Data Protection & Privacy
At mbs168, your privacy is a foundational commitment — not a compliance checkbox. This Privacy Policy explains precisely what personal data we collect, why we collect it, how we protect it, and what rights you hold over your information as a player on our platform.
Our Privacy Commitments
We believe every player deserves to know exactly how their information is handled. These six principles shape every data-related decision we make at mbs168.
All data transmitted between your device and mbs168's servers is secured by industry-standard 256-bit SSL encryption. Your login credentials, financial details, and personal information travel only through encrypted channels.
mbs168 does not sell, rent, or trade your personal data to third parties for their own marketing purposes — ever. The only third parties who receive your data are those strictly necessary to operate the platform (payment processors, KYC providers, game studios).
We collect only the minimum personal data necessary to provide our services, verify your identity, process payments, and comply with our legal obligations. We do not collect data speculatively or for undefined future purposes.
Player data is stored on hardened, access-controlled servers with strict role-based access policies. Our internal teams access personal data only on a need-to-know basis, and all access events are logged and audited.
We retain your data only for as long as your account is active, or as long as required by applicable law and our regulatory obligations. Inactive accounts are flagged for data review after 24 months of inactivity.
You have the right to access, correct, and request deletion of your personal data at any time by contacting our support team. We process all data rights requests within 14 business days and keep you informed throughout the process.
1.1 Scope. This Privacy Policy governs the collection, processing, storage, and transfer of personal data by mbs168 in connection with the operation of the online betting and gaming platform accessible at mbs168.cam ("the Platform"). It applies to all registered Players, visitors, and any other individuals whose personal data mbs168 processes in connection with the Platform.
1.2 Data Controller. mbs168 acts as the data controller in respect of the personal data it collects directly from Players and visitors. As data controller, mbs168 determines the purposes and means by which personal data is processed. Where mbs168 engages third-party data processors (such as KYC providers or payment processors), those third parties act strictly under mbs168's instruction and may not use your data for their own independent purposes.
1.3 Indonesia Market Context. mbs168 serves a primary audience of online gaming players based in Indonesia, including users in Jakarta, Surabaya, Bandung, Medan, Bali, Yogyakarta, and other major cities. Where this policy references local payment providers — such as BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja — those references are specific to the data processing activities required to facilitate IDR-denominated transactions for Indonesian players.
1.4 Contact. For all privacy-related inquiries, please contact mbs168 at: [email protected]
mbs168 collects personal data through several channels: directly from you when you register or use the Platform; automatically through your device and browser when you access the Platform; and from third-party verification and payment partners where required to deliver our services. The categories of personal data we collect include:
| Category | Examples | Source |
|---|---|---|
| Identity Data | Full legal name, date of birth, KTP number (Indonesian National ID), nationality, gender | Provided directly by you during registration or KYC |
| Contact Data | Email address, phone number, city of residence (e.g., Jakarta, Surabaya, Bandung) | Provided directly by you |
| Financial Data | Bank account number, bank name (BCA, BRI, BNI, Mandiri, etc.), e-wallet identifier (OVO, DANA, GoPay), transaction history | Provided by you or received from payment processors |
| Verification Data | KTP image, selfie with KTP, proof of address (bank statement or utility bill) | Provided by you during KYC verification |
| Gaming Activity Data | Bet history, wagering amounts, game preferences, session duration, win/loss records, togel (numbers lottery) selections | Generated automatically through platform use |
| Technical Data | IP address, device type, operating system, browser type and version, screen resolution, time zone (WIB/WITA/WIT) | Collected automatically via cookies and server logs |
| Communication Data | Support chat transcripts, email correspondence, WhatsApp message content (when contacting support) | Generated when you contact our support team |
| Marketing Preferences | Promotion opt-in/opt-out status, preferred communication channel, bonus claim history | Provided by you or inferred from platform behavior |
2.1 Sensitive Data. mbs168 does not intentionally collect sensitive personal data categories (such as health, religious, or political data) except where gaming activity data is used to assess responsible gaming risk — in which case it is processed solely for player protection purposes and is never used for marketing or shared with third parties outside the responsible gaming context.
mbs168 processes your personal data only where a lawful basis exists. The applicable bases are:
4.1 Account Management. We use your Identity and Contact Data to create and maintain your mbs168 account, authenticate your logins, and communicate important account-related notices to you.
