Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how mbakad ("Company", "We", "Us", "Our") collects, processes, stores, and shares personal information about individuals who visit our website at mbakad.cam, register an account, use our betting and gaming services, or otherwise interact with our platform (collectively, "Services"). This Policy applies to all users located in Indonesia and any other jurisdiction from which the Services are accessible.

By using mbakad's Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to these terms, you must discontinue use of the Services immediately. This Policy should be read in conjunction with our Terms & Conditions, which govern your overall use of the platform.

mbakad respects your privacy and is committed to transparency in all data-processing activities. We do not collect more information than is necessary to provide a secure, functional, and compliant gaming experience. Where alternative approaches to data collection exist, we prefer the option that involves less personal data.

2. Definitions

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, including name, identity number, contact details, financial data, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means mbakad, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of mbakad under a data-processing agreement.
• "Cookies" means small text files placed on your device by our website to facilitate functionality, analytics, and personalization.
• "KYC" (Know Your Customer) means the identity verification procedure required before withdrawal processing.
• "User", "You", or "Your" means any individual who accesses or uses mbakad's Services.
• "Sensitive Data" means categories of Personal Data that warrant heightened protection, including government-issued identification numbers and financial account details.

3. Information We Collect

3.1 Information You Provide Directly

When you register, verify your identity, or contact us, you may provide:

• Registration data: full legal name, date of birth, email address, phone number, and residential address
• Identity verification (KYC): copies of your KTP (Kartu Tanda Penduduk), passport, or other government-issued identification
• Payment information: bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, or other supported banks) and e-wallet account identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Support communications: correspondence records when you contact our customer service team
• Responsible gaming preferences: self-exclusion requests, deposit limits, and cooling-off period settings

3.2 Information Collected Automatically

When you use our platform, we automatically collect:

• Device and browser data: IP address, device type, operating system, browser version, and screen resolution
• Usage data: pages visited, session duration, click patterns, search queries, game history, betting history, and deposit/withdrawal activity
• Location data: approximate geographic location derived from IP address (we do not collect precise GPS coordinates)
• Cookie and tracking data: session identifiers, preference cookies, analytics tags, and fraud-detection signals
• Transaction metadata: timestamps, amounts, payment method references, and transaction status logs

3.3 Information from Third Parties

We may receive data about you from:

• Identity verification and KYC service providers who confirm the authenticity of documents you submit
• Payment processors and banks who provide transaction confirmation data
• Fraud detection and anti-money laundering (AML) screening services
• Game providers (Pragmatic Play, Evolution Gaming, Microgaming, etc.) who share session and outcome data to enable accurate account crediting

4. How We Use Your Information

mbakad uses the personal data we collect for the following purposes:

Purpose	Data Used	Legal Basis
Account creation and management	Name, email, phone, date of birth	Contract performance
Identity verification (KYC)	KTP/passport, selfie, bank details	Legal obligation
Processing deposits and withdrawals	Bank account, e-wallet ID, transaction data	Contract performance
Fraud prevention and AML compliance	Transaction patterns, IP address, device data	Legal obligation / Legitimate interest
Customer support	Communication history, account data	Contract performance
Platform personalization	Betting history, game preferences, usage data	Legitimate interest
Responsible gaming monitoring	Betting patterns, session data, deposit frequency	Legal obligation / Legitimate interest
Marketing communications (opt-in only)	Email, phone, preference data	Consent
Analytics and service improvement	Aggregated usage data, device data	Legitimate interest
Legal compliance and dispute resolution	All relevant account data	Legal obligation

5. Legal Basis for Processing

mbakad processes your Personal Data on the following legal grounds under applicable Indonesian personal data protection law and international standards:

• Contract performance: Processing is necessary to fulfill our obligations to you under the Terms & Conditions, including managing your account, processing bets, and handling financial transactions.
• Legal obligation: We are required by law to perform KYC identity checks, maintain transaction records, comply with anti-money laundering regulations, and report certain activities to relevant authorities.
• Legitimate interests: We process data to detect fraud, prevent abuse of our platform, improve our services, and personalize your experience, provided these interests do not override your fundamental rights.
• Consent: For optional processing activities such as marketing communications and non-essential cookies, we rely on your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

6. Information Sharing and Disclosure

mbakad does not sell your Personal Data. We share your information only in the circumstances described below, and always subject to appropriate confidentiality and security requirements.

6.1 Service Providers

We share data with vetted third-party service providers who process it on our behalf under strict data-processing agreements. These include KYC and identity verification providers, payment processors and banking intermediaries, cloud hosting and data storage providers, fraud detection and cybersecurity firms, and analytics providers that process only anonymized or aggregated data.

6.2 Game Providers

To operate our casino and sports betting products, we share necessary session data with game providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and Pocket Games Soft. These providers receive only the data required to deliver game results, process bets, and handle jackpot payouts.

6.3 Legal and Regulatory Disclosure

We may disclose your Personal Data to competent authorities, law enforcement agencies, or regulatory bodies when required to do so by applicable law, court order, or regulatory obligation. We will notify you of such disclosures wherever legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets involving mbakad, your Personal Data may be transferred to the acquiring entity, subject to the same privacy commitments described in this Policy. We will notify you via email or platform notice before any such transfer takes effect.

