maha33 Privacy Policy

1. Introduction

Welcome to the maha33 Privacy Policy. This document explains how maha33 ("we", "us", "our") collects, uses, stores, shares, and protects your personal information when you use our online betting platform and related services. We are committed to protecting your privacy and handling your data transparently in accordance with Indonesian data protection laws and international best practices.

By registering an account or using maha33 services, you acknowledge that you have read and understood this Privacy Policy and consent to the data processing practices described herein. If you do not agree with any aspect of this policy, you should not use our platform.

2. Information We Collect

maha33 collects several types of information to provide you with secure, personalized, and compliant betting services. The categories of data we collect include:

2.1 Personal Identification Information

When you register for a maha33 account, we collect:

• Full legal name as shown on your Indonesian national identity card (KTP)
• Date of birth to verify you are at least 21 years old
• Email address for account communications and password recovery
• Mobile phone number for account verification, security alerts, and customer support
• Residential address in Indonesia for regulatory compliance and KYC verification
• Government-issued ID documents (KTP photos, selfie verification) to prevent fraud and underage gambling
• Proof of address documents (utility bills, bank statements) if required for enhanced verification

2.2 Financial Information

To process deposits and withdrawals, we collect:

• Bank account details (bank name, account number, account holder name) for bank transfers via BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata
• E-wallet account information (registered phone numbers for OVO, DANA, GoPay, ShopeePay, LinkAja)
• Transaction history including deposit amounts, withdrawal requests, payment methods used, and transaction timestamps

Important: maha33 does not store credit card numbers, CVV codes, or full bank account credentials on our servers. Payment processing is handled by licensed third-party payment processors who maintain PCI DSS compliance.

2.3 Account Activity Data

We automatically collect information about your use of maha33 services, including:

• Betting history: Sports bets placed, casino games played, togel lottery tickets purchased, bet amounts, outcomes, and winnings
• Login records: Login timestamps, session durations, IP addresses, device information, and browser types
• Platform interactions: Pages visited, features used, buttons clicked, search queries, and navigation patterns
• Preferences: Game favorites, language settings, notification preferences, and display options
• Responsible gaming settings: Deposit limits, loss limits, session time limits, self-exclusion periods, and reality check configurations

2.4 Technical and Device Information

When you access maha33, we automatically collect:

• Device identifiers: Device type (mobile, tablet, desktop), operating system (Android, iOS, Windows), device model
• Network information: IP address, internet service provider, approximate geographic location (city/region level)
• Browser data: Browser type and version, language settings, time zone, screen resolution
• Cookies and tracking technologies: Session cookies, authentication tokens, analytics cookies (see Section 9 for details)

2.5 Communications

We retain records of:

• Customer support interactions: Live chat transcripts, email correspondence, phone call recordings (with notice), support ticket history
• Marketing communications: Email open rates, click-through rates, unsubscribe requests
• Promotional participation: Bonus claims, tournament entries, contest submissions

3. How We Use Your Information

maha33 uses your personal data for the following legitimate business purposes:

3.1 Account Management and Service Provision

• Creating and maintaining your maha33 account
• Verifying your identity and age (KYC compliance)
• Processing deposits and withdrawal requests
• Enabling you to place bets and play games
• Calculating and crediting winnings to your account balance
• Applying bonuses, promotions, and loyalty rewards
• Providing customer support and resolving disputes

3.2 Legal and Regulatory Compliance

• Complying with Indonesian laws and international gaming regulations
• Preventing fraud, money laundering, and terrorist financing
• Enforcing our Terms & Conditions and detecting terms violations
• Responding to legal requests from law enforcement or regulatory authorities
• Maintaining records required by licensing authorities
• Conducting internal audits and compliance reviews

3.3 Security and Fraud Prevention

• Detecting and preventing unauthorized account access
• Identifying suspicious betting patterns and collusion
• Preventing bonus abuse and arbitrage betting
• Monitoring for multiple accounts and account sharing
• Protecting against DDoS attacks, hacking attempts, and system vulnerabilities

