mz356 Privacy Policy

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Platform" — the mz356 website accessible at https://mz356.cam, including all sub-pages, mobile interfaces, and associated services.
• "Personal Data" — any information that identifies or can reasonably identify a living individual, including name, date of birth, national identity number, contact details, financial data, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, or deletion.
• "Data Controller" — mz356, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — a third party that processes Personal Data on behalf of mz356 under a binding data processing agreement (e.g., payment processors, KYC verification providers).
• "Member" / "User" / "you" — any individual who has registered, or is in the process of registering, an Account on the mz356 Platform.
• "KYC" — Know Your Customer: the identity and age-verification process required under anti-money laundering (AML) standards.
• "Cookies" — small text files placed on your device by the Platform to support session management, security, and analytics functions.

mz356 collects personal data in the categories listed below. Data markedRequired is necessary to operate your Account. Data marked Optional is collected only where you choose to provide it. Data marked Automatic is collected passively as part of normal Platform operation.

We do not collect special categories of sensitive personal data (e.g., racial or ethnic origin, religious beliefs, health data, political opinions) beyond what is incidentally apparent from KYC documents.

3.1 Directly from You. The majority of your Personal Data is provided directly by you during the account registration process, KYC verification, deposit and withdrawal requests, communications with customer support, and when you adjust your account preferences or responsible gaming settings.

3.2 Automatically Through Platform Use. When you access and use the mz356 Platform, our servers automatically record technical and device data including your IP address, session timing, browser fingerprint, and in-Platform navigation behaviour. This data is collected via server logs and first-party cookies.

3.3 From Third-Party Service Providers. mz356 may receive data about you from trusted third-party partners in the following contexts:

• Payment processors (e.g., local bank gateway providers for BCA, BRI, BNI, Mandiri transfers and e-wallet providers for OVO, DANA, GoPay) confirm transaction status, account name matching, and fraud signals;
• KYC and identity verification partners may return verification results, document authenticity scores, and fraud risk ratings;
• Responsible gaming databases may flag accounts subject to self-exclusion orders that you have registered with recognised exclusion programmes.

• Contractual Necessity: Processing your identity data, contact data, and financial data is necessary to create and maintain your Account, process deposits and withdrawals, and settle bets — all of which form the core of the service contract between you and mz356.
• Legal Obligation: mz356 is required by its international licensing obligations and AML/KYC regulatory requirements to collect identity verification documents, retain transaction records, and report certain suspicious activity to the relevant authorities. We cannot waive these obligations on request.
• Legitimate Interests: mz356 processes technical and device data, gaming activity logs, and communications data based on its legitimate interests in preventing fraud, ensuring platform security, improving service quality, and enforcing these Terms. These interests do not override your fundamental rights where those rights are clearly applicable.
• Consent: Where we send you optional marketing communications or use non-essential cookies, we will seek your consent at the relevant point. You may withdraw consent at any time by contacting support or adjusting your Account notification settings.

mz356 uses your Personal Data for the following specific purposes:

• Account Creation and Management: Creating your Member account, verifying your identity and age (21+), maintaining your account settings, and processing account-related requests;
• Payment Processing: Facilitating deposits and withdrawals via local Indonesian bank transfers (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, OCBC NISP, BSI) and e-walets (OVO, DANA, GoPay, ShopeePay, LinkAja), and reconciling transaction records;
• KYC and AML Compliance: Verifying that you meet the minimum age requirement of 21 years, confirming your identity against the information you provided, and screening against sanctions and watchlists as required by our licensing obligations;
• Fraud Prevention and Security: Detecting and preventing unauthorised account access, detecting bonus abuse and collusion, identifying suspicious betting patterns, and protecting the integrity of the mz356 Platform;
• Responsible Gaming: Monitoring gaming behaviour patterns to identify potential signs of problem gambling, enforcing self-exclusion and deposit limits set by you, and proactively reaching out to Members who may benefit from responsible gaming resources;
• Customer Support: Responding to your enquiries, resolving disputes, and improving our support processes based on communication records;
• Platform Improvement: Analysing aggregated, anonymised usage data to improve game selection, interface performance, payment routing, and overall Member experience;
• Marketing Communications (with consent): Sending you information about promotions, seasonal offers (e.g., Idul Fitri, Ramadhan, Indonesian Independence Day specials), and new game launches — only where you have opted in to receive such communications.

mz356 does not use your Personal Data for automated profiling that produces legally significant decisions without human review.

6.1 We Do Not Sell Your Data. mz356 does not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes.

6.2 Service Providers (Data Processors). mz356 shares Personal Data with carefully selected third-party service providers who process data strictly on our behalf and under binding data processing agreements. These include:

• Payment gateway and banking partners processing IDR transactions (BCA, BRI, BNI, Mandiri, and e-wallet providers);
• Identity verification and KYC technology providers;
• Cloud hosting and data storage providers operating under equivalent data security standards;
• Fraud detection and risk management systems;
• Customer support platform providers (live chat, ticketing systems);
• Game studios and live casino operators (e.g., Pragmatic Play, Evolution Gaming) to the extent technically necessary for session management.

6.3 Legal and Regulatory Disclosure. mz356 may disclose your Personal Data where required by a valid court order, regulatory authority request, or the obligations of our international gaming licence. We will notify you of such disclosure where legally permitted to do so.

6.4 Corporate Transactions. In the event of a merger, acquisition, or sale of assets involving mz356 or its operating entities, your Personal Data may be transferred to the acquiring entity, subject to at least equivalent privacy protections remaining in place. You will be notified of any such transfer prior to its completion.

6.5 Aggregated and Anonymised Data. mz356 may share aggregated statistical data (e.g., total number of active Members in Jakarta, most-played game categories) with partners or for industry research purposes. This data contains no information that can identify any individual Member.

