Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how maha99 ("we," "us," "our") collects, processes, stores, uses, and discloses personal information from users ("you," "your") of our website https://maha99.cam and all associated gaming services. By creating an account or using any maha99 services, you acknowledge that you have read, understood, and consent to the data practices described in this Privacy Policy.

This Privacy Policy applies to all personal information collected through our website, mobile-optimized platform, customer support channels, and any other maha99 touchpoints. It covers information collected directly from you, as well as information obtained from third parties such as payment processors and identity verification services.

maha99 reserves the right to update or modify this Privacy Policy at any time. Material changes will be communicated via email to registered users and through prominent notice on our website. Continued use of our services after such modifications constitutes your acceptance of the updated Privacy Policy.

2. Information We Collect

maha99 collects various types of personal information necessary to provide our gaming services, ensure platform security, comply with regulatory requirements, and improve user experience. The information we collect falls into the following categories:

2.1 Account Registration Information

When you create a maha99 account, we collect:

• Personal Identification: Full legal name as it appears on your Indonesian national ID (KTP - Kartu Tanda Penduduk), date of birth, place of birth, gender, and nationality
• Contact Information: Residential address (including street, city, province, postal code), email address, and mobile phone number
• Account Credentials: Username and encrypted password (we store passwords using industry-standard hashing algorithms—we never store or have access to your actual plain-text password)
• Security Questions: Answers to security questions used for account recovery (stored in encrypted format)

2.2 Identity Verification (KYC) Documentation

To comply with anti-money laundering (AML) regulations and prevent fraud, we require:

• Clear, legible copies of your Indonesian national ID card (KTP) showing your photograph, full name, date of birth, and ID number
• Proof of residential address dated within the last 3 months (utility bill, bank statement, government correspondence, or official rental agreement)
• Recent selfie photograph holding your ID card next to your face for biometric verification
• In certain circumstances, additional documentation such as proof of income or source of funds may be requested for unusually large transactions

2.3 Financial and Transaction Information

• Bank account details (bank name, account number, account holder name) or e-wallet information (OVO, DANA, GoPay, ShopeePay, LinkAja account details) used for deposits and withdrawals
• Complete transaction history including deposit amounts, withdrawal requests, bet placements, game outcomes, bonus claims, and account balance changes
• Payment method metadata (transaction IDs, timestamps, processing status, IP addresses at time of transaction)
• Note: We do not store complete credit/debit card numbers or CVV codes—payment processing is handled by PCI DSS-compliant third-party payment processors

2.4 Gameplay and Behavioral Data

• Complete gaming history: games played, bet amounts, win/loss records, jackpot wins, session durations, and gameplay patterns
• Sports betting records: events wagered on, bet types, odds accepted, stake amounts, settlement outcomes
• Bonus and promotion activity: bonuses claimed, wagering requirement progress, bonus winnings, promotional code usage
• Responsible gaming tool usage: deposit limits set, session time limits, self-exclusion requests, reality check notifications received
• This behavioral data helps us identify unusual patterns that may indicate problem gambling, fraud, or collusion

2.5 Technical and Device Information

When you access maha99, we automatically collect certain technical information:

• IP address and geolocation data (city/region level, not precise GPS coordinates) to verify you are accessing our services from within permitted jurisdictions
• Device information: device type (smartphone, tablet, desktop), operating system, browser type and version, screen resolution
• Usage analytics: pages visited, features used, navigation paths, time spent on different sections, click patterns
• Cookies and similar tracking technologies (see Section 8 for detailed cookie policy)
• Error logs and crash reports to help us identify and fix technical issues

2.6 Customer Support Communications

• All correspondence with our customer support team via live chat, email, or phone, including timestamps, transcripts, attachments, and resolution outcomes
• Feedback, complaints, and survey responses you provide
• Voice recordings if you contact us by phone (you will be notified before recording begins)

3. How We Use Your Information

maha99 uses the collected personal information for the following legitimate business purposes:

