mr888 Privacy Policy

This Privacy Policy applies to all personal data processed by mr888 in connection with the online gaming platform accessible at https://mr888.bio and all associated mobile-optimized interfaces (collectively, the "Platform"). It covers every stage of your interaction with mr888 — from initial registration through to Account closure.

For the purposes of applicable data protection law, mr888 acts as the data controller in respect of personal data collected directly from players and visitors to the Platform. mr888 may act as a data processor in respect of certain data processed on behalf of its licensed game-content providers or payment processing partners, as described in Section 5 below.

This Policy is intended to be read alongside mr888's Terms & Conditions and Responsible Gaming Policy, which together govern the full scope of the relationship between mr888 and its players. In the event of a conflict between this Privacy Policy and the Terms & Conditions, the Terms & Conditions shall prevail.

mr888 collects personal data in the categories set out in the table below. We collect only what is necessary for the stated purpose and do not retain data beyond the periods described in Section 6.

mr888 does not intentionally collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information. If any such data is incidentally disclosed in a support communication, it will not be processed for any purpose beyond resolving the relevant query.

mr888 collects personal data through the following channels:

• Direct Submission: Data you provide when registering an Account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or completing any form on the Platform.
• Automated Collection: Technical and gaming activity data collected automatically as you navigate and interact with the Platform. This includes data gathered via cookies, server logs, and session-tracking technologies as described in Section 8.
• Payment Processors: Confirmation data returned by Indonesian bank transfer systems and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when a deposit or withdrawal transaction is executed. mr888 does not receive or store full bank account credentials; only masked account identifiers and transaction reference numbers are retained.
• Identity Verification Partners: Where mr888 engages a third-party KYC or document verification provider, that provider may return a verification status and a risk score to mr888. The underlying document images are stored securely by mr888 as part of the KYC record.
• Game Content Providers: Aggregated session and game-outcome data passed from licensed game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) to mr888's platform layer for the purpose of account crediting, dispute resolution, and responsible gaming monitoring.
• Fraud Prevention Services: Device fingerprinting and behavioral analytics data generated by anti-fraud tools operated on mr888's behalf to detect and prevent unauthorized account access and payment fraud.

mr888 processes your personal data only where a valid legal basis exists. The primary purposes for which we process your data, and the corresponding legal basis for each, are as follows:

• Account Registration & Platform Access — Processing is necessary for the performance of the contract between you and mr888 (i.e., the Terms & Conditions you accept at registration). Without this data, mr888 cannot create or maintain your Account.
• Payment Processing & Transaction Management — Necessary for contract performance. mr888 must process your financial data to credit deposits, execute withdrawal requests, and maintain accurate account balances denominated in Indonesian Rupiah (IDR).
• Identity Verification (KYC) & Anti-Money Laundering Compliance — Necessary for compliance with mr888's legal obligations under its licensing framework and internationally recognized AML standards.
• Responsible Gaming Monitoring — Legitimate interest of mr888 to identify players who may be exhibiting signs of problem gambling and to fulfil mr888's duty of care obligations as a licensed gaming operator. Players located in Indonesia and across the archipelago benefit from these protections regardless of local regulatory status.
• Fraud Detection & Platform Security — Legitimate interest of mr888 and its players in preventing unauthorized account access, payment fraud, bonus abuse, and other integrity violations.
• Customer Support — Necessary for contract performance. mr888 must retain communications records to resolve disputes, process complaints, and provide continuity of support.
• Marketing Communications — Based on your explicit consent only. If you have opted in to receive promotional messages from mr888 (including bonus offers, free bet promotions, and seasonal campaigns such as those tied to Idul Fitri, Ramadhan, or Indonesian Independence Day), mr888 will process your contact data for this purpose. You may withdraw consent at any time.
• Platform Analytics & Improvement — Legitimate interest of mr888 to understand how players use the Platform in order to improve functionality, content quality, and user experience. Analytics data is aggregated and anonymized wherever possible.

mr888 does not sell or rent your personal data. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Processing Partners: Your name, account number, and transaction amount are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) solely to execute the deposit or withdrawal you have requested. These partners process data under their own privacy policies and applicable Indonesian banking regulations.
• KYC & Identity Verification Providers: Copies of identity documents submitted during KYC verification may be transmitted to a third-party verification service contracted by mr888. Such providers are bound by strict confidentiality agreements and data processing agreements that prohibit use of your data for any purpose other than verification.
• Licensed Game Content Providers: A pseudonymous player identifier and session data are shared with game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft) to facilitate gameplay, resolve game-round disputes, and support responsible gaming monitoring. Your full name, contact details, and financial data are not shared with game providers.
• Fraud Prevention & Security Services: Technical data, including IP addresses and device identifiers, may be shared with anti-fraud service providers retained by mr888 to detect and prevent unauthorized activity.
• Legal & Regulatory Authorities: mr888 may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other competent authorities where required to do so by applicable law, court order, or in connection with the investigation of fraud, money laundering, or other unlawful activity.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of mr888's assets, player data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained. mr888 will notify affected players of any such transfer where required by applicable law.