3.4 Platform Improvement and Analytics

• Analyzing user behavior to improve website usability and mobile app performance
• Understanding which games and features are most popular
• Optimizing page load times and server performance
• Testing new features and conducting A/B tests
• Generating aggregate statistical reports (anonymized data)

3.5 Marketing and Communications

• Sending transactional emails (deposit confirmations, withdrawal notifications, password resets)
• Delivering promotional offers and bonus announcements (with your consent)
• Sending responsible gaming reminders and account alerts
• Notifying you of platform updates, maintenance schedules, and policy changes
• Conducting customer satisfaction surveys

Opt-Out: You may unsubscribe from marketing communications at any time by clicking the unsubscribe link in our emails or adjusting your preferences in your account settings. Transactional and security-related emails cannot be opted out.

3.6 Responsible Gaming and Player Protection

• Monitoring betting behavior for signs of problem gambling
• Enforcing deposit limits, loss limits, and self-exclusion periods
• Providing personalized responsible gaming resources and support
• Intervening proactively if we detect high-risk gambling patterns

4. Legal Basis for Processing (Indonesian Context)

Under Indonesian data protection principles, maha33 processes your personal data based on the following legal grounds:

• Contractual necessity: Processing is required to fulfill our contract with you (providing betting services as outlined in our Terms & Conditions)
• Legal obligation: Processing is required to comply with Indonesian laws, anti-money laundering regulations, and licensing requirements
• Consent: You have given explicit consent for marketing communications, cookies, and optional data processing
• Legitimate interests: Processing is necessary for our legitimate business interests (fraud prevention, security, platform improvement) while respecting your rights and freedoms

5. Data Sharing and Disclosure

maha33 does not sell your personal data to third parties. However, we may share your information with the following categories of recipients under strict confidentiality obligations:

5.1 Service Providers and Processors

• Payment processors: Licensed Indonesian banks and e-wallet providers to process deposits and withdrawals
• Game providers: Pragmatic Play, Evolution Gaming, NetEft, Microgaming, Pocket Games Soft to deliver casino games and slots
• KYC verification services: Third-party identity verification specialists to authenticate ID documents
• Cloud hosting providers: Secure data centers storing encrypted player information
• Customer support platforms: Live chat and ticketing systems used by our support team
• Analytics services: Anonymized usage statistics for platform optimization

All service providers are contractually bound to process your data only for specified purposes and maintain security standards equivalent to ours.

5.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement, regulatory bodies, or government agencies when:

• Required by Indonesian law or valid legal process (court orders, subpoenas)
• Necessary to comply with anti-money laundering (AML) reporting obligations
• Requested by our licensing authority as part of compliance audits
• Essential to protect the rights, property, or safety of maha33, our players, or the public
• Needed to prevent or investigate suspected illegal activity (fraud, money laundering, underage gambling)

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, or bankruptcy involving maha33, your personal data may be transferred to the successor entity. You will be notified of any such transfer and your rights regarding your data.

6. Data Security Measures

maha33 employs industry-leading security technologies and practices to protect your personal data from unauthorized access, alteration, disclosure, or destruction:

• Encryption: 256-bit SSL/TLS encryption for all data transmitted between your device and our servers. Sensitive data (passwords, financial information) is encrypted at rest using AES-256 encryption.
• Access controls: Role-based access restrictions ensure only authorized personnel can access personal data on a need-to-know basis. Multi-factor authentication is required for all employee accounts.
• Secure infrastructure: Data is stored on secure servers in geographically distributed data centers with 24/7 physical security, fire suppression, and redundant power supplies.
• Regular security audits: Independent third-party security firms conduct penetration testing and vulnerability assessments quarterly.
• Intrusion detection: Real-time monitoring systems detect and respond to unauthorized access attempts, DDoS attacks, and suspicious activity.
• Secure payment processing: Payment card data is never stored on maha33 servers. Third-party payment processors maintain PCI DSS Level 1 compliance.
• Employee training: All staff undergo data protection and security awareness training annually.
• Incident response plan: Documented procedures for detecting, containing, and reporting data breaches in accordance with legal requirements.

