Privacy Policy

1. Introduction

mha303 ("we", "us", "our") operates the online gaming platform accessible at https://mha303.cam. We provide sports betting, live casino, slot games, and related entertainment services primarily to players resident in Indonesia. As part of delivering these services, we necessarily collect and process certain personal information about you.

This Privacy Policy sets out, in plain and precise language, the categories of personal data we collect, the legal bases on which we process that data, the purposes for which it is used, the parties with whom it may be shared, the safeguards we apply to protect it, and the rights you hold in relation to your information. Reading this document in full equips you to make informed decisions about using mha303.

By creating an account on mha303 or otherwise using our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree, you must discontinue use of the platform.

2. Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, directly or in combination with other data.
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or deletion.
• "Data Controller" — mha303, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" — a third party that processes personal data on behalf of mha303, subject to our instructions and data-processing agreements.
• "User," "You," or "Player" — any individual who registers an account or accesses the mha303 platform.
• "KYC" — Know Your Customer; the identity verification procedures we follow to confirm user eligibility and comply with anti-money laundering obligations.
• "Cookies" — small text files stored on your device by a website to remember preferences, authenticate sessions, and analyze usage.

3. Categories of Data We Collect

mha303 collects personal data across the following categories:

3.1 Identity & Contact Data

• Full legal name
• Date of birth (to verify minimum age of 21 years)
• Gender (optional, for personalization)
• Email address
• Mobile phone number
• Residential address (street, city, province, postal code, Indonesia)

3.2 Identification Documents (KYC)

• Scanned copies or photographs of government-issued photo ID (Indonesian KTP, passport, or driver's license)
• Proof of address documents (utility bill, bank statement dated within 90 days)
• Selfie photograph holding the presented ID document

3.3 Financial & Transaction Data

• Bank account details used for deposits and withdrawals (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method references
• Bonus allocation and wagering history

3.4 Gaming Activity Data

• Betting history across sports, live casino, and slot products
• Game session duration and frequency
• Responsible gaming tool usage (deposit limits, time-out activations, self-exclusion requests)

3.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Session timestamps and page interaction logs
• Referral source and marketing attribution identifiers

3.6 Communication Data

• Records of live chat transcripts and email correspondence with our support team
• Feedback, complaints, or dispute records
• Survey responses (where participation is voluntary)

4. How We Collect Your Data

We gather personal data through the following means:

1. Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or filling in any on-platform form.
2. Automated collection: Technical data gathered automatically when you access or interact with the mha303 platform, including browser cookies, server logs, and analytics tools.
3. Third-party payment processors: Transaction confirmation data received from Indonesian banks and e-wallet providers when you initiate a deposit or withdrawal.
4. Identity verification partners: Results and flags returned by KYC and anti-fraud service providers engaged to verify document authenticity.
5. Game providers: Aggregated game-session and RTP data shared by licensed gaming studios to enable fair-play auditing and dispute resolution.

5. Purposes of Data Processing

mha303 processes your personal data for the following clearly defined purposes:

6. Legal Basis for Processing

mha303 relies on the following legal grounds when processing your personal data:

• Contractual necessity: Processing required to fulfill our service obligations to you under the mha303 Terms and Conditions — including acco unt management, payment processing, and game delivery.
• Legal obligation: Processing necessary to comply with applicable regulatory requirements, including anti-money laundering (AML) obligations, age verification mandates, and record-keeping duties.
• Legitimate interests: Processing carried out to pursue our legitimate business interests — such as fraud prevention, platform security, and service analytics — where those interests do not override your fundamental privacy rights.
• Consent: Processing based on your explicit, freely given consent — principally for promotional communications and non-essential cookies. You may withdraw consent at any time without affecting prior processing.

7. Data Sharing and Disclosure

mha303 does not sell, rent, or trade your personal data to any third party for marketing purposes. We share data only in the following limited circumstances, and only to the extent strictly necessary:

7.1 Payment Service Providers

To process your deposits and withdrawals, we share relevant financial identifiers with Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja). These providers operate under their own privacy policies and applicable Indonesian financial regulations.

7.2 Identity Verification Partners

KYC document data is shared with licensed identity verification service providers who assess document authenticity and check submitted details against relevant databases. These processors are bound by strict data-processing agreements and may not use your data for any purpose beyond verification.

7.3 Game Technology Providers

Aggregated and pseudonymized gaming activity data is shared with licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) as necessary for game delivery, fairness auditing, and technical support. Individual identity data is not shared with game providers beyond what is required for session authentication.

7.4 Legal and Regulatory Disclosure

mha303 may disclose personal data to law enforcement agencies, regulatory bodies, or other authorized governmental authorities where required by a valid legal obligation, court order, or to protect the rights, property, or safety of mha303, its users, or the public.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of mha303's business, personal data held about users may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections. We will notify affected users where practicable.

