Privacy Policy

1 Introduction

madu58 is committed to maintaining the highest standards of data privacy and information security for every player on our platform. This Privacy Policy has been prepared in accordance with internationally recognised data protection principles and applies to all personal data processed by madu58 in connection with the delivery of our online betting, gaming, and related services to players across Indonesia, including those located in Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, and beyond.

This Policy should be read alongside our Terms & Conditions, which govern your use of the madu58 platform, and our Responsible Gaming Policy, which sets out our commitments to player welfare. Together these documents constitute the complete framework governing your relationship with madu58.

2 Data Controller

For the purposes of data protection law, madu58 acts as the data controller in respect of all personal data collected from players and website visitors. As the data controller, madu58 determines the purposes and means by which personal data is processed and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

If you have any questions about how madu58 processes your personal data, or if you wish to exercise any of your data rights, please contact our Data Protection team via the details provided in Clause 15 of this Policy.

3 Data We Collect

madu58 collects the following categories of personal data in the course of providing its services:

Data Category	Specific Examples	Collection Stage
Identity Data	Full name, date of birth, national ID number, passport number, KTP (national identity card) details	Registration & KYC verification
Contact Data	Email address, Indonesian mobile phone number, city of residence (e.g., Jakarta, Surabaya)	Registration
Financial Data	Bank account number (BCA, BRI, BNI, Mandiri, CIMB Niaga), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history in IDR/Rp	Deposit & withdrawal processing
Account Data	Username, hashed password, account balance, bonus history, betting history, session logs	Ongoing platform use
Technical Data	IP address, device type, operating system, browser type, screen resolution, cookie identifiers, session tokens	Automatic — website visit
Usage Data	Pages visited, games played (including togel — Indonesia's traditional numbers lottery — and live casino), bet frequency and amounts, time spent on platform	Automatic — ongoing use
Communications Data	Live chat transcripts, email correspondence, WhatsApp message records with our support team	Customer support interactions
Document Data	Copies of government-issued photo ID, utility bills or bank statements submitted for proof of address, selfie photographs submitted for identity verification	KYC verification

madu58 does not collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless strictly required to satisfy a specific legal obligation, and only with your explicit consent where such consent is required.

4 How We Collect Data

4.1 Direct Collection

We collect data directly from you when you: register an account on the madu58 platform; complete KYC ver ification by submitting identity documents; make a deposit or withdrawal; place a bet or participate in any game; contact our customer support team via live chat, email, or WhatsApp; respond to a survey or promotional communication; or update your account profile settings.

4.2 Automatic Collection

When you visit or use the madu58 platform, certain technical and usage data is collected automatically through cookies, server logs, and similar technologies. This includes your IP address, device identifiers, browser configuration, and behavioural data such as pages visited and time spent on each section of the platform. This data is collected whether or not you are logged into an account.

4.3 Third-Party Sources

In limited circumstances, madu58 may receive personal data about you from third-party sources, including: payment processors and banking partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) for the purpose of verifying transactions; fraud-detection and identity-verification service providers; and publicly available sources such as sanctions screening databases used for anti-money-laundering compliance.

5 Purposes of Processing

madu58 processes your personal data for the following specific, legitimate purposes:

• Account Management: To register, maintain, and administer your player account, including verifying your identity and eligibility.
• Service Delivery: To process deposits and withdrawals in Indonesian Rupiah (IDR/Rp), settle bets, credit bonuses, and deliver the full range of platform services.
• KYC & Compliance: To fulfil our obligations under applicable anti-money-laundering regulations, sanctions screening requirements, and responsible gaming obligations, including age verification to ensure all players are 21 years of age or older.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, cheating, money laundering, and other prohibited conduct on the platform.
• Customer Support: To respond to your enquiries, resolve complaints, and provide technical assistance through our 24/7 support channels.
• Platform Improvement: To analyse usage patterns, conduct A/B testing, and improve the performance, design, and functionality of the madu58 platform.
• Responsible Gaming: To monitor player behaviour for signs of problem gambling, enforce deposit limits and self-exclusion requests, and deliver timely responsible gaming interventions.
• Marketing Communications: To send you relevant promotional offers, bonus notifications, and platform updates — where you have provided consent or where such communications constitute a legitimate interest, subject always to your right to opt out.
• Legal Obligations: To comply with applicable laws, respond to lawful requests from regulatory authorities, and enforce our Terms & Conditions.

