Privacy Policy

Throughout this Privacy Policy, the following terms carry the specific meanings defined below. Familiarity with these definitions will help you understand how mc118 handles your personal data.

mc118, operating the online gaming and sportsbook platform accessible at mc118.org, acts as the sole Data Controller for all Personal Data collected from Members and visitors in connection with the use of the mc118 platform. mc118 determines the purposes for which Personal Data is collected and the means by which it is processed.

mc118 is an internationally licensed gaming operator. The platform is specifically designed and marketed to serve players residing in Indonesia, offering services fully denominated in Indonesian Rupiah (IDR) with support for major Indonesian local payment channels including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI (Bank Syariah Indonesia), Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja.

All data-related queries, access requests, correction requests, and deletion requests should be directed to mc118's support team via the 24/7 live chat channel available on the platform, or by email to the address provided in Section 15 (Contact Us) of this Policy.

mc118 collects only the Personal Data that is strictly necessary to deliver its services safely, securely, and in compliance with applicable legal and regulatory obligations. The categories of data we collect are described in the table below.

mc118 collects Personal Data through the following primary channels:

• Direct Registration: When you create an mc118 account, you voluntarily submit identity, contact, and payment data directly through the registration interface. This constitutes the primary source of your Personal Data on the platform.
• Financial Transactions: Each deposit or withdrawal you initiate generates transaction records containing financial identifiers, timestamps, payment channel details, and IDR amounts. These records are retained for compliance and audit purposes.
• Customer Support Interactions: When you contact mc118 via live chat or email, the content of your communication, including any personal details you share within the conversation, is recorded and stored as part of your support history.
• Automatic Technical Collection: As you browse and use the mc118 platform, technical data — including your IP address, browser fingerprint, session tokens, and navigational behaviour — is collected automatically via server logs, cookies, and analytics tools.
• KYC Document Submission: When mc118 requests identity verification, you submit scanned or photographed identity documents directly to the platform. These documents are processed by our KYC verification system and authorised compliance personnel.
• Third-Party Sources: In limited circumstances, mc118 may receive Personal Data about you from third-party sources, including payment processors, fraud screening services, and identity verification agencies. This data supplements the information you have provided directly and is used exclusively for verification and risk management purposes.

mc118 processes your Personal Data only for clearly defined, legitimate purposes. We do not process data in ways that are incompatible with those purposes without seeking fresh consent where required. Our processing purposes are as follows:

• Account Creation & Management: To register your account, maintain it in good standing, authenticate your identity at login, and manage account-level settings including deposit limits and responsible gaming preferences.
• Service Delivery: To provide all mc118 products — including sportsbook markets (BRI Liga 1, Champions League, EPL, Timnas Indonesia fixtures), live casino (baccarat, roulette, blackjack), slots (Pragmatic Play, NetEnt, Microgaming), togel (Indonesia's traditional numbers lottery), and esports betting on MPL, PUBG Mobile, and Free Fire events.
• Payment Processing: To facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja; to verify that payment accounts belong to the registered account holder; and to maintain accurate financial records in IDR.
• KYC & Age Verification: To confirm that you are at least 21 years of age, that your identity matches the details provided at registration, and that you are not subject to any self-exclusion order or sanctions list restriction.
• Fraud Prevention & AML Compliance: To detect, investigate, and prevent fraudulent activity, money laundering, match-fixing, and bonus abuse. mc118 maintains a strict AML programme and is obligated to report suspicious activity to relevant authorities where legally required.
• Responsible Gaming: To monitor wagering patterns that may indicate problem gambling behaviour; to enforce deposit limits, session time limits, and self-exclusion orders applied by or on behalf of a Member; and to provide timely intervention support where needed.
• Marketing & Promotions: To send you relevant promotional offers — such as welcome bonuses, reload promotions, and seasonal offers tied to Idul Fitri, Ramadhan, Nyepi, and major sporting events — where you have opted in to receive marketing communications. You may withdraw consent at any time via your account settings.
• Product Improvement & Analytics: To analyse aggregated usage data in order to improve platform performance, enhance user experience, optimise our game library, and develop new features that serve Indonesian players better.
• Legal & Regulatory Compliance: To fulfil obligations imposed by our international gaming licence, applicable financial regulations, court orders, and requests from competent legal authorities.

mc118 processes your Personal Data on one or more of the following legal bases, depending on the specific purpose of each processing activity:

mc118 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share your data only in the circumstances described below, and only to the minimum extent necessary for each stated purpose.