7.1 What Are Cookies. Cookies are small text files that the mz356 Platform places on your browser or device when you visit the site. They allow the Platform to remember your session, maintain your login state, and understand how you interact with pages and features.

7.2 Cookies Used by mz356. The following categories of cookies are deployed on the mz356 Platform:

7.3 No Third-Party Advertising Cookies. mz356 does not deploy third-party advertising cookies, pixel trackers from social media platforms, or cross-site behavioural tracking technologies. Your browsing activity on the mz356 Platform is not shared with advertising networks.

7.4 Managing Cookies. You can control cookie settings through your browser's privacy settings. Disabling strictly necessary cookies will impair or prevent your ability to log in and use the Platform. Disabling analytics cookies will have no impact on your gaming experience.

8.1 Active Accounts. While your Account remains active, mz356 retains all Personal Data associated with your Account to enable ongoing service delivery and compliance monitoring.

8.2 Closed or Terminated Accounts. Following closure, mz356 retains the following categories of data for the periods specified:

• Identity and KYC documents: Minimum five (5) years from Account closure, in accordance with international AML record-keeping standards;
• Financial transaction records: Minimum five (5) years from the date of each transaction;
• Responsible gaming records (self-exclusion, limit history): Minimum five (5) years to support re-registration screening;
• Customer support communications: Two (2) years from the date of each communication;
• Technical and device logs: Twelve (12) months from the date of recording, unless flaged for a fraud or security investigation.

8.3 Legal Hold. Where Personal Data is subject to an active legal claim, regulatory investigation, or court order, retention is extended for the duration of those proceedings regardless of the standard periods above.

8.4 Deletion. Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with mz356's data disposal procedures.

9.1 Technical Measures. mz356 implements a layered set of technical security controls to protect Personal Data against unauthorised access, disclosure, alteration, and destruction:

• 256-bit TLS/SSL encryption for all data in transit between the Platform and your browser or device;
• AES-256 encryption for sensitive Personal Data stored in our databases;
• Multi-factor authentication requirements for all administrative access to systems containing Personal Data;
• Continuous intrusion detection and anomaly monitoring across all Platform infrastructure;
• Regular penetration testing and security audits by independent third-party specialists;
• Strict access controls ensuring that only authorised personnel with a genuine operational need can access specific categories of Member data.

9.2 Organisational Measures. Access to Personal Data within mz356 is granted on a need-to-know basis. All personnel with access to Member data are subject to confidentiality obligations and receive regular training on data protection practices.

9.3 Data Breach Response. In the event of a confirmed Personal Data breach that presents a risk to your rights and freedoms, mz356 will notify affected Members via the email address registered on their Account as promptly as practicable, and will take immediate remediation steps to contain and assess the breach.

9.4 Your Responsibility. While mz356 applies rigorous security controls on its end, you are also responsible for maintaining the security of your Account credentials. Use a strong, unique password and enable any two-factor authentication options offered by the Platform. Do not share your login details with anyone.

As a Member of the mz356 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, contact our Data Privacy team at the email address listed in Section 14 of this Policy.

• Right of Access: You may request a copy of the Personal Data mz356 holds about you, along with information about how it is processed and for what purposes.
• Right to Rectification: You may request correction of any Personal Data that is inaccurate or incomplete. You can update many details directly in your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal retention obligations — mz356 cannot delete data it is required by law to retain.
• Right to Restriction of Processing: You may request that we temporarily pause processing of your Personal Data in specific circumstances, for example while a dispute over data accuracy is resolved.
• Right to Data Portability: You may request that we provide your Personal Data in a structured, commonly used, machine-readable format so that you may transfer it to another service provider.
• Right to Object: You may object to processing carried out on the basis of legitimate interests at any time. You also have an absolute right to object to the use of your data for direct marketing purposes, and mz356 will honour such objections without condition.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails, analytics cookies), you may withdraw that consent at any time with effect going forward. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

mz356 will respond to verified rights requests within 30 calendar days of receipt. Where requests are complex or numerous, we may extend this period by a further 30 days with written notification to you.

11.1 The mz356 Platform is strictly not intended for use by persons under the age of 21. We do not knowingly collect Personal Data from individuals below this age threshold.

11.2 If mz356 discovers or is notified that Personal Data has been collected from an individual under 21 years of age, we will immediately suspend the associated Account, void any transactions, and securely delete all Personal Data relating to that individual, subject only to any mandatory legal retention obligations.

11.3 If you are a parent or guardian and believe that a person under your care has registered on the mz356 Platform, please contact our support team immediately at the contact details provided in Section 14.

12.1 The mz356 Platform may contain references to third-party services in the context of game studios, sports data providers, and payment partners. This Privacy Policy applies only to the mz356 Platform and does not govern the privacy practices of any third-party entity.

12.2 mz356 is not responsible for the content, security, or privacy practices of third-party websites, applications, or services. Any Personal Data you provide directly to a third party — for example, by visiting a game studio's own website — is governed by that party's own privacy policy.

13.1 mz356 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, business practices, or the range of services offered on the Platform.

13.2 Where amendments are material — meaning they meaningfully change how we collect, use, or share your Personal Data — mz356 will provide at least fourteen (14) days' prior notice by posting a prominent notice on the Platform and, where practicable, by sending an email to your registered address.

13.3 The version of this Privacy Policy in effect at the time your Personal Data was collected governs the processing of that data, unless we have obtained your consent to apply the updated Policy retroactively.

13.4 The "Last Updated" date displayed at the top of this page reflects the most recent revision. We recommend reviewing this Policy periodically to stay informed about how mz356 handles your data.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or wish to raise a privacy-related complaint about mz356's data handling practices, please contact our Data Privacy team using the details below: