mio88 Privacy Policy
Your Data, Our Responsibility

Definitions

In this Privacy Policy, the following terms carry the meanings assigned below unless context requires otherwise:

• "Platform" — the mio88 website at https://mio88.cam and all associated services, features, and applications.
• "mio88", "we", "us", "our" — the internationally licensed entity operating the mio88 Platform.
• "User", "you", "your" — any individual who registers an account on, or accesses, the mio88 Platform.
• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, including name, email address, device identifiers, and financial account references.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion.
• "Data Controller" — mio88, acting as the entity that determines the purposes and means of processing Personal Data.
• "Third Party" — any entity other than mio88 and the user, including payment processors, KYC service providers, and analytics partners.
• "KYC" — Know Your Customer: the identity verification process required for account validation and withdrawal eligibility.
• "Consent" — a freely given, specific, and informed indication of the user's agreement to the processing of their Personal Data for a stated purpose.

Scope & Application

This Privacy Policy applies to all Personal Data collected by mio88 in connection with the operation of the Platform, whether collected directly from users, automatically through platform usage, or from third-party sources as described in Clause 4. It applies to all users who access the Platform from Indonesia or any other jurisdiction where access is not legally prohibited.

This Policy should be read in conjunction with the mio88 Terms & Conditions, which govern the overall contractual relationship between you and mio88. In the event of any conflict between these two documents concerning data matters, this Privacy Policy shall take precedence.

This Policy does not apply to third-party websites, applications, or services that may be linked from the Platform. mio88 is not responsible for the privacy practices of any third party and encourages users to review the privacy policies of any external service they access.

Data We Collect

mio88 collects the following categories of Personal Data, limited to what is necessary for the purposes described in Clause 5:

How We Collect Data

mio88 collects Personal Data through the following channels:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or responding to a survey.
• Automated collection: Technical and usage data collected automatically as you interact with the Platform, including through cookies, session tracking, and server logs (see Clause 12 for cookie details).
• Payment processors: Transaction confirmations and payment reference data received from our integrated payment partners including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC service providers: Identity verification outcomes and fraud-risk scores returned by licensed KYC and AML screening services following document submission.
• Referral mechanisms: If you arrive on the Platform via a referral link from an existing mio88 member, the referring member's account ID is recorded. No additional personal data about you is shared with the referring member.

Purpose of Processing

mio88 processes your Personal Data for the following defined purposes:

mio88 does not process Personal Data for any purpose not listed above without first obtaining explicit consent or updating this Privacy Policy with adequate notice to users.

Legal Basis for Processing

mio88 processes Personal Data on one or more of the following legal bases:

• Contractual necessity: Processing required to perform the agreement between you and mio88 — including account operation, payments, and platform access.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering regulations, licensing conditions, and age verification requirements under our gaming licence.
• Legitimate interests: Processing necessary for mio88's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, provided such interests are not overridden by your rights.
• Consent: Processing for marketing communications, non-essential cookies, and any purpose beyond those listed above, where your prior consent has been freely given and recorded. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing

mio88 does not sell, rent, or trade your Personal Data. We share Personal Data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, and LinkAja — to process deposit and withdrawal transactions in IDR.
• KYC and AML service providers: Licensed identity verification and fraud-screening providers that assist mio88 in fulfilling its regulatory obligations under our gaming licence.
• Game content providers: Pragmatic Play, Evolution Gaming, PG Soft, Microgaming, NetEnt, Spribe, and other licensed studios receive only the session and wagering data necessary to facilitate gameplay. They do not receive full identity or financial data.
• IT infrastructure providers: Cloud hosting, CDN, and cybersecurity providers operating under strict data processing agreements with mio88 that prohibit independent use of user data.
• Regulatory and law enforcement authorities: Where mio88 is legally required to disclose data pursuant to a court order, regulatory investigation, or mandatory reporting obligation under our gaming licence.
• Professional advisers: Legal counsel, auditors, and compliance consultants, bound by professional confidentiality obligations, where necessary for mio88's operational or legal requirements.