• Payment Processors & Banks: Financial transaction data is shared with payment processors and Indonesian banking partners — including BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, and e-wallet providers such as OVO, DANA, GoPay, ShopeePay, and LinkAja — to the extent necessary to process your deposits and withdrawals. Each of these partners operates under its own regulated privacy and security framework.
• Game Studio Providers: When you play games powered by third-party studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, or Pocket Games Soft, limited session and bet-level data is exchanged with those providers' systems to operate the game, calculate outcomes, and settle results. No additional identifiable data beyond what is necessary for game operation is shared.
• Identity Verification & KYC Agencies: To verify your identity and age, mc118 may submit copies of your KYC documents to third-party verification agencies. These agencies are contractually bound to process your data solely for verification purposes and to maintain it securely.
• Regulatory & Legal Authorities: mc118 is obligated to disclose Member data to relevant authorities — including financial intelligence units and law enforcement bodies — where required by a valid legal order, warrant, or AML reporting obligation. We will notify affected Members of such disclosures where legally permitted to do so.
• Analytics & Technology Partners: Aggregated, anonymised or pseudonymised usage data may be shared with analytics and technology partners to support platform performance optimisation and fraud detection. These partners do not receive data in a form that directly identifies individual Members.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of mc118's business assets, Member Personal Data may be transferred to the acquiring entity as part of that transaction. Affected Members will be notified prior to their data becoming subject to a materially different privacy policy.

As an internationally licensed gaming operator serving Indonesian players, mc118 may transfer certain categories of Personal Data to servers or processors located outside Indonesia. Such transfers may occur in connection with our cloud hosting infrastructure, international KYC verification services, game studio integrations, or our licensed operating entity's jurisdiction.

Where Personal Data is transferred internationally, mc118 ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to the protections afforded under the laws of Indonesia and the international data protection framework applicable in our licensing jurisdiction. Safeguards include:

• Contractual data protection clauses in agreements with all Data Processors receiving cross-border transfers.
• Transfer only to jurisdictions or processors that mc118 has assessed as providing an adequate level of data protection, consistent with our international licence obligations.
• End-to-end TLS encryption for all data in transit, regardless of destination jurisdiction.
• Regular third-party audits of international Data Processors' security posture and contractual compliance.

If you would like further information about the specific safeguards applied to any particular international transfer of your Personal Data, please contact our Data Protection Officer via live chat or at the email address listed in Section 15.

mc118 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

mc118 employs a comprehensive, layered security framework to protect Member Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security programme encompasses both technical controls and organisational policies.

• 256-bit TLS Encryption: All data transmitted between your browser or device and the mc118 platform is encrypted using industry-standard 256-bit Transport Layer Security (TLS). This protects your login credentials, financial transactions, and personal details from interception during transit.
• Encrypted Data Storage: Personal Data and financial records stored on mc118 servers are encrypted at rest using AES-256 encryption. Access to production databases is restricted to authorised personnel operating under strict need-to-know principles.
• Access Controls: mc118's internal systems employ role-based access control (RBAC). Staff members may only access Member data categories that are directly relevant to their specific job function. All internal access is logged and subject to periodic audit review.
• Fraud Detection Systems: mc118 operates real-time fraud monitoring systems that analyse login patterns, transaction behaviours, and session characteristics to identify and block suspicious activity. Anomalous events trigger automated security responses and manual review.
• Incident Response: mc118 maintains a documented data breach response plan. In the event of a confirmed breach affecting Member Personal Data, mc118 will take immediate containment action, notify the relevant supervisory authority within the required timeframe, and communicate with affected Members without undue delay.
• Third-Party Security Audits: mc118's platform and data security posture are subject to periodic independent security audits and penetration testing. Findings are addressed promptly within a structured remediation programme.

