Privacy Policy

This Privacy Policy applies to all personal data collected by mega28 through the website located at https://mega28.cam and any associated mobile applications, customer support channels, or marketing communications.

1.1 Territorial Application. This Policy is designed primarily for players in Indonesia but applies globally to all users of the mega28 platform. Where local data protection laws provide stronger protections than those described here, the stricter local law shall prevail.

1.2 Third-Party Sites. mega28 may contain links to third-party websites, including game studio sites or payment processor portals. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies independently before providing them with any personal information.

1.3 Integration with Terms & Conditions. This Privacy Policy should be read alongside the mega28 Terms & Conditions, which govern your overall relationship with mega28. In the event of any conflict between this Policy and the Terms & Conditions on data-related matters, this Privacy Policy shall take precedence.

mega28 acts as the data controller for all personal information collected through the platform. This means mega28 determines the purposes and means of processing your personal data and is responsible for compliance with applicable data protection laws.

For all data protection inquiries, requests to exercise your rights, or privacy-related complaints, you may contact our Data Protection Officer at [email protected]. We aim to respond to all privacy inquiries within 5 business days (WIB, UTC+7).

mega28 collects several categories of personal data to provide gaming services, comply with legal obligations, and improve platform security and performance. The types of data we collect include:

3.1 Sensitive Data. mega28 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric identifiers beyond what is strictly required for identity verification (e.g., a photograph on a government-issued ID card). Where such data is incidentally captured in identity documents, it is processed solely for verification purposes and is not used for profiling or other secondary purposes.

mega28 collects personal data through multiple channels, including:

• Direct Input: Information you provide when creating an account, submitting KYC documents, making a deposit, contacting customer support, or participating in promotions.
• Automatic Collection: Technical and behavioral data collected automatically through cookies, server logs, and analytics tools when you interact with the platform.
• Third-Party Sources: Data received from payment processors (to confirm transaction authenticity), fraud prevention services (to verify identity and flag suspicious activity), and game studios (to track gameplay for bonus wagering requirements).
• Public Sources: In rare cases, publicly available information may be consulted to verify identity or comply with legal obligations, such as checking government-issued sanctions lists or cross-referencing publicly available business registries.

4.1 Optional Data. Certain data fields during account registration or profile updates are marked as optional. You are not required to provide optional information, though doing so may improve your experience or enable access to specific features (e.g., promotional offers tailored to your city of residence).

mega28 processes your personal data for the following purposes, each grounded in a lawful basis under applicable data protection principles:

5.1 Account Management & Service Delivery (Contractual Necessity). We use your identity, contact, and financial data to create and maintain your account, process deposits and withdrawals, enable gameplay, and settle bets. This processing is necessary to perform the contract between you and mega28.

5.2 Legal & Regulatory Compliance (Legal Obligation). We use your identity and financial data to comply with Know Your Customer (KYC) requirements, anti-money laundering (AML) regulations, age verification mandates, and tax reporting obligations. This processing is required by law.

5.3 Security & Fraud Prevention (Legitimate Interest). We use technical and behavioral data to detect and prevent fraud, identify multiple accounts, investigate suspicious activity, and protect the integrity of the platform. This processing is necessary for our legitimate interests in maintaining a secure environment.

5.4 Responsible Gaming (Legitimate Interest & Regulatory Obligation). We use behavioral data to monitor for signs of problem gambling, enforce self-imposed limits (deposit caps, session duration), and offer intervention when patterns suggest a player may need support. This processing serves both our legitimate interest in player welfare and regulatory expectations around responsible gaming.

5.5 Customer Support (Contractual Necessity & Legitimate Interest). We use contact data and account history to respond to your inquiries, resolve technical issues, and provide assistance. This processing is necessary to deliver the service you expect and maintain customer satisfaction.

5.6 Marketing & Personalization (Consent). We use contact and marketing data to send you promotional offers, bonus notifications, and product updates where you have given explicit opt-in consent. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or contacting support.

