mpo2 Privacy Policy

Last Updated: January 2026  |  Effective Date: January 1, 2026

1. Definitions

Throughout this Privacy Policy the following terms carry the meanings set out below:

• "mpo2," "we," "us," "our" — the operator of the platform accessible at https://mpo2.cam and its affiliated entities.
• "Platform" — the mpo2 website, any associated mobile applications, and all services delivered through them.
• "You," "your," "user" — any individual who visits, registers on, or otherwise interacts with the platform.
• "Personal Data" — any information that identifies or could reasonably identify a living natural person, including name, national identity number, email address, payment details, device identifiers, and behavioral data.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "KYC" (Know Your Customer) — identity-verification procedures required by anti-money laundering regulations and responsible gaming obligations.
• "IDR / Rp" — Indonesian Rupiah, the currency in which all financial transactions on the platform are conducted.

2. Data Controller

mpo2 acts as the data controller in respect of Personal Data collected through this platform. As data controller, mpo2 determines the purposes and means of processing your information and is responsible for ensuring that processing is carried out in a lawful, fair, and transparent manner.

For all privacy-related queries, complaints, or requests to exercise your rights, contact us at the details provided in Section 14 of this document.

3. Personal Data We Collect

3.1 Data You Provide Directly

When you register an account, verify your identity, make transactions, or contact support, mpo2 collects the following categories of information:

• Identity data: Full legal name, date of birth, Indonesian National Identity Card number (KTP/NIK), nationality, and a photograph of your identity document.
• Contact data: Email address, mobile phone number, and residential address including city, province, and postal code.
• Financial data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), deposit amounts, withdrawal amounts, and transaction history in IDR.
• Communications data: Records of live-chat conversations, email correspondence, and support-ticket content.

3.2 Data Collected Automatically

When you use the platform, our systems automatically collect technical and behavioral data, including:

• Device and connection data: IP address, device type, operating system version, browser type and version, mobile carrier, and screen resolution.
• Usage data: Pages visited, games played, bets placed, session duration, click paths, search queries entered on the platform, and features used.
• Location data: General geographic location inferred from IP address (country, city). We do not collect precise GPS coordinates unless you explicitly grant permission.
• Cookie and tracking data: Session cookies, persistent cookies, and pixel tags as described in Section 7.

3.3 Data Received from Third Parties

We may receive information about you from third parties including:

• Identity verification service providers who validate documents against national databases.
• Payment processors confirming the status of deposits and withdrawals via Indonesian banking channels.
• Fraud prevention agencies and sanctions-screening databases.
• Analytics and marketing partners (subject to your consent preferences) who provide aggregated audience insights.

4. Legal Basis for Processing

mpo2 processes your Personal Data on the following legal grounds:

• Contractual necessity: Processing required to create your account, execute bets, process deposits and withdrawals, and deliver our services.
• Legal obligation: Processing required to comply with anti-money laundering (AML) regulations, identity verification mandates, and responsible gaming requirements — including the enforcement of the minimum age of 21 years.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, improving our products, and conducting analytics, provided these interests are not overridden by your privacy rights.
• Consent: Processing for optional marketing communications or non-essential cookies, where you have given clear, informed, and freely withdrawable consent.

5. How We Use Your Data

We use the Personal Data we hold about you for the following purposes:

• Account management: Creating and maintaining your account, verifying eligibility, processing logins, and managing account settings.
• Service delivery: Processing bets, settling winnings, executing deposits and withdrawals in IDR via your chosen Indonesian bank or e-wallet.
• Identity verification (KYC): Confirming that you are who you claim to be and that you meet the 21+ age requirement under Indonesian and international gaming standards.
• Fraud and security: Detecting unauthorized access, preventing chargebacks, identifying collusion, and blocking prohibited account behaviors listed in our Terms and Conditions.
• Responsible gaming: Monitoring betting patterns to identify potential problem gambling, enforcing self-imposed limits, and delivering reality-check reminders.
• Customer support: Responding to your inquiries, resolving disputes, and maintaining records of support interactions for quality assurance.
• Legal compliance: Retaining transaction records as required by applicable regulations and responding to lawful requests from authorized authorities.
• Marketing (consent-based only): Sending promotional emails, bonus notifications, or personalized offers where you have opted in. You may withdraw consent at any time.
• Platform improvement: Analyzing aggregate usage patterns (anonymized where possible) to improve features, fix bugs, and optimize the user experience.

6. Data Sharing and Disclosure

6.1 Categories of Recipients

mpo2 does not sell your Personal Data to third parties. We may share your data with the following categories of recipients under strict data-protection agreements:

• Payment service providers: Indonesian banks (BCA, BRI, BNI, Mandiri, and others) and e-wallet operators (OVO, DANA, GoPay, ShopeePay, LinkAja) require account and transaction data to process your deposits and withdrawals.
• Identity verification partners: KYC vendors who verify the authenticity of your KTP against government databases and screen against sanctions lists.
• Game technology providers: Third-party suppliers of casino software, slot engines, live dealer streams, and sportsbook data feeds may receive limited technical data (e.g., session tokens) to deliver their games to your device.
• IT infrastructure providers: Cloud hosting, content delivery, and cybersecurity vendors who process data exclusively on our instructions under data-processing agreements.
• Legal and regulatory authorities: Government agencies, law enforcement, or regulators may receive data when legally required or when mpo2 is obligated to report suspicious financial activity.

