Privacy Policy — maha03

Section 01

Introduction

This Privacy Policy ("Policy") describes how maha03 ("we", "us", "our") collects, uses, stores, shares, and protects personal information about individuals ("you", "Member", "User") who access or use the maha03 online gaming platform available at maha03.app, including all associated products, services, features, and communications.

By registering a Member Account on maha03, depositing funds, placing wagers, or otherwise using the platform in any capacity, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. This Policy should be read in conjunction with the maha03 Terms & Conditions, which govern the overall contractual relationship between you and maha03.

maha03 is committed to handling your personal data responsibly. We operate this platform for Indonesian players who prefer an English-language international gaming experience, and we recognize that the trust our members place in us carries a corresponding obligation to maintain the highest standards of data protection. This Policy applies to all Members regardless of their location within Indonesia — whether in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, or any other city across the archipelago.

Section 02

Data Controller

For the purposes of this Privacy Policy, the data controller responsible for the personal information of maha03 Members is the operator of the maha03 platform, which holds an international gaming licence and operates the maha03.app domain.

All data-related enquiries, subject access requests, correction requests, erasure requests, and complaints should be directed to the maha03 Data Protection team via the contact details set out in Section 15 of this Policy. Our Data Protection team will respond to all formal requests within 5 business days of receipt.

Where maha03 engages third-party processors (such as payment providers, KYC verification services, or analytics platforms) to process personal data on its behalf, those processors act strictly under data processing agreements that bind them to the same standards of confidentiality and security that maha03 applies internally.

Section 03

Data We Collect

maha03 collects the following categories of personal data, depending on your level of interaction with the platform:

We collect only the data that is necessary for the purposes described in this Policy. We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data beyond what is present in standard government-issued identification documents submitted during KYC.

Section 04

How We Collect Your Data

maha03 collects personal data through the following channels:

• Direct Submission: Information you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal, contacting customer support, or responding to a promotional survey.
• Automated Collection: Technical data collected automatically when you visit maha03.app through server logs, session tracking software, and first-party cookies. This data is collected regardless of whether you are logged in to an Account.
• Third-Party Payment Processors: Transaction confirmation data shared with maha03 by your payment provider when a deposit or withdrawal instruction is processed. This includes the transaction reference number, amount, and account name.
• KYC Verification Partners: Where maha03 uses an automated identity verification service to cross-check submitted documents, that service may return a verification result and a confidence score. The underlying document images are stored by maha03, not the third-party service.
• Fraud Detection Systems: Risk signals generated by fraud monitoring tools, including device fingerprinting data and IP reputation scores, which help maha03 identify and prevent unauthorized account access and multi-accounting behaviour.

Section 05

Purposes of Processing

maha03 processes your personal data only for defined and legitimate purposes. The table below maps each processing activity to its purpose and the data categories involved:

maha03 will not process your personal data for any purpose not listed above without first obtaining your explicit consent or notifying you via an updated Privacy Policy.

Section 06

Legal Bases for Processing

maha03 processes your personal data under one or more of the following legal bases, depending on the processing activity in question:

• Contractual Necessity: Processing required to fulfil the Member Agreement between you and maha03, including account creation, transaction processing, and dispute resolution. Without this processing, maha03 cannot provide its services to you.
• Legal Obligation: Processing required to comply with applicable law, including KYC identity verification, anti-money laundering (AML) record-keeping, and reporting to regulatory authorities under maha03's international gaming licence obligations.
• Legitimate Interests: Processing carried out for maha03's legitimate business interests where those interests are not overridden by your rights. This includes fraud detection, responsible gaming monitoring, platform security, and anonymised analytics to improve our products. maha03 has assessed that these interests are proportionate and that your fundamental privacy rights are safeguarded.
• Consent: Processing for which we rely on your freely given, specific, informed, and unambiguous consent. This applies primarily to optional marketing communications (email, SMS, and in-platform notifications) and the use of non-essential analytics cookies. You may withdraw consent at any time without affecting the lawfulness of any processing that occurred before withdrawal.