All third parties with whom mr888 shares personal data are required to maintain appropriate technical and organizational security measures and are prohibited from using your data for their own commercial purposes.

mr888 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. The general retention periods applied by mr888 are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with mr888's internal data disposal procedures. Where data cannot be immediately deleted due to technical constraints (e.g., backup tape rotation cycles), it is isolated from active processing until deletion is technically feasible.

mr888 implements a layered set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Key measures include:

• Encryption in Transit: All communication between your browser or device and mr888's servers is encrypted using TLS 1.3. Pages transmitting personal data are served exclusively over HTTPS.
• Encryption at Rest: Sensitive data fields — including KYC document files, bank account identifiers, and password hashes — are encrypted at rest using AES-256.
• Password Hashing: Account passwords are never stored in plaintext. They are processed using a modern, salted hashing algorithm (bcrypt) before storage. mr888 staff cannot retrieve your plaintext password under any circumstances.
• Access Controls: Access to production systems and player data is restricted to authorized personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication. All access events are logged for audit purposes.
• Vulnerability Management: mr888 conducts regular security assessments, including penetration testing and vulnerability scanning, of its Platform infrastructure. Critical vulnerabilities are remediated on an expedited basis.
• Incident Response: mr888 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a material risk to affected players, mr888 will notify those players without undue delay and take all reasonable steps to contain and remediate the breach.

mr888 uses cookies and similar technologies (collectively "cookies") to operate the Platform, maintain your login session, and collect aggregate analytics data. The types of cookies used on the mr888 Platform are described below:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function. They include session authentication tokens, security tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: These cookies remember your preferences — such as your preferred language display, previously selected game categories, and notification settings — to provide a more personalized experience. They are enabled by default but can be disabled via your browser settings.
• Analytics Cookies: mr888 uses privacy-respecting, server-side analytics to understand aggregate user behavior — such as which pages attract the most traffic, average session duration, and popular game categories. Analytics data is aggregated and does not identify individual players. No third-party behavioral advertising networks are used.

mr888 does not use cross-site tracking cookies, retargeting pixels from advertising networks, or social media tracking scripts. You can manage or delete cookies through your browser settings at any time. Disabling strictly necessary cookies will impair your ability to log in and use the Platform.

Subject to applicable law and the limitations described below, you have the following rights in respect of the personal data mr888 holds about you:

• Right of Access: You may request a copy of the personal data mr888 holds about you, together with information about how it is processed. mr888 will respond to verified access requests within 30 days.
• Right to Rectification: If any personal data mr888 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. Many basic details (email address, mobile number) can be updated directly from your Account profile page.
• Right to Erasure: You may request that mr888 delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where it has been unlawfully processed. This right is subject to mr888's obligations to retain certain data under AML and licensing requirements, as described in Section 6.
• Right to Restrict Processing: You may request that mr888 restrict the processing of your personal data in certain circumstances — for example, while a rectification request is pending verification.
• Right to Data Portability: Where processing is based on your consent or on contract performance, and is carried out by automated means, you may request that mr888 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of mr888's legitimate interests. mr888 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact mr888's data support team by email at [email protected] with the subject line "Data Rights Request" and include your registered username and mobile number for identity verification purposes. mr888 will respond within 30 calendar days of receiving a verifiable request.

mr888 is strictly an adults-only platform. Access to and use of mr888's Services is prohibited for any individual under the age of 21. mr888 does not knowingly collect personal data from persons under 21.

If you are the parent or guardian of a minor and believe that the minor has registered an Account on mr888 or has otherwise submitted personal data to the Platform, please contact mr888 immediately at [email protected]. Upon verification, mr888 will promptly close the Account, void all associated bets and balances, and delete the minor's personal data from its systems to the extent permitted by applicable legal retention obligations.

mr888 employs age verification controls at the point of registration and enforces KYC verification — including submission of a government-issued photo ID confirming date of birth — before processing any withdrawal. These controls are designed to minimize the risk of underage gambling and underage data collection on the Platform.

mr888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the features and functionality of the Platform. The "Last Updated" date at the top of this page will be revised whenever a material change is made.

Where a proposed change is material — meaning it significantly affects your rights or the way in which mr888 processes your personal data — mr888 will provide advance notice of the change by posting a prominent notice on the Platform and/or by sending a notification to your registered email address at least 14 days before the change takes effect.

Your continued use of the mr888 Platform following the effective date of any amended Privacy Policy constitutes your acknowledgment of the updated terms. If you do not accept the revised Privacy Policy, you should discontinue use of the Platform and may request Account closure in accordance with the procedure set out in our Terms & Conditions.

If you have any questions, concerns, or complaints about this Privacy Policy or about the way in which mr888 handles your personal data, please contact us through one of the following channels:

• Email: [email protected] — for data rights requests, please include "Data Rights Request" in the subject line.
• Live Chat: Available 24 hours a day, 7 days a week, directly from the mr888 Platform. Our support team includes Indonesian-speaking agents able to assist players from Jakarta, Surabaya, Bandung, Medan, Bali, and across the archipelago.

mr888 is committed to resolving privacy-related complaints promptly and transparently. If you submit a complaint, mr888 will acknowledge receipt within two business days (WIB) and provide a substantive response within 14 calendar days. Where a complaint relates to a data rights request that requires additional verification, the 30-day response window described in Section 9 applies.

If you are not satisfied with mr888's response to your complaint, you may have the right to escalate the matter to a relevant data protection supervisory authority in the jurisdiction applicable to you. mr888 will cooperate fully with any such authority in the investigation of a complaint.

This Privacy Policy was last revised in January 2026. Thank you for taking the time to read it in full. Playing on mr888 should be an enjoyable, secure, and transparent experience — and responsible data handling is a fundamental part of that commitment.