mu138 Privacy Policy

This Privacy Policy applies to all personal data collected and processed by mu138 in connection with the operation of its online casino and sportsbook platform, accessible at https://mu138.club. It covers data collected through the website, through our customer support channels, and through interactions with third-party service providers integrated into the platform (such as payment processors and game studios).

mu138 acts as the data controller in respect of the personal data of its registered players and website visitors. As data controller, mu138 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection obligations.

This policy is intended for players based in Indonesia. mu138 acknowledges and respects the personal data protection principles increasingly being adopted across the Indonesian regulatory landscape, and we align our practices accordingly. You must be a resident of Indonesia and at least 21 years of age to hold a registered mu138 account.

mu138 collects personal data from you directly (when you register, make a deposit, or contact support) and indirectly (through automated technologies such as cookies and server logs). The categories of personal data we collect are described in the table below:

mu138 does not intentionally collect sensitive special-category data such as racial or ethnic origin, political opinions, religious beliefs, or health information. If any such data is incidentally disclosed during a support interaction, it will not be retained or used beyond the purpose of resolving that specific interaction.

mu138 processes your personal data only where a valid legal basis exists. The applicable legal basis depends on the specific processing activity, as summarised below:

• Performance of a Contract: Processing your identity data, contact data, financial data, and gaming activity data is necessary for us to provide the mu138 platform services as described in our Terms & Conditions. Without this processing, we cannot operate your account, process deposits or withdrawals, or settle bets.
• Legal Obligation: We are required to collect and retain certain data — particularly KYC identity documents and financial transaction records — to comply with applicable anti-money-laundering (AML) obligations, fraud prevention requirements, and age verification duties. This processing is mandatory and cannot be opted out of while you hold a mu138 account.
• Legitimate Interests: We process technical data (IP addresses, device data, session logs) and gaming activity data for fraud detection, responsible gaming monitoring, platform security, and service improvement. These activities serve the legitimate interests of mu138 and its player community, and do not override your fundamental privacy rights.
• Consent: Where we send you promotional communications (bonus offers, event announcements, seasonal promotions tied to events such as Idul Fitri, Ramadhan, and Indonesian Independence Day), we do so only where you have provided explicit opt-in consent during registration or subsequently via account settings. Consent can be withdrawn at any time without penalty.

The personal data collected by mu138 is used for the following specific purposes:

• Account Management: Creating and maintaining your mu138 account, authenticating your identity at login, and enabling you to access all platform features including live casino, slots, Dragon Tiger, Video Poker, and sportsbook markets.
• Payment Processing: Verifying and processing your deposits and withdrawal requests via your nominated Indonesian bank account or e-wallet. Withdrawal payments are made exclusively to accounts registered in your own name, consistent with our anti-money-laundering obligations.
• Identity and Age Verification (KYC): Confirming that you are who you say you are, that you are at least 21 years of age, and that you are located in Indonesia. KYC is a prerequisite for processing your first withdrawal.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, including multiple account registration, bonus abuse, chargebacks, money laundering, and unauthorised account access. We use automated risk-scoring systems and manual review processes for this purpose.
• Responsible Gaming: Monitoring gaming activity patterns to identify potential problem gambling behaviour, enforcing deposit limits and self-exclusion requests, and providing support to players who activate responsible gaming tools.
• Customer Support: Responding to your queries, complaints, and account requests via live chat and email. Support transcripts are retained as described in Section 7.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve the performance, design, and feature set of the mu138 platform.
• Marketing Communications: Sending you personalised promotional offers, bonus notifications, and event-based communications where you have provided consent. These may include offers linked to BRI Liga 1 football seasons, Piala AFF fixtures, and major seasonal events in Indonesia.
• Legal and Regulatory Compliance: Fulfilling our obligations under applicable law, responding to lawful requests from regulatory and law enforcement authorities, and defending legal claims.

mu138 does not sell your personal data. We share personal data only in the following limited and controlled circumstances:

• Payment Processors: We share the financial and identity data necessary to complete your deposit or withdrawal transaction with your nominated Indonesian bank (e.g., BCA, BRI, BNI, Mandiri) or e-wallet provider (e.g., OVO, DANA, GoPay, ShopeePay, LinkAja). These processors receive only the data required to execute the specific transaction.
• KYC Verification Partners: Where mu138 uses a third-party identity verification service to assist with document checking and age verification, the relevant KYC documents and identity data will be shared with that partner under a binding data-processing agreement that restricts use to verification purposes only.
• Game Studio Providers: When you play a game supplied by a third-party studio (such as Pragmatic Play, Evolution Gaming, PG Soft, Habanero, Microgaming, or Spribe), the game provider may receive limited technical session data (such as a pseudonymous session token) necessary to operate the game. Game studios do not receive your full identity or financial data.
• Fraud and Security Partners: We may share technical data (IP addresses, device fingerprints) with anti-fraud and cybersecurity service providers for the purpose of protecting the platform and its players from fraud and abuse.
• Regulatory and Law Enforcement Authorities: mu138 will disclose personal data to government bodies, regulatory authorities, or law enforcement agencies where required to do so by applicable law, court order, or other legally compelled process. We will notify affected players of such disclosures where permitted by law.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of mu138's business operations, personal data held by mu138 may be transferred to the acquiring entity as part of that transaction. Affected players will be notified prior to any such transfer, and the acquiring entity will be required to honour this Privacy Policy or provide players with the opportunity to close their accounts.

All third parties with whom mu138 shares personal data are contractually required to implement appropriate technical and organisational security measures, to use the data only for the specified purpose, and to delete or return it upon termination of the service relationship.

mu138 uses cookies and similar tracking technologies to enable essential platform functionality, improve the user experience, and gather analytical data about how the platform is used. The categories of cookies deployed are as follows:

• Strictly Necessary Cookies: Required for the platform to function correctly. These include session authentication cookies that keep you logged in during an active session, security tokens that protect against cross-site request forgery, and cookies that remember your responsible gaming limit preferences. These cookies cannot be disabled without impairing core platform functionality.
• Functional Cookies: Remember your preferences such as your most recently played game category, your preferred display language, and your time-zone setting (defaulting to WIB, Western Indonesia Time, UTC+7). These cookies improve your experience on return visits but are not essential to platform operation.
• Analytical Cookies: Collect aggregated, anonymised data about how players navigate the platform — which pages are visited, how long sessions last, and which game categories are most popular. This data helps mu138 identify performance issues and prioritise product improvements. No individual player is identifiable from analytical cookie data.
• Fraud Prevention and Security Cookies: Assist in identifying suspicious or anomalous behaviour — such as the use of automated bots, VPN connections, or multiple simultaneous session attempts — that may indicate fraudulent activity. These cookies are a critical component of our player protection infrastructure.

mu138 does not deploy third-party advertising cookies or behavioural targeting cookies that track your activity across other websites for commercial advertising purposes.

mu138 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The key retention periods are as follows:

• Active Account Data: Identity, contact, financial, and gaming activity data is retained throughout the period your account remains active on the mu138 platform.
• KYC Documents: Identity and address verification documents are retained for a minimum of five (5) years following account closure, in compliance with anti-money-laundering record-keeping requirements.
• Financial Transaction Records: Deposit and withdrawal transaction logs are retained for a minimum of five (5) years following the date of the transaction.
• Customer Support Communications: Live chat transcripts and email correspondence are retained for two (2) years from the date of the interaction, unless the communication forms part of an ongoing dispute or legal matter, in which case it is retained until that matter is fully resolved.
• Marketing Consent Records: Records of your marketing opt-in or opt-out decisions are retained for the duration of your account and for three (3) years following account closure, to demonstrate compliance with consent obligations.
• Closed Account Data: Following account closure, we retain the minimum personal data necessary to fulfil our legal obligations and to defend potential legal claims. Data that is no longer required for these purposes is securely deleted or anonymised.

When personal data is no longer required and the applicable retention period has expired, mu138 securely destroys or permanently anonymises that data using industry-standard data sanitisation procedures.

mu138 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser or mobile device and the mu138 platform is encrypted using TLS 1.2 or higher with 256-bit AES encryption, providing industry-standard protection for data in transit.
• Encryption at Rest: Sensitive personal data stored in mu138 databases — including KYC documents, payment details, and account credentials — is encrypted at rest using strong encryption algorithms.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff members can only access the categories of data required to perform their specific job functions. Access privileges are reviewed regularly and revoked immediately upon role change or departure.
• Multi-Factor Authentication (MFA): Administrative access to mu138 internal systems that contain personal data is protected by mandatory multi-factor authentication, reducing the risk of unauthorised access through credential compromise.
• Penetration Testing and Vulnerability Scanning: mu138 conducts regular security assessments, including penetration testing and vulnerability scanning, to identify and remediate potential weaknesses in the platform infrastructure before they can be exploited.
• Incident Response Plan: mu138 maintains a documented data breach response plan. In the event of a security incident affecting personal data, we will contain the breach, assess the impact, notify affected players without undue delay where required, and take corrective action to prevent recurrence.