3.1 Service Provision and Account Management

• Creating and maintaining your maha99 account
• Verifying your identity and age (21+ requirement) through KYC procedures
• Processing deposits, withdrawals, and other financial transactions
• Enabling gameplay, settling bets, and crediting winnings to your account
• Managing bonuses, promotions, and loyalty rewards
• Providing customer support and responding to your inquiries

3.2 Security, Fraud Prevention, and Compliance

• Detecting and preventing fraudulent activity, money laundering, collusion, bonus abuse, and other violations of our Terms & Conditions
• Monitoring for suspicious betting patterns that may indicate match-fixing or insider information exploitation
• Complying with anti-money laundering (AML) and know-your-customer (KYC) regulations
• Maintaining platform security and protecting against unauthorized access, hacking attempts, and cyber threats
• Enforcing age restrictions to prevent underage gambling
• Responding to legal obligations, court orders, or requests from law enforcement or regulatory authorities

3.3 Responsible Gaming and Player Protection

• Identifying players who may be at risk of developing gambling problems based on behavioral indicators (rapid deposit increases, extended session times, chasing losses)
• Implementing and monitoring deposit limits, loss limits, and self-exclusion requests
• Sending reality check notifications and responsible gaming reminders
• Providing personalized responsible gaming resources and support

3.4 Platform Improvement and Analytics

• Analyzing usage patterns to improve website functionality, user experience, and game offerings
• Conducting A/B testing on features, layouts, and promotional offers
• Identifying technical issues, bugs, and performance bottlenecks
• Developing new features based on player feedback and behavioral data

3.5 Marketing and Communications (With Your Consent)

• Sending promotional emails about new games, bonuses, tournaments, and special offers (you can opt out at any time)
• Providing personalized game recommendations based on your play history
• Sending important account notifications (security alerts, policy updates, responsible gaming reminders) which cannot be opted out of as they are essential service communications

4. Legal Basis for Processing Your Data

maha99 processes your personal information under the following legal grounds:

• Contractual Necessity: Processing is necessary to fulfill our obligations under the Terms & Conditions you agreed to when creating your account
• Legal Compliance: Processing is required to comply with AML/KYC regulations, age verification laws, tax reporting obligations, and responses to lawful requests from authorities
• Legitimate Interests: Processing serves our legitimate business interests in fraud prevention, security, platform improvement, and protecting our intellectual property, provided these interests do not override your fundamental privacy rights
• Consent: For marketing communications and non-essential cookies, we obtain your explicit consent, which you can withdraw at any time

5. Data Sharing and Third-Party Disclosures

maha99 does not sell, rent, or trade your personal information to third parties for their marketing purposes. However, we may share your data with the following categories of recipients under strict confidentiality and data protection agreements:

5.1 Payment Processors

We share necessary financial information with Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposits and withdrawals. These partners are contractually obligated to handle your data securely and only for transaction processing purposes.

5.2 Identity Verification Services

We use third-party KYC verification services to authenticate your Indonesian national ID (KTP) and other submitted documents. These services compare your documents against government databases to confirm authenticity and prevent identity fraud.

5.3 Game Providers and Software Partners

Certain gaming content on maha99 is provided by third-party game studios. When you play these games, minimal technical data (user ID, bet amount, game outcome) is shared with the provider for game functionality and RTP verification. Your personal identification information is not shared with game providers.

5.4 Cloud Storage and Hosting Providers

maha99 uses enterprise-grade cloud infrastructure providers to host our platform and store data securely. These providers are GDPR-compliant and maintain ISO 27001 information security certifications. All data is stored in encrypted format both at rest and in transit.

5.5 Analytics and Monitoring Services

We use analytics tools to monitor website performance, user behavior (in anonymized/pseudonymized form), and security threats. These tools help us improve platform reliability and user experience.

5.6 Legal and Regulatory Authorities

We may disclose your information to law enforcement agencies, regulatory bodies, courts, or government authorities when legally required to do so, or when we believe in good faith that such disclosure is necessary to comply with legal obligations, enforce our Terms & Conditions, protect our rights and property, or ensure public safety.

5.7 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy involving maha99, your personal information may be transferred to the successor entity, subject to the same privacy protections outlined in this policy.