The mc118 platform uses cookies and similar tracking technologies to deliver core functionality, remember your preferences, maintain session security, and support platform analytics. By continuing to use the mc118 platform, you consent to the use of cookies as described in this section.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies will impair your ability to log in and use the mc118 platform. For guidance on managing cookies in your specific browser, refer to your browser's official help documentation.

As a Member of mc118, you hold a number of rights in relation to your Personal Data. mc118 is committed to honoring these rights promptly and transparently. To exercise any of the rights described below, please contact our support team via 24/7 live chat or by emailing [email protected] with the subject line "Data Rights Request".

• Right of Access: You have the right to request a copy of the Personal Data mc118 holds about you, together with information about how it is being processed, the purposes of processing, and the categories of third parties with whom it has been shared.
• Right to Rectification: If any Personal Data mc118 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay. Identity and financial data corrections may require supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no overriding legal basis exists. Note that mc118 is legally required to retain certain data categories (KYC, financial records) for defined periods regardless of a deletion request.
• Right to Restriction of Processing: You may request that mc118 restrict the processing of your Personal Data in specific circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.
• Right to Data Portability: Where processing is based on your consent or on a contractual necessity, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to the processing of your Personal Data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though mc118 may continue processing where it can demonstrate compelling grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. You can manage marketing consent preferences directly within your account settings.
• Right to Lodge a Complaint: If you believe mc118 has processed your Personal Data in breach of applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority in the jurisdiction applicable to mc118's international gaming licence.

The mc118 platform is strictly intended for adults aged 21 years or older. mc118 does not knowingly collect, process, or retain Personal Data from individuals under the age of 21. This policy applies without exception to all Members, regardless of the jurisdiction in which they reside within Indonesia — including Jakarta, Surabaya, Medan, Bandung, Bali, Yogyakarta, Semarang, Palembang, Makassar, and all other cities and regions.

All prospective Members are required to confirm their age at registration. Prior to processing the first withdrawal from any account, mc118 conducts a mandatory KYC verification process during which proof of age — in the form of a valid government-issued ID such as a KTP (Kartu Tanda Penduduk) or passport — must be submitted and approved.

mc118 reserves the right to update or amend this Privacy Policy at any time in order to reflect changes in our data processing practices, applicable legal and regulatory requirements, platform features, or operational arrangements. All amendments will be published on this page with a revised "Last Updated" date prominently displayed at the top of the Policy.

Where an amendment constitutes a material change to the way in which mc118 processes your Personal Data — particularly where it affects your rights or the legal bases on which we rely — mc118 will notify active Members via the email address registered on their account and/or via a prominent in-platform notification. Such notice will be provided no less than 14 calendar days prior to the amended Policy taking effect.

Your continued use of the mc118 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not accept a material amendment, you must cease using the platform and may request account closure by contacting our support team. mc118 will process such closure requests within 5 business days.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mc118 handles your Personal Data, please do not hesitate to reach out to our team through any of the following channels:

• 24/7 Live Chat: The fastest way to reach mc118's support team is through the live chat feature available directly on the platform. Our Indonesian-speaking agents are available every day of the year — including during Idul Fitri, Lebaran, and all Indonesian national public holidays — and typically respond within 60 seconds.
• Email (non-clickable): For formal written privacy inquiries, data subject access requests, or complaints, please send your message to [email protected]. Include "Data Privacy Request" in the subject line to ensure your message is routed directly to our Data Protection Officer. Responses to formal written requests are provided within 30 calendar days.

All support hours are displayed in WIB (Western Indonesia Time, UTC+7), which covers Jakarta, Surabaya, Bandung, Yogyakarta, Medan, Semarang, Palembang, and the majority of Indonesia's population centers. Members in Bali and Sulawesi (WITA, UTC+8) or Papua and Maluku (WIT, UTC+9) should note the time-zone difference when assessing expected response times.