4.2 Payment Processing. We use your Financial Data to process deposits and withdrawals via your nominated Indonesian bank account (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja). We share the minimum necessary data with payment processors to execute each transaction.
4.3 Identity Verification (KYC). We use your Verification Data to confirm your identity, verify your age (21+ requirement), and fulfill our AML compliance obligations. KYC data is shared with our appointed third-party identity verification provider and is handled under strict data processing agreements.
4.4 Gaming Services. We use your Gaming Activity Data to provide personalized gaming experiences, settle bets accurately, display your betting and transaction history, and operate the togel (numbers lottery), sports betting, live casino, and slot game verticals available on the Platform.
4.5 Responsible Gaming. We analyze Gaming Activity Data and session behavior to identify early indicators of problem gambling. Where such indicators are detected, we may proactively contact you to offer responsible gaming support tools including deposit limits, time-outs, or self-exclusion, in accordance with our Responsible Gaming obligations.
4.6 Fraud Prevention and Security. We use Technical Data and Financial Data to detect and prevent fraud, unauthorized account access, collusion, and money laundering. Automated risk-scoring systems may flag unusual patterns for manual review by our compliance team.
4.7 Marketing Communications. Where you have opted in to receive promotional materials, we use your Contact Data and Marketing Preferences to send you relevant offers, seasonal promotions (for example, Idul Fitri, Ramadhan, or Indonesian Independence Day promotions), and platform news. You may opt out at any time.
4.8 Platform Improvement. We use aggregated and anonymized Technical Data and Gaming Activity Data to analyze platform performance, identify usability improvements, and develop new features. This data cannot be used to identify individual players.
5.1 Third-Party Processors. mbs168 engages carefully vetted third-party data processors to assist in delivering our services. These processors act solely on mbs168's instruction and are bound by strict data processing agreements. Categories of processors we use include:
5.2 Legal Disclosures. mbs168 may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where required by applicable law, a valid legal order, or where we reasonably believe disclosure is necessary to protect the safety of any individual or to prevent criminal activity.
5.3 Business Transfers. In the event of a merger, acquisition, or sale of all or part of mbs168's business, your personal data may be transferred to the successor entity. We will notify you via email or prominent platform notice before any such transfer takes effect and before your data becomes subject to a different privacy policy.
5.4 No Sale of Data. mbs168 does not sell, rent, or trade your personal data to any third party for that party's own commercial purposes. This prohibition is absolute and applies regardless of the commercial value of the data.
6.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. mbs168 uses cookies and similar tracking technologies (such as web beacons and local storage objects) to maintain your session, remember your preferences, and analyze how the Platform is used.
6.2 Types of Cookies We Use.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, login authentication, security tokens, fraud prevention flags | Session / up to 24 hours |
| Functional | Remembering your language preference, preferred deposit method, and display settings | Up to 12 months |
| Performance / Analytics | Measuring page load times, identifying navigation drop-off points, tracking aggregated usage patterns | Up to 24 months |
| Marketing | Tracking promotion clicks and bonus claim journeys to evaluate campaign effectiveness (anonymized) | Up to 30 days |
6.3 Managing Cookies. You may disable non-essential cookies through your browser settings at any time. Please note that disabling strictly necessary cookies will impair your ability to log in and use core platform features. Instructions for managing cookies in common browsers are available in each browser's help documentation.
7.1 Technical Measures. mbs168 implements appropriate technical security measures proportionate to the sensitivity of the data held. These include:
7.2 Organizational Measures. Access to personal data is restricted to staff who have a legitimate need to process it. All staff with data access undergo data protection training and are bound by confidentiality obligations. Third-party data processors are subject to contractual security requirements and periodic audits.
7.3 Data Breach Response. In the event of a personal data breach that poses a risk to your rights and freedoms, mbs168 will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach. Where required by applicable law, relevant authorities will also be notified within the prescribed timeframe.
8.1 Active Accounts. Personal data associated with an active mbs168 account is retained for the duration of the account's active status plus the minimum retention period required by applicable AML and gaming regulations — typically five (5) years from the date of the last transaction or account activity.
