Privacy Policy

1 Introduction

mega31 ("we", "us", or "our") operates the online gaming platform accessible at https://mega31.cam. We are committed to handling your personal information with transparency, care, and respect. This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

This Policy applies to all Users of the mega31 Platform, including visitors who browse without registering, registered account holders, and any individual whose data we receive in connection with the provision of our gaming services to Indonesian players and international users who access our services.

By accessing the Platform or creating an Account, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection, use, and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.

2 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings given below:

• "Personal Data" means any information relating to an identified or identifiable natural person — a person who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or other factors.
• "Processing" means any operation or set of operations performed on Personal Data, whether by automated means or otherwise, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Data Controller" means mega31, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of mega31 under written instruction.
• "User" or "Data Subject" means any natural person whose Personal Data is processed under this Policy.
• "Cookies" means small text files placed on your device by the Platform to store session and preference information.
• "KYC" means Know Your Customer, the identity verification process performed to satisfy regulatory and compliance obligations.
• "IDR" means Indonesian Rupiah, the currency in which mega31 Wallet balances are denominated.

3 Data We Collect

mega31 collects Personal Data across several categories, depending on how you interact with our Platform. The table below summarises the principal categories of data we collect and representative examples of each:

We do not collect special categories of sensitive data (such as health data, biometric data used for identification, or data revealing racial or ethnic origin) except where strictly required for identity verification purposes, and only to the minimum extent necessary.

4 How We Collect Data

mega31 collects Personal Data through the following channels:

4.1 Direct Collection

You provide data directly to us when you register an Account, complete the KYC process, make a deposit or withdrawal request, contact our support team, respond to a survey or promotion, or voluntarily submit information through any form or interface on the Platform.

4.2 Automated Collection

When you access and browse the Platform, our servers automatically record Technical Data and Usage Data. This includes your IP address, the pages or game lobbies you visit, the duration of your sessions, and device-level information. This data is collected through server logs, cookies, pixel tags, and similar tracking technologies described in Section 8 of this Policy.

4.3 Third-Party Sources

We may receive limited Personal Data about you from third-party sources, including:

• Payment processors and financial institutions: Transaction confirmation data from Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity verification service providers: Results of automated document authentication checks performed during KYC review.
• Fraud and risk management partners: Anonymised risk-score data used to detect suspicious activity or potential account compromise.
• Game content providers: Aggregated gameplay and transaction data from studios including Pragmatic Play, Evolution Gaming, NetEnt, and Microgaming, which is used to reconcile game outcomes and Wallet balances.

5 Legal Basis for Processing

mega31 processes Personal Data on one or more of the following legal bases, depending on the specific purpose of processing:

• Contractual necessity: Processing required to perform our contract with you, including operating your Account, processing deposits and withdrawals, and providing gaming services.
• Legal obligation: Processing required to comply with our international gaming licence conditions, anti-money-laundering (AML) obligations, Know Your Customer (KYC) requirements, and any applicable legal or regulatory requirement.
• Legitimate interests: Processing carried out for our genuine business interests — such as fraud prevention, platform security, analytics to improve our services, and responsible gaming monitoring — provided that your interests and fundamental rights do not override those interests.
• Consent: Where we rely on your freely given, specific, informed, and unambiguous consent, such as for sending direct marketing communications or placing non-essential cookies on your device. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

6 How We Use Your Data

mega31 uses the Personal Data we collect for the following specific purposes:

• Account management: Creating, maintaining, and securing your Player Account; verifying your identity; processing login requests; and responding to password-reset or account-recovery requests.
• Service delivery: Processing deposits and withdrawals in IDR; crediting winnings to your Wallet; facilitating gameplay across all games on the Platform, including slot games, live casino, sports betting, and togel (Indonesia's traditional numbers lottery) markets.
• KYC and compliance: Verifying your identity and age (you must be 21 or older) in accordance with our licensing obligations; screening against sanctions lists and politically exposed persons (PEP) databases.
• Fraud prevention and security: Detecting and preventing fraudulent activity, money laundering, and other forms of financial crime; monitoring for unusual account behaviour; and protecting the integrity of the Platform and its users.
• Customer support: Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance purposes.
• Responsible gaming: Monitoring gameplay patterns to identify potential signs of problem gambling; administering deposit limits, time-out periods, and self-exclusion requests; and proactively reaching out where our systems flag a concern.
• Marketing and promotions: Sending you information about bonuses, seasonal promotions (such as offers tied to Idul Fitri, Indonesian Independence Day on 17 August, or Ramadhan), and platform updates — but only where you have opted in to receive such communications or where we have a legitimate interest to do so.
• Platform improvement: Analysing aggregated Usage Data and Technical Data to understand how players interact with the Platform, identify technical issues, and inform product development decisions.
• Legal compliance: Retaining transaction records and account data for the periods required by applicable laws and our licence conditions; responding to lawful requests from regulatory bodies or law enforcement agencies.

7 Data Sharing & Disclosure

mega31 does not sell, rent, or trade your Personal Data. We share your data only in the following circumstances and only to the minimum extent necessary:

7.1 Service Providers (Data Processors)

We engage trusted third-party vendors who process data strictly on our behalf and under our written instructions. These include payment processing partners (Indonesian banks and e-wallet providers), identity verification agencies, cloud hosting providers, cybersecurity firms, and customer support software vendors. All Data Processors are contractually bound to maintain appropriate security standards and to process data solely for the purposes we specify.

7.2 Game Content Providers

Certain game studios — including Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, and Pocket Games Soft — receive limited transactional data (such as bet amounts and game session identifiers) necessary to operate their games and resolve any game-outcome disputes. These studios operate under their own applicable gaming licences and data protection frameworks.

7.3 Legal and Regulatory Disclosure

We may disclose your Personal Data to law enforcement agencies, regulatory bodies, courts, or other public authorities where we are legally required to do so, where disclosure is necessary to establish, exercise, or defend legal claims, or where we have a good-faith belief that disclosure is necessary to prevent imminent harm or financial crime.

7.4 Business Transfers

In the event that mega31 undergoes a merger, acquisition, restructuring, or sale of all or a substantial part of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will notify you via the email address registered to your Account before your data is transferred and becomes subject to a different privacy policy.

7.5 Aggregated and Anonymised Data

We may share aggregated, anonymised, or pseudonymised data — from which you cannot reasonably be identified — with analytics partners, industry researchers, or within published platform statistics. This does not constitute a disclosure of Personal Data.

8 Cookies & Tracking Technologies

The mega31 Platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure user experience. The categories of cookies we use are as follows:

Strictly necessary cookies are placed without your consent as they are essential for the Platform to function. All other cookie categories are placed only with your consent, which you may grant or withdraw at any time through your Account settings or by adjusting your browser's cookie preferences. Please note that disabling functional cookies may degrade your user experience on the Platform.

In addition to cookies, we use server-side logging and session tokens as part of our security infrastructure. These are not accessible by third parties and are used solely for authentication and fraud-detection purposes.

9 Data Retention

mega31 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting obligations. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your Account plus a minimum of 5 years after Account closure, in accordance with AML and KYC regulatory requirements.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction, as required by applicable financial regulations.
• KYC documentation (ID scans, selfies): Retained for 5 years from the date of submission or the date of Account closure, whichever is later.
• Support communications: Retained for 3 years from the date of the last interaction, to support dispute resolution and quality assurance.
• Marketing preferences and opt-in records: Retained for as long as your Account remains active, plus 1 year after Account closure.
• Technical and Usage Data (logs): Retained for up to 24 months for security and analytics purposes, after which they are permanently deleted or anonymised.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised in accordance with our internal data destruction procedures. If you request early deletion of your data, we will fulfil that request to the extent that we are not required to retain the data by law or for the establishment, exercise, or defence of legal claims.

10 International Data Transfers

mega31 operates globally and your Personal Data may be transferred to, stored in, and processed in countries outside of Indonesia. In particular, our cloud infrastructure, game content providers, and certain support functions may be located in jurisdictions with differing data protection standards to those applicable in your country of residence.