While we implement robust security measures, no system is 100% secure. You also play a role in protecting your data by choosing strong passwords, enabling two-factor authentication, and logging out after each session.

7. Data Retention

maha33 retains your personal information only as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specific retention periods include:

• Account data: Retained for the duration of your active account, plus 7 years after account closure (regulatory requirement for gaming operators)
• Transaction records: Retained for 7 years after the transaction date (anti-money laundering compliance)
• KYC documents: Retained for 7 years after account closure (regulatory requirement)
• Customer support communications: Retained for 3 years for quality assurance and dispute resolution
• Marketing communications data: Deleted within 30 days of unsubscribe request
• Cookies and technical data: Session cookies expire immediately; analytics cookies expire after 2 years
• Self-excluded accounts: Data retained for the self-exclusion period plus 7 years (to prevent circumvention)

After the applicable retention period, personal data is securely deleted or anonymized such that it can no longer identify you.

8. Your Rights and Choices

Under Indonesian data protection principles and international standards, you have the following rights regarding your personal data:

8.1 Right to Access

You may request a copy of the personal data we hold about you. This includes account information, transaction history, betting records, and communications. To request access, contact [email protected] with your account details and specify what information you wish to access.

8.2 Right to Rectification

You have the right to correct inaccurate or incomplete personal data. You can update your email address, phone number, and address directly in your account settings. For changes to your name or date of birth (which must match your KTP), contact customer support with supporting documentation.

8.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data in the following circumstances:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent (for data processing based on consent)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

Important limitations: We cannot delete data if we have a legal obligation to retain it (e.g., transaction records for 7 years per anti-money laundering laws). We also cannot delete data necessary to establish, exercise, or defend legal claims.

8.4 Right to Object

You may object to processing of your personal data for:

• Direct marketing: Opt out at any time via the unsubscribe link in emails or account settings
• Legitimate interests: Object to processing based on our legitimate interests (we will cease unless we can demonstrate compelling legitimate grounds)

8.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON) and transmit it to another service provider. Contact [email protected] to request data portability.

8.6 Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing emails, optional cookies), you may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

8.7 Right to Lodge a Complaint

If you believe maha33 has violated your data protection rights, you may lodge a complaint with the Indonesian data protection authority or your local supervisory authority.

9. Cookies and Tracking Technologies

maha33 uses cookies and similar technologies to enhance your experience, analyze usage patterns, and deliver personalized content. A cookie is a small text file stored on your device that helps our website recognize you.

Types of Cookies We Use:

• Essential cookies: Required for core functionality (login authentication, session management, security). These cannot be disabled.
• Performance cookies: Collect anonymous usage statistics to help us improve the platform (page load times, error rates, popular features).
• Functional cookies: Remember your preferences (language, currency display, notification settings).
• Analytics cookies: Third-party services (e.g., Google Analytics) that help us understand how users interact with maha33.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies may affect platform functionality. For more information, visit your browser's help section.

10. Children's Privacy

maha33 services are strictly intended for adults aged 21 and above. We do not knowingly collect personal information from minors. Our KYC verification process is designed to prevent underage access. If we discover that we have inadvertently collected data from a person under 21, we will immediately delete their account and all associated data. Parents or guardians who believe their child has accessed maha33 should contact [email protected] immediately.

11. International Data Transfers

Your personal data is primarily stored on secure servers located in Indonesia. However, some of our service providers (game providers, cloud hosting, analytics services) may be based outside Indonesia, which may involve transferring your data to countries with different data protection standards. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by data protection authorities
• Data processing agreements requiring equivalent security measures
• Encryption of data in transit and at rest

12. Updates to This Privacy Policy

maha33 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. When we make material changes, we will notify you via email or prominent notice on our website at least 30 days before the changes take effect. The "Last Updated" date at the top of this policy indicates when it was most recently revised. Continued use of maha33 after changes become effective constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Subject Line: Privacy Inquiry / Data Protection Request
• Live Chat: Available 24/7 on our website
• Response Time: We aim to respond to all privacy inquiries within 5 business days