5.7 Analytics & Product Improvement (Legitimate Interest). We use aggregated, de-identified data to analyze platform performance, understand player preferences, optimize game library selections, and improve user experience. This processing supports our legitimate interest in continuous improvement without compromising individual privacy.

mega28 does not sell, rent, or trade your personal data to third parties for marketing purposes. However, we may share your data with carefully selected third-party service providers and in specific legal circumstances:

6.1 Payment Processors. We share financial data with licensed payment processors (bank transfer gateways, e-wallet API providers) to execute deposits and withdrawals. These processors are contractually bound to use your data solely for transaction processing and to maintain equivalent security standards.

6.2 Game Studios & Platform Providers. We share limited gameplay data (user ID, bet amounts, game results) with third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft to enable real-money gameplay. Studios receive pseudonymized identifiers and do not have access to your full personal profile.

6.3 KYC & Fraud Prevention Vendors. We share identity data with specialized KYC verification services and fraud detection platforms to validate your documents and screen for high-risk indicators. These vendors process data as our sub-processors under strict confidentiality agreements.

6.4 Cloud Infrastructure Providers. Personal data is stored on secure cloud servers operated by ISO 27001-certified infrastructure providers. These providers act as data processors under our instruction and do not access or use player data for their own purposes.

6.5 Legal Authorities. We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by law, court order, or legal process. Examples include responding to subpoenas, complying with AML investigations, or cooperating with tax authorities.

6.6 Business Transfers. In the event of a merger, acquisition, or sale of all or part of mega28's assets, personal data may be transferred to the acquiring entity. You will be notified via email and prominent site notice at least 30 days before any such transfer, and the acquiring entity will be required to honor this Privacy Policy.

6.7 Aggregated & Anonymized Data. We may share aggregated, anonymized data with business partners or the public (e.g., "mega28 processed 50,000 transactions in January 2026"). This data cannot be re-identified to individual players and is not considered personal data under data protection laws.

mega28 uses cookies, web beacons, and similar tracking technologies to enhance platform functionality, analyze usage patterns, and deliver personalized content.

7.1 Essential Cookies. These cookies are strictly necessary for the platform to function. They enable account login, session management, payment processing, and security features. Essential cookies cannot be disabled without breaking core site functionality.

7.2 Performance & Analytics Cookies. These cookies collect aggregated data about how visitors use the platform — which pages are visited most, which games are most popular, where users encounter errors. This data helps us optimize performance and prioritize development resources. These cookies do not identify individual users.

7.3 Functional Cookies. These cookies remember your preferences (e.g., language selection, favorite games, odds format) to provide a more personalized experience. Disabling functional cookies may reduce convenience but will not prevent platform use.

7.4 Marketing Cookies. With your consent, we may use marketing cookies to track the effectiveness of promotional campaigns, deliver targeted offers, and limit the frequency of certain advertisements. You may opt out of marketing cookies through your browser settings or our cookie preference center.

7.5 Managing Cookies. Most modern browsers allow you to control cookie settings through preferences menus. You can configure your browser to block all cookies, accept only first-party cookies, or prompt you before accepting each cookie. Note that blocking essential cookies will prevent you from using mega28 services.

mega28 employs industry-leading technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All data transmitted between your device and mega28 servers is encrypted using 256-bit SSL/TLS protocols. This prevents interception or eavesdropping by third parties.
• Encryption at Rest: Sensitive data fields (passwords, financial details, identity documents) are encrypted at rest using AES-256 encryption. Decryption keys are stored separately from the encrypted data and are rotated regularly.
• Access Controls: Personal data is accessible only to authorized mega28 employees and contractors who require access to perform their job functions. Access is granted on a least-privilege basis and is logged for audit purposes.
• Password Policies: Player passwords are hashed using bcrypt with a high work factor. mega28 employees cannot view your password at any time. We enforce strong password requirements (minimum 8 characters, mix of letters, numbers, and symbols).
• Penetration Testing: mega28 undergoes regular independent security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Data Segregation: Production databases are segregated from development and testing environments. Test data uses anonymized or synthetic records, never real player information.
• Incident Response Plan: mega28 maintains a documented incident response plan. In the event of a data breach affecting personal information, we will notify affected users within 72 hours via email and provide guidance on protective measures.