Where Personal Data is transferred internationally, mega31 ensures that adequate safeguards are in place to protect your data. These safeguards include:

• Contractual clauses with Data Processors that impose data protection obligations equivalent to those we adhere to ourselves.
• Transfers only to jurisdictions that maintain internationally recognised data protection standards or that have formal adequacy arrangements in place.
• Technical controls — including end-to-end encryption in transit and at rest — that protect data regardless of where it is physically stored.

11 Your Rights

As a Data Subject, you have the following rights in relation to your Personal Data held by mega31. To exercise any of these rights, please contact us at the details provided in Section 16.

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. For minor updates (email address, phone number), you may also make changes directly within your Account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing is unlawful — subject to our legal retention obligations.
• Right to Restriction of Processing: You may request that we restrict the processing of your Personal Data in certain circumstances, for example where you contest the accuracy of the data or where processing is unlawful but you do not want erasure.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including the use of your data for direct marketing purposes. Where you object to marketing, we will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We will respond to all valid rights requests within 30 days of receipt. In complex cases, we may extend this period by a further 60 days, in which case we will notify you and explain the reason for the extension. We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

12 Minors & Age Restriction

The mega31 Platform is strictly intended for adults aged 21 years and over. We do not knowingly collect, solicit, or process Personal Data from individuals under the age of 21. Age verification is a mandatory step of our KYC process, and we reserve the right to request proof of age from any User at any time.

If we discover or have reasonable grounds to believe that an Account has been opened by or is being used by a person under 21, we will immediately suspend the Account, freeze the associated Wallet balance, and initiate an investigation. Where underage use is confirmed, the Account will be permanently closed, and any deposited funds will be returned to the source payment method after deducting any amounts required under applicable law or our licensing obligations.

If you have reason to believe that a minor has registered an Account on the mega31 Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

13 Security Measures

mega31 employs a comprehensive set of technical, organisational, and procedural security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our key security controls include:

• 256-bit SSL/TLS encryption: All data transmitted between your device and our servers is encrypted in transit using industry-standard Transport Layer Security protocols.
• Encryption at rest: Sensitive data fields — including financial records and identity documents — are encrypted at the storage level using AES-256 encryption.
• Two-factor authentication (2FA): Available and strongly recommended for all Accounts. 2FA adds an additional verification step beyond your password, significantly reducing the risk of unauthorised access.
• Access controls: Internal access to Personal Data is restricted on a strict need-to-know basis. Staff are granted the minimum level of system access required to perform their role.
• Regular security audits: Our Platform undergoes periodic penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• Incident response plan: We maintain a documented data breach response procedure. In the event of a breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

While we implement robust security measures, no method of electronic transmission or storage is completely secure. You also play an important role in protecting your data — keep your password confidential, do not share your Account credentials with anyone, and notify us immediately if you suspect any unauthorised access to your Account.

14 Third-Party Links & Services

The mega31 Platform may contain references to or integrations with third-party services, including game studios (such as Pragmatic Play, Evolution Gaming, and Spribe), payment gateways, and customer support tools. When you interact with these third-party services, their own privacy policies govern the collection and use of your data — mega31's Privacy Policy does not extend to those third-party environments.

We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of the mega31 Platform. We are not responsible for the content, privacy practices, or data security standards of third-party services.

15 Policy Amendments

mega31 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or licensing requirements. When material changes are made, we will notify registered Users by email to the address on file and by displaying a prominent notice on the Platform for a minimum of 14 days prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how we protect your Personal Data. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy.

16 Contact & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or the way mega31 handles your Personal Data, please contact our dedicated privacy team using the details below. We are committed to addressing all enquiries promptly and transparently.

• Email: [email protected] — include "Privacy Request" in the subject line for fastest routing
• Live Chat: Available 24/7 via the Platform, with native Indonesian-speaking agents on hand
• Response Time: We aim to acknowledge all privacy-related enquiries within 48 hours (WIB) and to provide a substantive response within 30 days

If you are not satisfied with our response to your privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. We will always cooperate fully with any such investigation.