7. Cookies and Tracking Technologies

mbakad uses cookies and similar tracking technologies to operate core platform functions, remember your preferences, detect fraudulent activity, and understand how users interact with our services. Below is a summary of the cookie categories we use:

Cookie Type	Purpose	Duration
Essential	Maintain your logged-in session, enable secure transactions, and prevent cross-site request forgery	Session
Functional	Remember language preferences, display settings, and responsible gaming limits you have configured	Up to 12 months
Analytics	Collect anonymized usage statistics to help us improve page performance and user experience	Up to 24 months
Security	Detect suspicious login patterns, bot activity, and unauthorized access attempts	Up to 6 months

Essential and security cookies are required for the platform to function and cannot be disabled without severely impacting your experience. Functional and analytics cookies may be declined by adjusting your browser settings. Note that disabling functional cookies may reset your saved preferences on each visit. Most modern browsers allow you to view, manage, and delete cookies through their settings menus.

8. Data Retention

mbakad retains your Personal Data only for as long as necessary to fulfill the purposes outlined in this Policy or as required by applicable law. The following general retention periods apply:

• Account data: Retained for the lifetime of your active account plus a minimum of 5 years after account closure to satisfy AML and regulatory record-keeping requirements.
• KYC documents: Retained for a minimum of 5 years from submission, in line with Indonesian financial compliance obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Customer support communications: Retained for 3 years from the date of the last interaction.
• Marketing preferences: Retained until you withdraw consent or request deletion, whichever comes first.
• Analytics data: Aggregated and anonymized within 24 months; raw event logs are deleted within 90 days.

When Personal Data is no longer required, we delete or irreversibly anonymize it in a manner that prevents reconstruction of the original data. Physical document copies are destroyed using certified secure-destruction procedures.

9. Your Rights and Choices

Depending on the laws applicable to your location within Indonesia, you have the following rights with respect to your Personal Data held by mbakad:

• Right of access: You may request a copy of all Personal Data we hold about you, along with information about how it is being processed.
• Right to rectification: If any of your Personal Data is inaccurate or incomplete, you have the right to request correction. You can update basic account details directly in your account settings, or contact support for KYC-related corrections.
• Right to erasure: You may request deletion of your Personal Data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations. Note that regulatory requirements may prevent us from deleting certain records immediately.
• Right to restrict processing: You may request that we temporarily restrict processing of your data while a rectification or objection request is assessed.
• Right to data portability: You may request a structured, machine-readable copy of the Personal Data you have provided to us.
• Right to object: You may object to processing based on legitimate interests, including profiling for personalization purposes.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

To exercise any of these rights, contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and fulfill it within 30 calendar days. If an extension is required due to complexity, we will notify you in advance.

10. Children's Privacy

mbakad's Services are strictly intended for adults aged 21 years and older. We do not knowingly collect, process, or store Personal Data from individuals under the age of 21. If we become aware that a minor has registered an account or provided personal information, we will immediately close the account, void any associated transactions, and delete the data in question.

If you believe a minor may have accessed our platform using false information, please notify us immediately at [email protected] so we can take appropriate action. Parents and guardians are encouraged to use device-level parental controls to prevent minors from accessing online gambling services.

11. Data Security Measures

mbakad implements a comprehensive, layered security program to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our technical and organizational measures include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 with 256-bit AES ciphers.
• Encryption at rest: Sensitive data fields, including payment details and identification numbers, are encrypted in our databases using AES-256.
• Access controls: Personal Data is accessible only to mbakad staff with a legitimate business need. Role-based access control (RBAC) and multi-factor authentication (MFA) are enforced for all internal systems.
• Intrusion detection: Automated monitoring systems flag anomalous access patterns, brute-force attempts, and unusual data export activity in real time.
• Regular audits: We conduct periodic internal security reviews and commission independent third-party penetration tests at least annually.
• Incident response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities within the timeframes required by applicable law.

While we maintain robust security practices, no system is entirely immune to risk. You also play a role in protecting your account by using a strong, unique password, enabling two-factor authentication, and never sharing your login credentials with anyone.

12. International Data Transfers

mbakad operates infrastructure and engages service providers across multiple jurisdictions. Your Personal Data may be transferred to and processed in countries outside Indonesia where data protection laws may differ from those in your home jurisdiction. When such transfers occur, we ensure that appropriate safeguards are in place, including contractual obligations that require the receiving party to protect your data to standards equivalent to those described in this Policy.

Game providers such as Pragmatic Play and Evolution Gaming may process session data on servers in their respective home jurisdictions. These providers are subject to international gaming regulatory requirements and maintain their own robust privacy and security programs. We evaluate the data protection practices of all third-party partners before engaging their services.

13. Third-Party Services

Our platform integrates with third-party services to deliver a complete betting and gaming experience. These integrations may involve limited data sharing as described in Section 6. Third-party services currently integrated with mbakad include payment gateways for Indonesian banks (BCA, BRI, BNI, Mandiri) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), game content providers, and KYC verification platforms.

Each third-party provider operates under its own privacy policy and terms of service. mbakad is not responsible for the privacy practices of third-party providers beyond the contractual obligations we impose on them. We recommend reviewing the privacy policies of any third-party services you interact with directly.

14. Changes to This Policy

mbakad reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When we make material changes, we will notify you by posting the updated Policy on this page with a revised "Last Updated" date and, where appropriate, sending an email notification to your registered address.

Your continued use of the Services following the posting of changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically. If you object to any change, you must stop using the Services and may request account closure by contacting our support team.

15. Contact and Data Requests

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact us using the details below. Our Data Protection team will respond to all inquiries promptly.

• Email: [email protected]
• Subject line for data requests: "Data Rights Request — [Your Registered Email]"
• Response time: Acknowledgment within 3 business days; full response within 30 calendar days
• Support availability: 24/7, with Indonesian-speaking agents available at all hours

All personal data submitted as part of a data rights request is used solely to verify your identity and process the request. It is not retained beyond the period necessary to fulfill the request and is handled under the same security standards as all other Personal Data.

Last Updated: January 1, 2026  |  Version: 2.4