6. Data Security Measures

maha99 implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction:

• Encryption: All data transmission uses 256-bit SSL/TLS encryption (the same standard used by banks). Passwords are hashed using bcrypt with individual salts. Sensitive documents (KYC materials) are encrypted at rest using AES-256 encryption.
• Access Controls: Personal data is accessible only to authorized maha99 personnel who require it to perform their job functions. All access is logged and monitored. Employees undergo background checks and sign strict confidentiality agreements.
• Network Security: Our infrastructure is protected by enterprise firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and DDoS mitigation services.
• Regular Security Audits: We conduct quarterly penetration testing by independent security firms and maintain continuous vulnerability scanning.
• Data Segregation: Player funds are held in segregated accounts separate from operational funds, ensuring your money is protected even in the unlikely event of company financial difficulties.
• Physical Security: Data centers hosting our infrastructure maintain 24/7 physical security, biometric access controls, and environmental monitoring.

7. Data Retention

maha99 retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

Data Type	Retention Period	Reason
Account information	Duration of active account + 7 years	Regulatory compliance, fraud prevention
KYC documents	7 years after account closure	AML/KYC legal requirements
Transaction history	7 years after transaction date	Tax reporting, audit compliance
Gameplay history	5 years after account closure	Dispute resolution, regulatory reporting
Marketing consent records	Duration of consent + 3 years	Proof of consent for regulatory purposes
Customer support communications	3 years after last interaction	Quality assurance, training, dispute resolution

After the applicable retention period expires, your personal information is securely deleted or anonymized so that it can no longer be associated with you personally. Anonymized data may be retained indefinitely for statistical and research purposes.

8. Cookies and Tracking Technologies

maha99 uses cookies (small text files stored on your device) and similar tracking technologies to enhance your browsing experience, analyze site usage, and deliver personalized content. We use the following types of cookies:

• Essential Cookies: Required for basic platform functionality such as account login, session management, and security. These cannot be disabled without breaking core features.
• Performance Cookies: Collect anonymous data about how you use our website (pages visited, errors encountered) to help us improve performance.
• Functional Cookies: Remember your preferences (language selection, display settings) to provide a more personalized experience.
• Marketing Cookies: Track your browsing behavior to deliver relevant promotional offers. These require your consent and can be disabled through cookie settings.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may limit your ability to use some features of the maha99 platform.

9. Your Privacy Rights

As a maha99 user, you have the following rights regarding your personal information:

• Right of Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct any inaccurate or incomplete personal information
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to Restrict Processing: Limit how we use your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Opt out of marketing communications and certain data processing activities
• Right to Withdraw Consent: Revoke consent for data processing that was based on consent

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond to your request within 30 days. Please note that some requests may require identity verification to prevent unauthorized disclosure of your information.

10. International Data Transfers

While maha99 primarily serves Indonesian players and stores data within secure cloud infrastructure, certain third-party service providers may process data in jurisdictions outside Indonesia. We ensure that any international data transfers comply with applicable data protection laws and that recipient countries provide adequate protection for your personal information through appropriate safeguards such as standard contractual clauses.

11. Children's Privacy

maha99 services are strictly intended for individuals aged 21 years or older. We do not knowingly collect personal information from anyone under the age of 21. If we discover that we have inadvertently collected information from a minor, we will immediately delete such data and permanently close the associated account. Parents or guardians who believe their child has provided information to maha99 should contact us immediately at [email protected].

12. Changes to This Privacy Policy

maha99 may update this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated through prominent notice on our website and email notification to registered users at least 30 days before the changes take effect. The "Last Updated" date at the top of this policy indicates when the most recent revisions were made. We encourage you to review this Privacy Policy regularly to stay informed about how we protect your information.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Subject Line: Privacy Inquiry
• Data Protection Officer: Available through customer support channels
• Response Time: We aim to respond to all privacy inquiries within 5 business days

For immediate assistance with account-related privacy matters, our 24/7 live chat support is available in both English and Bahasa Indonesia.