As a mu138 player, you hold the following rights in respect of the personal data we hold about you. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and include your registered username and a clear description of your request. We will respond within 30 days.

• Right of Access: You may request a copy of the personal data mu138 holds about you, together with information about the purposes for which it is processed, the categories of data held, and the third parties with whom it has been shared.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Some data (such as your registered name and date of birth) may require re-submission of KYC documentation before we can update it.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent for marketing processing. This right is subject to our legal retention obligations; we cannot delete data that we are required by law to retain.
• Right to Restriction of Processing: In certain circumstances (such as where you contest the accuracy of your data or have objected to processing), you may request that we restrict our use of your data to storage only, pending resolution of the relevant issue.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you may request that we provide your personal data in a structured, commonly used, machine-readable format, so that you can transfer it to another service provider if you wish.
• Right to Object: You may object to processing based on our legitimate interests at any time. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to Withdraw Consent: Where processing is based on your consent (principally, marketing communications), you may withdraw that consent at any time via your account settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

The mu138 platform is strictly for adults aged 21 and over. mu138 does not knowingly collect, process, or retain personal data from any individual under the age of 21. Age verification is a mandatory step in the account registration process, and KYC documentation confirming date of birth is required before any withdrawal is permitted.

If mu138 discovers or is notified that an account has been registered by or on behalf of a person under 21 years of age, the following actions will be taken immediately:

• The account will be permanently closed;
• All funds in the account will be held pending investigation and may be forfeited;
• All personal data associated with the underage account will be deleted from our systems as soon as is legally permissible, retaining only the minimum data necessary to document the incident for compliance purposes;
• The matter may be referred to the appropriate authorities.

Parents and guardians are encouraged to make use of internet filtering and parental control software to prevent minors from accessing online gambling platforms. If you believe a minor has accessed mu138 using your account, contact us immediately at [email protected].

The mu138 platform may contain references to third-party services — such as payment gateway interfaces, game studio launch environments, or links in support documentation to external resources. mu138 is not responsible for the privacy practices or content of any third-party service, and this Privacy Policy does not extend to those services.

When you interact with a third-party service integrated into the mu138 platform — for example, when your browser communicates with your bank's online payment portal to complete a deposit — you are also subject to that third party's privacy policy. We encourage you to review the privacy policies of all payment providers, e-wallet services, and other third-party platforms you use in connection with your mu138 account.

mu138 does not have visibility into or control over the data practices of third-party providers once your data leaves our platform systems. However, all service providers integrated into the mu138 platform are contractually required to maintain appropriate data security standards as a condition of their engagement.

mu138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, we will:

• Update the "Last Updated" date at the top of this page;
• Send a notification to your registered email address summarising the key changes, at least seven (7) days before the revised policy takes effect;
• Display a prominent notice on the mu138 platform homepage for a period of not less than 14 days following the update.

Your continued use of the mu138 platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you must stop using the platform and may request account closure and withdrawal of your remaining balance (subject to KYC completion and these Terms).

For non-material changes — such as minor clarifications of existing language, correction of typographical errors, or updates to contact details — mu138 may update the policy without providing advance notice, though the "Last Updated" date will always be revised to reflect any change.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data mu138 holds about you, please contact our Data Protection team through the following channels:

• Email: [email protected] — Please include "Privacy Policy Query" or "Data Rights Request" in the subject line, along with your registered username, to ensure your message is routed to the correct team promptly.
• Live Chat: Available 24 hours a day, 7 days a week, directly from any page on the mu138 platform. Our support team — staffed by Indonesian-speaking agents — can handle general privacy queries in real time and will escalate formal data rights requests to the relevant team on your behalf.

mu138 does not operate a postal address for data subject requests. All privacy-related communications should be directed via email or live chat as described above. We do not operate a telephone support line.