Section 07

Data Sharing & Third Parties

maha03 does not sell your personal data. We share personal data with third parties only in the following limited circumstances:

• Payment Processors: To process your deposits and withdrawals, maha03 must share your name and account details with the relevant financial institution or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, Bank Danamon, OVO, DANA, GoPay, ShopeePay, LinkAja). Only the minimum data necessary for the transaction is shared.
• KYC & Identity Verification Partners: Third-party identity verification services may process your submitted documents to confirm authenticity. These partners operate under strict data processing agreements and are prohibited from using your data for any other purpose.
• Game Studios & Content Providers: Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe may receive an anonymised session token to facilitate game play. They do not receive your full identity data.
• Fraud Prevention & AML Services: Specialist third-party platforms that assist maha03 in detecting fraudulent account activity, collusion, and potential money laundering. These services may process Technical Data and Financial Data under confidentiality agreements.
• Legal & Regulatory Authorities: Where required by applicable law, court order, or regulatory instruction, maha03 may be obligated to disclose Member data to law enforcement agencies or regulatory bodies. maha03 will notify you of any such disclosure where legally permitted to do so.
• Corporate Restructuring: In the event of a merger, acquisition, or sale of all or substantially all of maha03's assets, Member data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and given the opportunity to close your Account if you do not consent.

Section 08

Cookies & Tracking Technologies

maha03 uses cookies and similar tracking technologies to enable core platform functionality, improve the member experience, and — where you have consented — deliver relevant promotional content. The following categories of cookies are used on maha03.app:

You may manage your cookie preferences at any time through your Account settings or by adjusting the cookie settings in your browser. Please note that disabling Strictly Necessary cookies will prevent you from logging in to your Account.

maha03 does not use third-party advertising networks or cross-site tracking cookies. All analytics and personalisation tracking is first-party and limited to activity on maha03.app.

Section 09

Data Retention

maha03 retains personal data only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active Member Accounts: All personal, financial, and gaming activity data is retained for the full duration of your active membership and for a period of 5 years following permanent account closure. This retention period is driven by our international licensing obligations and anti-money laundering record-keeping requirements.
• KYC Documents: Identity and address verification documents (e.g., copies of KTP, passport, utility bills) are retained for 5 years from the date of submission or from the date of account closure, whichever is later.
• Financial Transaction Records: All deposit and withdrawal records, together with associated correspondence, are retained for 5 years from the date of each transaction in accordance with AML regulatory requirements.
• Customer Support Communications: Live chat transcripts and support email threads are retained for 2 years from the date of the conversation to allow effective handling of escalated disputes.
• Marketing Opt-In Records: Records of your consent to receive marketing communications are retained for the duration of your membership plus 2 years after account closure, to demonstrate compliance with consent requirements.
• Technical / Log Data: Server access logs, IP address records, and session timestamps are retained for 12 months and then securely deleted.
• Inactive Accounts: Accounts with no login or wagering activity for 12 consecutive months are classified as inactive. Data associated with inactive accounts is retained in accordance with the financial records schedule above. After the applicable retention period expires, data is securely purged from maha03's systems.

Section 10

Data Security

maha03 employs a comprehensive suite of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Key measures include:

• Transport Layer Security: All data transmitted between your device and maha03.app is protected by TLS 1.2 or higher with 256-bit encryption. Our SSL certificate is issued by a globally recognized Certificate Authority and is renewed continuously.
• Data-at-Rest Encryption: Personal data stored in maha03's databases is encrypted at rest using AES-256 encryption. Encryption keys are managed separately from the data they protect and are rotated on a regular schedule.
• Access Controls: Access to Member personal data is restricted to maha03 staff who require it for their specific job function, enforced through role-based access control (RBAC). All internal data access is logged and subject to regular audit review.
• Two-Factor Authentication: maha03 strongly recommends enabling two-factor authentication (2FA) on your Member Account. Staff with access to Member data systems are required to use 2FA on all internal platforms.
• Penetration Testing: maha03's platform infrastructure undergoes regular third-party penetration testing and vulnerability assessments. Critical vulnerabilities identified are remediated as a priority within defined SLA timescales.
• Incident Response: In the event of a data security incident that poses a risk to Member rights and freedoms, maha03 maintains a documented incident response plan. Affected Members will be notified without undue delay in accordance with our notification obligations.

