At mas68, your privacy is a foundational commitment, not an afterthought. This Privacy Policy explains precisely what personal data we collect, why we collect it, how we store and protect it, and what rights you hold as a registered member. We encourage you to read this document in full before creating your Account.
Throughout this Privacy Policy, the following terms carry the meanings set out below:
mas68 is the data controller responsible for Personal Data collected through the Platform. As data controller, mas68 determines the purposes and means by which your Personal Data is processed, and is accountable for ensuring that Processing activities comply with applicable data protection principles.
All data protection enquiries, requests to exercise your rights, and complaints regarding mas68's data handling practices should be directed to our designated data protection contact at [email protected], using the subject line "DATA PROTECTION ENQUIRY" to ensure prompt routing to the appropriate team member.
mas68 operates as a Trusted and Secure Platform. While the Platform primarily serves Indonesian players across cities including Jakarta, Surabaya, Medan, Bandung, Bali, and Yogyakarta, data controller responsibilities apply universally to all registered members regardless of their location within Indonesia.
3.1 Registration Data. When you create a mas68 Account, we collect your full legal name, date of birth, Indonesian residential address, email address, and mobile phone number. This information is required to verify your identity, enforce our 21+ age restriction, and maintain a single-account environment.
3.2 Identity Verification (KYC) Data. To process your first withdrawal and to comply with our anti-money-laundering obligations, mas68 collects copies of your government-issued Indonesian identity document (KTP — Kartu Tanda Penduduk), a selfie photograph taken alongside that document, and proof of ownership of the payment method used (e.g., a screenshot of your OVO, DANA, GoPay, BCA, or BRI mobile banking interface showing the registered name and account number).
3.3 Financial Transaction Data. We collect records of every deposit and withdrawal processed through the Platform, including the payment method used (bank transfer via BCA, BRI, BNI, Mandiri, CIMB Niaga, or e-wallet via OVO, DANA, GoPay, ShopeePay, LinkAja), transaction reference numbers, IDR amounts, timestamps, and processing status. We do not store full bank account numbers or e-wallet PIN credentials.
3.4 Wagering Activity Data. We maintain a complete record of your betting and gaming activity on the Platform — including sportsbook wagers on BRI Liga 1, EPL, La Liga, Champions League, and other markets, live casino session data, slot game rounds, crash game sessions, and video poker hands — for the purposes of account management, bonus settlement, dispute resolution, and responsible gaming monitoring.
3.5 Technical and Device Data. When you access the Platform, our servers automatically log your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and pages visited. This data is used for security monitoring, fraud prevention, and Platform performance optimisation.
3.6 Communications Data. If you contact mas68 via email or live chat, we retain records of those communications — including the content of messages, timestamps, and support ticket reference numbers — for quality assurance, training, and dispute resolution purposes.
3.7 Preference and Behavioural Data. We may collect data about your Platform preferences, favourite game categories, language settings, notification preferences, and interaction patterns. This data informs our personalisation features and helps us surface relevant promotions, such as bonus offers tied to Piala AFF fixtures or Ramadhan seasonal campaigns.
mas68 collects your Personal Data through the following channels and mechanisms:
mas68 processes your Personal Data only for the specific, legitimate purposes described below. We do not process Personal Data in ways that are incompatible with these stated purposes without first obtaining your explicit Consent.
| Purpose | Data Categories Used | Retention Period |
|---|---|---|
| Account creation & management | Registration data, device data | Duration of Account + 5 years post-closure |
| Identity verification (KYC) | KYC documents, selfie, payment proof | 5 years from verification date |
| Payment processing | Financial transaction data | 7 years (regulatory requirement) |
| Fraud prevention & security | Technical data, wagering activity, device data | 5 years from last activity |
| Responsible gaming monitoring | Wagering activity, session data, deposit patterns | Duration of Account + 3 years |
| Bonus & promotion administration | Wagering activity, registration data, preference data | Duration of bonus period + 2 years |
| Customer support | Communications data, registration data | 3 years from ticket closure |
| Platform analytics & improvement | Behavioural data, technical data (anonymised) | 26 months (standard analytics cycle) |
| Legal & regulatory compliance | All categories as required by law | As mandated by applicable law |
mas68 relies on the following legal bases to process your Personal Data:
7.1 mas68 does not sell, rent, or trade your Personal Data to third-party marketing companies or data brokers under any circumstances.