8.1 Player Responsibilities. While mega28 implements robust security measures, you also play a critical role in protecting your account. Never share your password with others, log out after each session on shared devices, and report suspicious activity immediately to [email protected].

mega28 retains personal data only as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations:

• Active Accounts: For the duration of your account's active status plus 5 years after the last login, to meet regulatory record-keeping requirements.
• Closed Accounts: Identity and financial data for closed accounts are retained for 7 years from the date of closure to comply with AML and tax reporting obligations, then securely deleted.
• Marketing Data: If you unsubscribe from marketing communications, your email address is retained only to honor your opt-out preference and prevent re-subscription. No further marketing content will be sent.
• Transaction Records: Deposit, withdrawal, and bet settlement records are retained for 7 years to comply with financial auditing and dispute resolution requirements.
• Support Tickets: Customer support correspondence is retained for 3 years to track issue resolution patterns and maintain service quality.

9.1 Early Deletion. In some cases, you may request early deletion of your data by closing your account and contacting support. We will delete all data not subject to legal retention obligations within 30 days of your request.

Under applicable data protection laws, you have the following rights regarding your personal data. To exercise any of these rights, contact [email protected] with your account details:

• Right of Access: You may request a copy of all personal data mega28 holds about you. We will provide this in a structured, commonly used, machine-readable format (e.g., JSON or CSV) within 30 days.
• Right of Rectification: If any personal data we hold is inaccurate or incomplete, you have the right to request correction. For most profile fields, you can update data directly through your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent, or where processing is unlawful. Note that legal retention obligations may prevent immediate deletion in some cases.
• Right to Restrict Processing: You may request that we limit processing of your personal data while we investigate a dispute about accuracy or lawfulness of processing.
• Right to Data Portability: You may request a copy of your data in a portable format to transfer to another service provider (where technically feasible).
• Right to Object: You may object to processing of your personal data based on legitimate interests (e.g., for marketing or profiling purposes). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: If you believe mega28 has violated your data protection rights, you have the right to lodge a complaint with your local data protection authority.

mega28 will respond to all rights requests within 30 days. If we require additional time due to request complexity or volume, we will notify you and may extend the response period by an additional 30 days.

mega28 operates internationally, and your personal data may be transferred to, stored in, or processed in jurisdictions outside Indonesia where our servers, service providers, or business partners are located. These jurisdictions may have different data protection standards than Indonesian law.

Where we transfer data internationally, we implement appropriate safeguards to ensure your data receives equivalent protection, including:

• Utilizing service providers located in jurisdictions recognized as providing adequate data protection (e.g., European Economic Area countries under GDPR).
• Executing Standard Contractual Clauses (SCCs) approved by data protection authorities with all international processors.
• Requiring third-party processors to maintain ISO 27001 certification or equivalent information security standards.

By using mega28 services, you acknowledge and consent to international data transfers under these safeguards.

mega28 services are strictly for adults aged 21 and over. We do not knowingly collect personal data from individuals under 21 years of age. Our age verification procedures are designed to prevent minors from accessing the platform.

If we become aware that a user is under 21, we will immediately suspend the account, void all transactions, forfeit any balances, and delete all personal data associated with the account. Parents or guardians who believe a minor has provided personal data to mega28 should contact [email protected] immediately.

mega28 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or platform features. Material changes will be communicated via email to your registered address and a prominent notice on the platform at least 14 days before the new policy takes effect.

Your continued use of mega28 after the effective date of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not agree with the changes, you may close your account. The most current version of this Privacy Policy is always available at https://mega28.cam/privacy-policy, with the "Last Updated" date displayed at the top of the page.

If you have questions, concerns, or complaints about this Privacy Policy or mega28's data practices, or if you wish to exercise any of your data protection rights, please contact us:

mega28 is committed to transparency and accountability in all data handling practices. We welcome your feedback and take all privacy concerns seriously.