Privacy Policy

1 Definitions

The following terms carry the meanings set out below throughout this Privacy Policy.

Term	Meaning
"Personal Data"	Any information relating to an identified or identifiable natural person — including name, date of birth, contact details, financial information, and device identifiers.
"Processing"	Any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion.
"Data Controller"	m11tt — the entity that determines the purposes and means by which your personal data is processed.
"Data Processor"	A third-party service provider that processes personal data on m11tt's behalf and under m11tt's documented instructions.
"KYC"	Know Your Customer — the identity verification process required to confirm a player's identity before withdrawals or elevated deposit tiers are permitted.
"AML"	Anti-Money Laundering — the regulatory framework governing the detection, prevention, and reporting of suspicious financial transactions.
"Cookies"	Small text files placed on your device by the m11tt platform to support session management, personalization, and analytics functions.

2 Data We Collect

2.1 Registration Data

When you create an m11tt account, we collect the information you provide during the registration form, including your full legal name, date of birth, Indonesian mobile phone number, email address, and the username and password you choose. This information is required to open and maintain your account.

2.2 Identity Verification (KYC) Data

To comply with our international license obligations and AML regulations, we collect documentary evidence of your identity and address. This includes:

• Government-issued photo ID (Indonesian National ID Card — KTP, or valid passport)
• Proof of residential address (utility bill, bank statement, or official government correspondence dated within 3 months)
• Proof of payment method ownership (screenshot of your BCA, BRI, BNI, Mandiri, or e-wallet account showing your name and account number)
• In certain high-risk or enhanced due diligence cases: source-of-funds documentation

2.3 Financial Transaction Data

We record details of every deposit and withdrawal you make, including transaction amounts in IDR, timestamps, payment method identifiers (bank account numbers, e-wallet account IDs), and transaction reference numbers. This data is retained for a minimum of 5 years to meet AML regulatory requirements.

2.4 Gaming Activity Data

We log your betting history, game sessions, wager amounts, win/loss outcomes, bonus utilization, and responsible gaming tool usage. This data is used for account management, dispute resolution, bonus administration, and the delivery of responsible gaming interventions where appropriate.

2.5 Technical & Device Data

When you access the m11tt platform, our servers automatically collect certain technical data, including your IP address, device type and operating system, browser type and version, referring URL, pages visited, session duration, and timestamps. This data is used for security monitoring, fraud detection, and platform performance optimization.

2.6 Communications Data

If you contact m11tt's customer support team via email or live chat, we retain records of those communications — including your messages and our responses — for quality assurance, dispute resolution, and staff training purposes.

3 How We Collect Data

m11tt collects personal data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal, contact support, or update your account settings.
• Automatically — through server logs, cookies, and similar tracking technologies when you browse or interact with the platform.
• From third-party payment processors — transaction confirmation data is relayed to m11tt by your bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) when a payment is initiated.
• From identity verification providers — where m11tt uses a third-party KYC service to validate document authenticity, that provider may return verification outcomes and risk signals to m11tt.
• From fraud detection and AML screening services — m11tt may cross-reference account data with sanctions lists, politically exposed person (PEP) databases, and adverse media sources as part of its compliance obligations.

4 How We Use Your Data

m11tt uses your personal data for the following purposes:

Purpose	Description
Account Management	Creating, maintaining, and securing your player account; verifying your identity at registration and during ongoing KYC reviews.
Transaction Processing	Processing deposits and withdrawals via local Indonesian payment methods; recording transaction history for your account statement.
Regulatory Compliance	Meeting AML, KYC, and licensing obligations; filing suspicious transaction reports where required; cooperating with law enforcement requests.
Fraud Prevention & Security	Detecting and preventing unauthorized account access, bonus abuse, multi-accounting, and financial fraud through automated and manual monitoring.
Responsible Gaming	Monitoring betting patterns for signs of problem gambling; delivering responsible gaming interventions, limit notifications, and self-exclusion enforcement.
Customer Support	Responding to your inquiries; resolving disputes; providing technical assistance with your account or games.
Platform Improvement	Analyzing aggregated, anonymized usage data to improve platform performance, user experience, and game selection.
Marketing Communications	Sending promotional offers and bonus notifications via email or SMS — only where you have provided explicit consent and have not subsequently opted out.

5 Legal Basis for Processing

m11tt processes your personal data on the following legal grounds:

• Contractual necessity — processing required to open your account, process transactions, and deliver the Services you have requested under these Terms.
• Legal obligation — processing required to comply with AML regulations, KYC mandates, sanctions screening, and reporting obligations under m11tt's international gaming license.
• Legitimate interests — processing undertaken for fraud prevention, security monitoring, platform performance optimization, and responsible gaming enforcement, where those interests are not overridden by your privacy rights.
• Consent — processing for marketing communications and non-essential cookies, where your explicit consent has been obtained. You may withdraw consent at any time by contacting support or updating your account preferences.

6 Data Sharing

6.1 Service Providers (Data Processors)

m11tt shares personal data with carefully selected third-party service providers that process data on our behalf under binding data processing agreements. These providers include payment processors, identity verification platforms, fraud detection services, cloud infrastructure providers, and customer support tooling vendors. All processors are contractually prohibited from using your data for any purpose other than delivering the specific service they provide to m11tt.

6.2 Regulatory & Law Enforcement Authorities

m11tt will disclose personal data to regulatory bodies, financial intelligence units, and law enforcement agencies where required to do so by applicable law, by our licensing authority, or by a valid legal order. Such disclosures are made without prior notice to the player where the law prohibits notification (e.g., in the context of a suspicious transaction report).