6 Legal Basis for Processing

madu58 relies on the following legal bases for processing your personal data, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to perform the contract between you and madu58 — including account registration, transaction processing, and service delivery — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
• Legal Obligation: Certain processing activities — particularly KYC identity verification, anti-money-laundering checks, age verification, and record-keeping — are carried out because they are required by applicable law or regulation.
• Legitimate Interests: madu58 processes some data on the basis of its legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and product analytics. Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms.
• Consent: Where required, madu58 will seek your explicit consent before processing your data, particularly for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Data Sharing

madu58 does not sell your personal data. We share your data only in the following limited circumstances, and only to the extent necessary for each purpose:

• Payment Processors: Financial data is shared with our banking and e-wallet partners — including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja — solely for the purpose of processing your deposit and withdrawal transactions.
• Identity Verification Providers: Document data submitted for KYC purposes may be shared with licensed third-party identity verification service providers operating under data processing agreements with madu58.
• Game Studio Partners: Aggregated, anonymised gameplay data may be shared with licensed game studio partners such as Pragmatic Play, Evolution Gaming, and Pocket Games Soft for the purposes of game performance analysis and RNG auditing. No personally identifiable data is shared with game studios.
• Fraud Prevention Services: Technical and account data may be shared with fraud-detection platforms to identify and prevent abuse, bonus fraud, and money laundering.
• Legal Authorities: madu58 may disclose personal data to law enforcement agencies, regulators, or courts where required to do so by applicable law, court order, or regulatory obligation. We will notify you of such disclosures where legally permissible.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of the madu58 business, player data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer in advance.

8 International Data Transfers

madu58 operates internationally and your personal data may be transferred to, stored in, or processed in countries outside Indonesia. When such transfers occur, madu58 ensures that appropriate safeguards are in place to protect your data at a standard equivalent to that required under internationally recognised data protection frameworks. These safeguards may include standard contractual clauses, adequacy decisions, or binding corporate rules agreed between madu58 and the relevant data processor or controller.

If you have concerns about the international transfer of your personal data, you may contact our Data Protection team using the details in Clause 15.

9 Data Retention

madu58 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

Data Category	Retention Period	Rationale
Account & Identity Data	Duration of account + 5 years after closure	Legal obligation; anti-money-laundering compliance
KYC Documents	Duration of account + 5 years after closure	Regulatory requirement
Financial Transaction Records	7 years from transaction date	Financial record-keeping obligations
Betting & Game History	5 years from each transaction date	Dispute resolution; responsible gaming audits
Customer Support Records	3 years from last interaction	Quality assurance; dispute resolution
Technical & Log Data	12 months	Security monitoring; fraud detection
Marketing Consent Records	Until consent is withdrawn + 3 years	Evidence of consent; legal compliance

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that ensures it cannot be reconstructed or linked back to an individual player.

10 Your Data Rights

As a player on the madu58 platform, you have the following rights in relation to your personal data. These rights may be exercised at any time by contacting our Data Protection team via the details in Clause 15:

madu58 will respond to all data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, of which you will be notified. We will not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

11 Cookies and Tracking Technologies

11.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. madu58 uses cookies and similar technologies (including local storage and session tokens) to ensure the platform functions correctly, to maintain your login session securely, and to collect aggregate analytics data about how players use the platform.

11.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of the platform, including session management and authentication. These cookies cannot be disabled without affecting core platform functionality.
• Functional Cookies: Remember your preferences, such as language settings, display options, and previously viewed game categories. These enhance your experience but are not strictly required.
• Analytics Cookies: Collect anonymised data about how visitors interact with the platform, which pages are most visited, and where technical errors occur. This data is used solely to improve the madu58 platform.
• Security Cookies: Support fraud detection and account security features, such as identifying unusual login behaviour from unrecognised devices or IP addresses.

11.3 Managing Cookies

You may manage or disable non-essential cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging into your madu58 account and using core platform features. madu58 does not use third-party advertising cookies or cross-site behavioural tracking technologies.

12 Minors and Age Restriction

The madu58 platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect personal data from any person under the age of 21. If madu58 becomes aware that personal data has been collected from a minor, we will take immediate steps to delete that data and permanently close the associated account. If you believe a minor has registered an account or provided personal data to madu58, please contact our support team immediately so that we may investigate and act accordingly.

13 Security Measures

madu58 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS/SSL Encryption: All data transmitted between your device and the madu58 platform is encrypted using industry-standard TLS protocols.
• Encrypted Data Storage: Personal and financial data at rest is stored using AES-256 encryption on access-controlled servers.
• Access Controls: Access to player data within the madu58 organisation is restricted on a strict need-to-know basis. Staff with access to personal data are subject to confidentiality obligations and regular security training.
• Two-Factor Authentication: Players are encouraged to enable two-factor authentication on their accounts. madu58 staff accessing administrative systems are required to use multi-factor authentication.
• Penetration Testing: The madu58 platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities.
• Incident Response: madu58 maintains a documented data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify affected players promptly and take all reasonable steps to contain and remediate the incident.

14 Policy Amendments

madu58 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered players via email to the address on file and/or through a prominent notice on the platform at least 7 days before the changes take effect. We encourage you to review this Privacy Policy periodically. Your continued use of the madu58 platform following the effective date of any amendments constitutes your acceptance of the revised Policy. The "Last Updated" date at the top of this page will always reflect when the most recent version was published.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way madu58 processes your personal data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — responses within 2 hours during WIB business hours (UTC+7).
• Live Chat: Available 24/7 directly through the madu58 platform.
• WhatsApp: Available 24/7 — contact details provided upon account registration.

Our support team includes Indonesian-speaking agents available at all hours. For data rights requests specifically, please state clearly in your message that you are submitting a data subject access request (DSAR) or a request to exercise another data right, so that our team can route your enquiry to the appropriate department without delay.