7.2 We share Personal Data with carefully selected third parties only where necessary to deliver our services or to comply with legal obligations:
7.3 No Sale of Data. mas68 has not sold Personal Data in the preceding 12 months and has no plans to do so. Any future change to this practice will be communicated to all registered members with a minimum of 30 days' advance notice and will require explicit opt-in Consent.
8.1 Some of the third-party service providers engaged by mas68 — including game content studios and cloud infrastructure partners — may process Personal Data on servers located outside Indonesia. Where such international transfers occur, mas68 takes steps to ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Indonesia.
8.2 Safeguards employed for international transfers include: contractual data processing agreements incorporating standard data protection clauses; vendor security certifications (such as ISO 27001 or SOC 2 Type II); and technical measures including end-to-end encryption of data in transit and at rest.
You may request information about the specific safeguards applied to any international transfer of your Personal Data by contacting us at [email protected] with the subject line "INTERNATIONAL TRANSFER ENQUIRY".
9.1 mas68 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The specific retention periods applicable to each data category are summarised in the table in Section 5 above.
9.2 Financial transaction records are retained for a minimum of seven years from the date of each transaction in accordance with standard financial record-keeping requirements applicable to payment processing entities.
9.3 KYC documentation is retained for five years from the date of verification, or five years from the date of Account closure, whichever is later.
9.4 Upon expiry of the applicable retention period, Personal Data is securely deleted or permanently anonymised so that it can no longer be linked to any identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and analytical purposes without constituting Personal Data processing.
9.5 Account Closure. If you request closure of your mas68 Account, your active profile data will be deactivated immediately. Financial and KYC records will be retained for the mandatory periods described above before being deleted. You will not receive marketing communications following Account closure.
10.1 mas68 implements a layered security architecture designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our key technical and organisational measures include:
10.2 In the event of a Personal Data breach that poses a risk to your rights and freedoms, mas68 will notify affected members without undue delay, and in any case within 72 hours of becoming aware of the breach, using the email address registered to your Account. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address it.
11.1 mas68 uses cookies and similar tracking technologies (local storage, session storage, device fingerprinting) to operate the Platform, maintain your login session, remember your preferences, detect fraud, and analyse Platform usage. The cookies we set fall into the following categories:
| Category | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Session management, login state, security tokens, CSRF protection | No — required for Platform operation |
| Functional | Language preferences, game lobby layout, notification settings, last-used payment method | Yes — disabling may reduce personalisation |
| Analytical | Page view counts, feature usage stats, load time monitoring (anonymised data only) | Yes — via Account preference settings |
| Security & Fraud | Device fingerprint, IP reputation scoring, bot detection | No — required to protect Account integrity |
11.2 mas68 does not use third-party advertising cookies or behavioural tracking cookies that share your data with external advertising networks. We do not participate in cross-site tracking ecosystems.
11.3 You may manage functional and analytical cookie preferences through your Account settings. Disabling strictly necessary or security cookies is not possible without preventing core Platform functionality from operating correctly.
As a Data Subject, you hold the following rights in relation to your Personal Data held by mas68. To exercise any of these rights, contact us at [email protected] with the subject line "PRIVACY RIGHTS REQUEST" and we will respond within 30 days of receipt.
Response Timelines. mas68 will acknowledge all privacy rights requests within 5 business days and will provide a substantive response within 30 calendar days. For complex or high-volume requests, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it.
13.1 The mas68 Platform is strictly restricted to adults aged 21 years or older. We do not knowingly collect Personal Data from individuals under the age of 21. All registration attempts are subject to age verification, and identity documents confirming date of birth are required as part of the KYC process.
13.2 If mas68 becomes aware that Personal Data has been collected from an individual under the age of 21 — whether through a fraudulent registration or any other means — we will immediately suspend the relevant Account, delete all associated Personal Data, and refund any deposited funds to the originating payment method pending identity confirmation.