Section 11

Your Data Rights

As a Member of maha03, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our Data Protection team using the details in Section 15:

• Right of Access: You may request a copy of all personal data that maha03 holds about you, along with information about how that data is being processed. We will provide this within 5 business days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update basic contact details directly within your Account settings; changes to identity-verified fields (such as legal name or date of birth) require a formal request with supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where the data has been processed unlawfully. Note that regulatory retention obligations may prevent complete erasure of financial and KYC records within their mandatory retention periods.
• Right to Restriction of Processing: You may ask maha03 to suspend certain processing activities while a dispute about the accuracy or lawfulness of the data is being resolved.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) and to request that it be transmitted to another controller where technically feasible.
• Right to Object: You have the right to object at any time to the processing of your personal data where maha03 relies on legitimate interests as the legal basis. maha03 must then cease that processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications, non-essential analytics cookies), you may withdraw that consent at any time through your Account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

All rights requests will be acknowledged within 2 business days and substantively responded to within 5 business days. Complex requests may require up to 30 calendar days in exceptional circumstances, in which case you will be notified of the expected timeline.

Section 12

Children's Privacy & Age Restriction

maha03 is an online gambling platform strictly intended for adults aged 21 years and older. The collection of personal data from individuals under the age of 21 is not permitted under any circumstances, and maha03 does not knowingly collect, store, or process personal data from minors.

If maha03 discovers that a Member Account has been registered by an individual below the age of 21 — whether detected through KYC verification, account monitoring, or a report from a third party — the following steps will be taken immediately:

1. The Account will be suspended and all login access disabled.
2. All funds held in the Account will be forfeited and not returned, in accordance with our zero-tolerance underage gambling policy and our Terms & Conditions.
3. All personal data associated with the underage Account will be permanently deleted from maha03's systems within 30 calendar days, except where retention is required for regulatory reporting purposes.
4. Where applicable, a report will be submitted to the relevant regulatory authority in accordance with maha03's licensing obligations.

Parents and guardians who believe their child may have accessed or registered on maha03 are urged to contact our support team immediately at [email protected]. We will investigate and respond within 24 hours. We also strongly encourage the use of parental control software to restrict minors' access to online gambling platforms.

Section 13

Third-Party Links & Integrations

The maha03 platform may contain references to third-party game studios, payment providers, and sports data providers. While maha03 integrates with these services to deliver its products, each third party operates under its own privacy policy and data practices, which are independent of this Policy.

maha03 is not responsible for the privacy practices or content of any third-party service. We encourage you to review the privacy policies of any payment provider or service you interact with in connection with your maha03 Account. Specifically:

• If you use OVO, DANA, GoPay, ShopeePay, or LinkAja to fund your Account, the relevant e-wallet provider's privacy policy governs how that provider handles your data on their platform.
• If you use BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, or Bank Danamon for bank transfer deposits or withdrawals, the relevant bank's privacy policy governs the bank's handling of your data.
• Game providers such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe may process anonymised game session data. Their data practices do not affect the personal data maha03 holds about you.

maha03 does not embed third-party advertising trackers, social media pixel codes, or affiliate tracking scripts that would allow third parties to profile your behaviour across the web based on your activity on maha03.app.

Section 14

Policy Amendments

maha03 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, platform features, or regulatory obligations. Any changes will take effect from the "Last Reviewed" date shown at the top of this page.

Where an amendment materially affects how we process your personal data — particularly data collected under consent-based processing — maha03 will notify registered Members by email at least 7 calendar days before the updated Policy takes effect. The notification will clearly describe the nature of the changes and, where applicable, request fresh consent for any new processing activity.

Your continued use of the maha03 platform following the effective date of an updated Privacy Policy constitutes your acknowledgment of, and agreement to, the revised terms. If you do not agree with any changes, you have the right to close your Account by contacting our support team before the effective date of the amendment.

Section 15

Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about how maha03 handles your personal information, please reach out to our Data Protection team through any of the following channels:

• Email: [email protected] — include "Privacy Request" in the subject line for fastest routing. Responses are typically provided within 2 business hours during WIB (UTC+7) business hours and within 12 hours outside those hours.
• Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the maha03 platform. Indonesian-speaking support agents are available at all times to assist with data rights requests and privacy enquiries.
• Postal / Formal Written Requests: For formal subject access requests or erasure requests that require written confirmation, please contact us via email first and our Data Protection team will advise on the appropriate submission process.

When submitting a data rights request, please provide your registered username and the email address associated with your Account so that our team can locate your record quickly and verify your identity before processing the request. maha03 does not charge a fee for handling data rights requests unless a request is manifestly unfounded, repetitive, or excessive.

All formal privacy complaints will be acknowledged within 2 business days and substantively resolved within 30 calendar days. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection supervisory authority under the jurisdiction of maha03's international gaming licence.