International Data Transfers

As an internationally operated platform, mio88 may transfer Personal Data to recipients located outside of Indonesia for the purposes of cloud hosting, game content delivery, KYC processing, and platform operations. All such transfers are subject to the following safeguards:

• Data processing agreements that impose data protection obligations equivalent to those applied by mio88 under this Policy.
• Where required, standard contractual clauses or other approved transfer mechanisms consistent with internationally recognised data protection frameworks.
• Technical access controls that restrict data access to authorised personnel with a documented business need.

mio88 does not transfer Personal Data to recipients in jurisdictions that do not provide an adequate level of data protection without implementing the contractual safeguards described above.

Data Retention

mio88 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence. Specific retention periods are as follows:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with mio88's internal data lifecycle management procedures.

Data Security

mio88 implements a layered security architecture to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Transport Layer Security (TLS 1.3): All data in transit between user devices and mio88 servers is encrypted using 256-bit SSL/TLS.
• Data-at-rest encryption: Databases containing Personal Data and KYC documents are encrypted using AES-256 at the storage layer.
• Access controls: Internal access to Personal Data is granted on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA) for all staff accounts.
• Network security: Web application firewalls (WAF), intrusion detection systems (IDS), and regular penetration testing to identify and remediate vulnerabilities.
• Incident response: A documented data breach response procedure that includes user notification in the event of a breach that is likely to result in a risk to affected individuals.

Your Data Rights

As a user of mio88, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to support@mio88.cam with the subject line "Data Rights Request". mio88 will respond within 14 business days of receipt.

Cookies & Tracking Technologies

mio88 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are in use:

• Strictly necessary cookies: Essential for platform operation — including session authentication, fraud prevention, and load balancing. These cannot be disabled without impairing basic platform functionality.
• Functional cookies: Store user preferences such as language settings, deposit defaults, and interface customisations to improve your experience on return visits.
• Analytics cookies: Collect aggregated, anonymised data on how users navigate the Platform — including which pages are visited most frequently and where errors occur — to inform product improvements. No personally identifiable information is included in analytics data exports.
• Marketing cookies: Used only with your prior consent to personalise promotional offers and track the effectiveness of campaigns. You may opt out at any time through your account settings.

Most web browsers allow you to control cookies through their settings. Disabling strictly necessary cookies may prevent parts of the Platform from functioning correctly. mio88 does not use third-party advertising networks for behavioural retargeting.

Minors

mio88 enforces a strict 21+ age policy. The Platform is not directed at, and does not knowingly collect Personal Data from, any individual under the age of 21. All accounts are subject to age verification during the KYC process.

If mio88 becomes aware that Personal Data has been collected from a user under the age of 21, the account will be immediately suspended, all associated data will be reviewed, and — where there is no overriding legal obligation to retain it — the data will be securely deleted. Any funds held in the account will be returned to their verified source after investigation.

If you have reason to believe that an individual under 21 is operating an account on mio88, please report this immediately to support@mio88.cam.

Policy Changes

mio88 reserves the right to update this Privacy Policy at any time. Material changes — defined as changes that significantly affect how we use your Personal Data or that reduce your rights — will be communicated to registered users via the email address on file at least 14 calendar days before the updated policy takes effect.

Non-material changes (such as editorial clarifications, formatting adjustments, or the addition of new sections that do not reduce existing protections) will be reflected in an updated version number and "Last Updated" date at the top of this page. Continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

The version history of this Privacy Policy is maintained by mio88's compliance team. Users may request a copy of a prior version by contacting support.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact mio88 through the following channel:

mio88's support team operates 24 hours a day, 7 days a week, including Indonesian public holidays such as Idul Fitri, Nyepi, and Hari Kemerdekaan (Indonesian Independence Day, 17 August). We are committed to responding to all data-related enquiries promptly and transparently.