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of m11tt's assets, player data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any changes to data controller identity via email to your registered address, with a minimum of 30 days' notice before the transfer takes effect.

6.4 No Third-Party Marketing

m11tt does not sell, rent, or otherwise provide your personal data to third parties for their own marketing, advertising, or profiling purposes. Any data shared with advertising networks is limited to anonymized or aggregated identifiers that cannot be used to identify you as an individual.

7 Cookies & Tracking Technologies

7.1 Types of Cookies Used

m11tt uses the following categories of cookies on its platform:

• Strictly necessary cookies — required for core platform functionality, including session authentication, security token management, and load balancing. These cannot be disabled without breaking core features.
• Functional cookies — used to remember your preferences such as language, display settings, and last-used payment method, to provide a more personalized experience.
• Analytics cookies — used to collect anonymized data about how players navigate the platform, which pages are most visited, and where errors occur. This data is used exclusively for internal platform improvement.
• Fraud-detection cookies — used alongside device fingerprinting to detect multi-accounting, automated bot activity, and other prohibited behaviors.

7.2 Cookie Consent & Control

Strictly necessary and fraud-detection cookies are placed without consent as they are essential for secure platform operation. Functional and analytics cookies require your consent, which is requested when you first visit the platform. You may update your cookie preferences at any time by contacting support. Note that disabling functional cookies may affect the personalization features of your account experience.

7.3 Third-Party Cookies

Certain m11tt game content is delivered via iframes from licensed game studio providers (such as Pragmatic Play, Evolution Gaming, Microgaming, and Spribe). These studios may set their own cookies within their game environments, subject to their own privacy policies. m11tt does not control third-party studio cookies and is not responsible for their data practices.

8 International Data Transfers

m11tt's servers and data processing infrastructure are located outside Indonesia. By using the platform, you acknowledge that your personal data may be transferred to, stored in, and processed in jurisdictions other than Indonesia, including the jurisdiction in which m11tt holds its international gaming license.

Where personal data is transferred internationally, m11tt ensures that appropriate safeguards are in place, including contractual protections with data processors that reflect internationally recognized data protection standards. If you have questions about the specific safeguards applied to your data transfers, please contact our support team at the address provided in Section 15.

9 Data Retention

m11tt retains personal data for the periods set out below. After the applicable retention period expires, data is securely deleted or irreversibly anonymized.

Data Category	Retention Period
Account registration data	Duration of account plus 5 years after account closure
KYC identity documents	5 years after account closure (AML regulatory minimum)
Financial transaction records	5 years after the transaction date (AML regulatory minimum)
Gaming activity logs	3 years after the session date, or 5 years where linked to a disputed transaction
Customer support communications	2 years after the support ticket is closed
Marketing consent records	Until consent is withdrawn, plus 1 year as an audit trail
Server and access logs	90 days, extended to 12 months where a security investigation is active

10 Your Rights

As an m11tt player, you have the following rights in relation to your personal data. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 5 business days and respond in full within 30 days.

11 Security Measures

m11tt implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Transport security — all data in transit is encrypted using TLS 1.2 or higher with strong cipher suites. HTTP connections are automatically redirected to HTTPS.
• Storage encryption — sensitive personal data and KYC documents are encrypted at rest using AES-256 with hardware security module (HSM) key management.
• Access controls — access to production systems and player data is restricted to authorized personnel on a need-to-know basis. All access is logged and subject to regular audit.
• Two-factor authentication (2FA) — available for all player accounts and mandatory for all m11tt staff accessing administrative systems.
• Penetration testing — m11tt engages independent security firms to conduct periodic penetration tests and vulnerability assessments of the platform.
• Incident response — m11tt maintains a documented data breach response plan. In the event of a breach affecting your personal data, you will be notified within 72 hours of m11tt becoming aware of the incident.

While m11tt takes all reasonable precautions to protect your data, no system is entirely immune to risk. You also have a responsibility to maintain the security of your account credentials and to notify us immediately if you suspect unauthorized access to your account.

12 Minors

The m11tt platform is strictly for adults aged 21 years and over. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that a player under the minimum age has registered an account, we will immediately close the account, void any balance, and securely delete the personal data associated with that account.

If you believe that a minor has registered on m11tt, please notify us immediately at [email protected]. We take underage gambling extremely seriously and will act on all credible reports without delay.

13 Third-Party Links & Content

The m11tt platform may display game content, promotional material, or informational links that connect to third-party platforms — including game studio environments delivered via embedded iframes. These third-party environments operate under their own privacy policies, which m11tt does not control. m11tt is not responsible for the privacy practices of any third-party game studio, payment provider, or external platform. We encourage you to review the privacy policies of any third-party service you interact with through the m11tt platform.

14 Amendments to This Policy

m11tt reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable regulations, or platform functionality. When material changes are made — those that significantly affect how we use or share your personal data — we will notify you by email to your registered address at least 14 days before the updated policy takes effect.

Non-material changes (typographical corrections, clarifications that do not alter the substance of the policy, or updated contact details) may be published without advance notice. The date at the top of this page always reflects the most recent revision. Continued use of the m11tt platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

15 Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact m11tt's data protection team using the details below.

If you are not satisfied with m11tt's response to a privacy complaint, you may escalate the matter to the dispute resolution body designated by m11tt's licensing authority. Details of the relevant escalation body are available upon request from the support team. m11tt is committed to resolving all privacy concerns promptly and in good faith.