate and resolve the situation.

madu03 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS 1.3): All data transmitted between your browser and our servers is encrypted using TLS 1.3, the current industry-leading transport encryption standard.
• Data Encryption at Rest: Sensitive Personal Data — including identity documents and financial records — is encrypted at rest using AES-256 encryption.
• Password Hashing: Account passwords are hashed using a modern, computationally expensive hashing algorithm (bcrypt with an appropriate cost factor). No password is ever stored or accessible in plaintext.
• Access Controls: Access to Personal Data within the Company's internal systems is restricted on a strict need-to-know basis. All internal data access events are logged and subject to periodic audit.
• Intrusion Detection: The Platform's infrastructure is monitored 24 hours a day, 7 days a week by automated intrusion detection systems configured to alert the security team to anomalous activity in real time.
• Penetration Testing: The Platform undergoes regular independent security penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Staff Training: All Company employees and contractors who handle Personal Data receive mandatory data protection and security awareness training as a condition of their engagement.

Despite these measures, no online system can be guaranteed to be completely secure. madu03 cannot warrant absolute security but commits to responding promptly and transparently to any security incident that may affect your Personal Data.

madu03 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, new legal or regulatory requirements, or improvements to the Platform. All changes will be effective immediately upon publication of the revised Policy at https://madu03.cam/privacy-policy.

Where a change is material — meaning it significantly affects your rights as a data subject or alters how we use your Personal Data in a way that requires your consent — we will notify you in advance via your registered email address and, where appropriate, display a prominent notice on the Platform. Your continued use of the Platform following notification of a material change constitutes your acceptance of the revised Policy.

We recommend that you review this Privacy Policy periodically to stay informed of how madu03 handles your Personal Data. The effective date at the top of this page indicates when the current version was last updated.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by madu03, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week — including all Indonesian public holidays such as Idul Fitri, Nyepi, and Indonesian Independence Day. First response within 90 seconds.
• Support Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Subject Request" to ensure your message is routed to the appropriate team. We aim to respond to all privacy-related emails within 4 business hours during 09:00–21:00 WIB.

When submitting a data subject request, please include your registered username and the email address associated with your Account so that we can locate your records and verify your identity efficiently. We may request additional verification before processing requests that involve access to, correction of, or deletion of Personal Data.