8.2 Closed Accounts. Upon account closure, mbs168 retains the minimum data necessary to satisfy regulatory requirements, resolve any outstanding disputes, and prevent re-registration by self-excluded players. Data not required for these purposes is deleted or anonymized within 90 days of account closure.
8.3 KYC Records. Identity and verification documents (KTP copies, selfies, proof of address) are retained for a minimum of five (5) years from the date of collection, in accordance with standard AML regulatory expectations for online gaming operators.
8.4 Communication Records. Support correspondence (email and chat transcripts) is retained for three (3) years to facilitate dispute resolution and quality assurance. Records related to complaint investigations or regulatory inquiries may be retained for longer where legally necessary.
8.5 Anonymization. Where the retention period for a specific data set has elapsed and there is no ongoing legal basis for continued storage, mbs168 will either securely delete the data or anonymize it such that it can no longer be attributed to any individual player.
mbs168 respects your right to control your personal data. Depending on your circumstances, you may exercise the following rights by submitting a request to [email protected]:
Request a copy of the personal data mbs168 holds about you, including details of how it is being used and with whom it has been shared.
Request correction of inaccurate or incomplete personal data. We will update your records and notify any relevant third parties of the correction.
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent and no overriding legal basis exists.
Request that mbs168 pause processing of your data — for example, while the accuracy of data you have contested is verified.
Receive a structured, machine-readable copy of personal data you have provided to mbs168, suitable for transfer to another service provider.
Object to processing based on legitimate interests, including direct marketing. We will cease processing unless compelling legitimate grounds override your objection.
Response Timeframe. mbs168 will acknowledge all privacy rights requests within 5 business days and complete the requested action within 14 business days. Where a request is complex or high in volume, we may extend this period by a further 14 days, providing written notice of the extension and the reason for it.
Identity Verification for Rights Requests. To protect against unauthorized requests, mbs168 will verify your identity before processing any data rights request. You will be asked to confirm your registered email address and may be asked to provide additional verification information consistent with our KYC process.
If you believe a minor has registered on the Platform, please contact us immediately at [email protected]. Parents and guardians are encouraged to make use of parental control software to restrict access to online gambling platforms.
11.1 Cross-Border Processing. mbs168 operates internationally and may transfer your personal data to servers or third-party processors located outside Indonesia. Where such transfers occur, mbs168 ensures that adequate data protection safeguards are in place, including contractual clauses that require the recipient to protect your data to the same standard as this Privacy Policy.
11.2 Payment Data. Financial transaction data related to Indonesian bank transfers (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI) and e-wallet payments (OVO, DANA, GoPay, ShopeePay, LinkAja) is processed within the payment provider's own data infrastructure. mbs168 selects only payment processors that maintain robust data security certifications commensurate with the sensitivity of financial data.
11.3 Player Rights on Transfer. Transferring your data internationally does not diminish any of your privacy rights set out in Section 9 of this policy. You may submit a rights request at any time regardless of where your data is processed.
12.1 Right to Update. mbs168 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, new services, regulatory developments, or legal requirements. The "Last Updated" date at the top of this policy will be revised accordingly whenever a material change is made.
12.2 Notification of Material Changes. Where changes are material — meaning they significantly affect your rights or the way we handle your personal data — mbs168 will provide at least 14 days' advance notice via email to your registered address and/or via a prominent in-platform banner before the revised policy takes effect.
12.3 Continued Use. Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised policy, you must cease using the Platform and may request account closure by contacting our support team.
13.1 Privacy Inquiries. For any questions, concerns, or requests relating to this Privacy Policy or mbs168's data handling practices, please contact our dedicated privacy support team:
13.2 Complaints. If you are dissatisfied with how mbs168 has handled your personal data or responded to a privacy rights request, you have the right to submit a complaint. We encourage you to contact us first to allow us the opportunity to resolve your concern directly before escalating to any external body. We treat all privacy complaints seriously and will investigate thoroughly and transparently.
13.3 Related Policies. This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gaming policy, which together govern the full scope of your relationship with mbs168.
Stay Informed
Our support team is available around the clock to answer data inquiries. You can also review our Terms & Conditions or visit the FAQ for quick answers to common questions.