8. Data Retention

mha303 retains personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. The following retention schedules apply:

• Account and identity data: Retained for the duration of your active account relationship plus a minimum of five (5) years following account closure, to satisfy AML record-keeping obligations.
• KYC documents: Retained for five (5) years from the date of verification, or longer if required by applicable law or regulatory guidance.
• Financial transaction records: Retained for a minimum of five (5) years following the date of each transaction.
• Gaming activity logs: Retained for three (3) years from the date of each session, or longer if required for dispute resolution.
• Customer support communications: Retained for two (2) years from the date of the last interaction, or until a related dispute is formally resolved.
• Marketing preferences and consent records: Retained until you withdraw consent, plus an additional twelve (12) months as an audit record.
• Technical and device logs: Retained for ninety (90) days on a rolling basis unless flagged as relevant to an active security investigation.

Once a retention period expires, data is securely deleted using industry-standard methods or, where deletion is not immediately practicable, permanently anonymized so that it can no longer be attributed to any individual.

9. Security Measures

mha303 applies a layered, defense-in-depth approach to protecting your personal data. Our security framework includes:

• Transport encryption: All data exchanged between your browser or app and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). No unencrypted connections are permitted.
• Data-at-rest encryption: Sensitive personal and financial data stored in our databases is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Staff with access are subject to confidentiality obligations and receive regular data protection training.
• Multi-factor authentication: Administrative access to systems holding personal data requires multi-factor authentication. We recommend users also enable any available two-step verification on their accounts.
• Intrusion detection: Our infrastructure is monitored continuously by automated intrusion detection and anomaly-alerting systems. Any suspicious activity triggers immediate investigation.
• Third-party audits: mha303 engages independent security specialists to conduct periodic penetration testing and vulnerability assessments.
• Incident response: In the event of a confirmed data breach that creates a risk to your rights, we will notify affected users without undue delay, together with information on the nature of the breach and the steps we are taking to contain it.

While we implement rigorous safeguards, no internet-based system is completely immune to risk. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorized access to your account.

10. Cookies and Tracking Technologies

mha303 uses cookies and similar tracking technologies to operate the platform, remember your preferences, maintain session security, and analyze how users interact with the site. The categories of cookies we deploy are described below:

10.1 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled. They include session authentication tokens, load-balancing identifiers, and security tokens that protect against cross-site request forgery (CSRF). No personal data collected by these cookies is used for profiling or advertising.

10.2 Functional Cookies

Functional cookies remember choices you make — such as your preferred language or display settings — and enable enhanced, personalized features. Disabling these cookies may affect the quality of your experience but will not prevent access to core services.

10.3 Analytics Cookies

With your consent, we deploy analytics cookies that collect aggregated, anonymized data about how users navigate the mha303 platform. This information helps us identify high-friction areas, measure the effectiveness of design changes, and improve the overall user experience. Analytics data is not linked to your individual identity.

10.4 Marketing and Attribution Cookies

Where you have provided consent, marketing cookies record the channel through which you arrived at mha303 and may be used to measure the performance of promotional campaigns. These cookies do not track your activity on external websites.

10.5 Managing Cookies

You may control cookie preferences through your browser settings. Most browsers allow you to view, block, or delete cookies. Please note that blocking strictly necessary cookies will prevent you from logging in to your mha303 account. Detailed instructions for managing cookies in popular browsers are available in each browser's help documentation.

11. Your Data Rights

As a user of mha303, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact us at the email address listed in Section 14:

• Right of access: You may request a copy of the personal data we hold about you, along with information on how it is processed and with whom it is shared.
• Right to rectification: If any personal data we hold is inaccurate or incomplete, you may request that we correct or update it without undue delay.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any overriding legal retention obligations (e.g., five-year AML record-keeping requirements).
• Right to restrict processing: You may request that we temporarily suspend processing of your data — for example, while the accuracy of the data is contested — without requesting full deletion.
• Right to data portability: Where processing is based on consent or contractual necessity, you may request that we provide your personal data in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right to object: You may object to processing based on legitimate interests — including direct marketing profiling — at any time. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.

We aim to respond to all substantiated data rights requests within thirty (30) calendar days. In complex cases we may extend this period by a further sixty (60) days, and will notify you accordingly.

12. Minors and Age Restriction

mha303 is strictly an adults-only platform. You must be at least 21 years of age to register an account and use our services. We do not knowingly collect personal data from individuals under the age of 21.

As part of our registration and KYC procedures, we verify the age of every user through government-issued identification documents. Any account found to belong to a person under the age of 21 will be suspended immediately, all funds will be frozen pending investigation, and any winnings will be forfeited in accordance with our Terms and Conditions.

13. Changes to This Privacy Policy

mha303 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. When we make material changes, we will:

• Post the revised policy on this page with a new "Last Reviewed" date
• Send an email notification to the address registered to your account for changes that significantly affect your rights or the way we process your data
• Display a prominent notice on the mha303 platform for a period of not less than fourteen (14) days following publication of material changes

Your continued use of the mha303 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed of how we protect your information.

14. Contact Information

If you have questions, concerns, or wish to exercise any of your data rights as described in Section 11, please reach out to our Privacy team using the contact details below. All privacy-related inquiries are handled by dedicated staff and treated with strict confidentiality.

Our customer support team is available around the clock in both English and Indonesian. Native Indonesian-speaking agents are on hand to assist users from Jakarta, Surabaya, Medan, Bandung, Bali, and throughout the archipelago who may prefer to discuss privacy matters in their first language.

By using the mha303 platform, you confirm that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein. This policy is effective as of January 1, 2026, and supersedes all prior versions.