14.1 The mas68 Platform does not include links to external third-party websites. Game content is delivered via embedded APIs and iframes supplied by our studio partners; you do not leave the mas68 Platform domain during play.
14.2 Our payment processing interfaces — while operating under the brands of BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja — are integrated within the mas68 Platform. Where a payment action redirects you to a third-party provider's interface (e.g., a bank's one-time-password confirmation page), that provider's own privacy policy governs the data collected during that interaction. mas68 is not responsible for the privacy practices of external payment provider interfaces.
14.3 This Privacy Policy applies exclusively to Personal Data collected and processed by mas68 through the Platform. It does not extend to any third-party service, application, or website that is referenced in our content or integrated via our payment or game delivery infrastructure.
15.1 mas68 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or the services we offer. Material changes — defined as changes that affect your rights, expand the categories of data collected, or introduce new purposes of processing — will be communicated to registered members via the email address associated with their Account and via a prominent notice on the Platform, with a minimum of 14 days' advance notice before the changes take effect.
15.2 Minor administrative updates (e.g., corrections to contact details, typographical fixes, clarifying language that does not alter substantive content) may be made without prior notice, and the version number and last-updated date at the top of this document will be updated accordingly.
15.3 Your continued use of the Platform after any amended Privacy Policy takes effect constitutes your acceptance of the revised Policy. If you do not accept the amended Policy, you must stop using the Platform and may request Account closure as described in Section 9.5 above.
15.4 The current version of this Privacy Policy is always accessible at mas68.bio/privacy-policy. Prior versions are available on request by contacting [email protected].
16.1 For all privacy-related enquiries, requests to exercise your rights, complaints, or questions about this Privacy Policy, please contact the mas68 data protection team using the details below. Our Indonesian-speaking support agents are available 24 hours a day, 7 days a week, and will route data protection matters to the appropriate specialist.
16.2 When contacting us about a privacy matter, please include the following in your email to help us locate your records and respond efficiently:
16.3 mas68 is committed to resolving all privacy complaints fairly and promptly. If you are not satisfied with our response to a privacy complaint, you retain the right to escalate the matter to a competent data protection authority or seek resolution through the dispute mechanism described in our Terms & Conditions.
Every privacy commitment below is backed by technical controls, contractual safeguards, and a team dedicated to keeping your personal information secure.
Every byte of data transmitted between your device and the mas68 Platform travels under 256-bit SSL/TLS encryption — the same standard used by Indonesia's leading retail banks including BCA and Mandiri. Your credentials, payment details, and personal information are never exposed in transit.
mas68 has never sold your Personal Data to a third-party marketing company or data broker, and we never will. Your registration information, wagering history, and payment details are used exclusively to operate your Account and deliver the services you signed up for — nothing more.
Your login password is never stored in plain text on our servers. mas68 uses industry-standard cryptographic hashing (bcrypt/Argon2) to store password credentials, meaning that even our own engineering team cannot read your password. In the event of a breach, your credentials remain protected.
Full bank account numbers and e-wallet credentials for OVO, DANA, GoPay, ShopeePay, and LinkAja are never stored on mas68 servers. Our payment gateway partners provide encrypted tokens for transaction references only — your sensitive financial credentials remain exclusively within the payment provider's own secured environment.
Role-based access controls ensure that mas68 staff can only view the Personal Data categories strictly necessary for their specific job function. Customer support agents, for example, can view your Account status and transaction history but cannot access your KYC documents. Access logs are audited regularly by our security team.
If a security incident occurs that puts your Personal Data at risk, mas68 commits to notifying all affected members within 72 hours of becoming aware of the breach — via the email address registered to your Account — with full details of what happened, what data was affected, and what steps we are taking to protect you.
Now that you know exactly how mas68 handles your personal information, you can play with full confidence. Join thousands of Indonesian players from Jakarta to Bali who trust mas68 for football betting on BRI Liga 1, live casino action, premium slots, and more — all secured by the protections described in this Privacy Policy. You must be 21 or older to register.