6.2 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all assets of mpo2, your Personal Data may be transferred to the successor entity. You will be notified in advance and given an opportunity to delete your account if you do not wish your data to be transferred.

7. Cookies and Tracking Technologies

7.1 Types of Cookies We Use

• Strictly necessary cookies: Required for the platform to function (session management, login state, security tokens). These cannot be disabled.
• Functional cookies: Remember your preferences such as language setting, preferred deposit method, and responsible gaming limit selections.
• Analytics cookies: Collect anonymized data about how users navigate the platform to help us improve performance and content (e.g., which game categories attract the most engagement).
• Marketing cookies (consent-based): Track whether you arrived via a specific promotional campaign and help us measure return on marketing spend. Only activated with your explicit consent.

7.2 Managing Cookies

You can control cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the core platform, though some personalization features may be affected. Detailed cookie settings are accessible via the cookie-preferences interface on the platform.

8. Data Retention

mpo2 retains Personal Data for no longer than is necessary for the purposes described in this Policy, subject to the following guidelines:

• Active account data: Retained for the lifetime of your account plus a minimum of five (5) years after account closure, as required by AML record-keeping standards.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction to satisfy financial reporting and audit obligations.
• KYC documents: Retained for five (5) years following the end of the business relationship, after which copies are securely destroyed.
• Support communications: Retained for three (3) years to facilitate dispute resolution and quality assurance.
• Marketing data: Retained until you withdraw consent or request deletion, after which it is removed from active systems within 30 days.

9. Security Measures

mpo2 implements layered technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, or destruction:

• Encryption in transit: All data exchanged between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS/SSL).
• Encryption at rest: Sensitive fields including identity document numbers, bank account numbers, and passwords are stored using AES-256 encryption in our database systems.
• Access controls: Strict role-based access controls ensure that only authorized mpo2 personnel with a legitimate business need can view your Personal Data. All staff with data access undergo background screening and regular privacy training.
• Two-factor authentication: Administrative systems require multi-factor authentication to prevent unauthorized internal access.
• Penetration testing: We engage independent cybersecurity firms to conduct regular vulnerability assessments and penetration tests of our platform infrastructure.
• Incident response: A formal data breach response plan is maintained. In the event of a breach affecting your data, we will notify you and relevant authorities within the timeframes required by applicable law.

While we take every reasonable precaution, no system connected to the internet can guarantee absolute security. You are responsible for keeping your login credentials confidential and for logging out after each session, particularly on shared devices.

10. Your Rights

Subject to applicable law, you hold the following rights in relation to your Personal Data held by mpo2. To exercise any of these rights, contact us using the details in Section 14. We will respond within 30 days of receiving a valid request.

Right	What It Means
Right of Access	Request a copy of the Personal Data we hold about you and receive confirmation of how it is being processed.
Right to Rectification	Request correction of inaccurate or incomplete Personal Data. You may also update certain details directly through your account settings.
Right to Erasure	Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations (e.g., AML record-keeping requirements).
Right to Restrict Processing	Request that we limit how we use your data in certain circumstances, such as while a dispute about accuracy is being resolved.
Right to Data Portability	Receive a structured, machine-readable copy of Personal Data you provided to us and, where technically feasible, have it transmitted to another data controller.
Right to Object	Object to processing based on legitimate interests, including profiling for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent	Where processing is based on consent (e.g., marketing emails), withdraw that consent at any time without affecting the lawfulness of prior processing. Opt-out links are included in every marketing communication.

11. International Data Transfers

mpo2 operates servers in multiple international jurisdictions. When your Personal Data is transferred outside Indonesia to countries that may not have equivalent data-protection legislation, we implement appropriate safeguards to ensure your data remains protected to a standard comparable to Indonesian privacy norms, including:

• Contractual clauses obligating recipient entities to process data solely for specified purposes and to implement adequate security measures.
• Binding corporate rules between mpo2 group entities governing intra-group data transfers.
• Transfers only to jurisdictions assessed by our legal team as providing an adequate level of data protection.

By using our platform, you acknowledge that your data may be processed in jurisdictions outside Indonesia. If you have concerns about cross-border transfers, contact us using the details in Section 14.

12. Minors and Age Verification

mpo2 strictly prohibits use of the platform by persons under the age of 21 years. We do not knowingly collect Personal Data from individuals under this age. As part of our KYC process, all users are required to submit a valid Indonesian identity document confirming that they meet the minimum age requirement.

If we discover that Personal Data of a person under 21 has been collected — whether through misrepresentation or any other means — we will immediately suspend the relevant account, void any associated bets or winnings, and securely delete the data. If you believe a minor has registered on our platform, please notify us immediately at the contact details in Section 14.

13. Changes to This Privacy Policy

mpo2 may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document.
• Display a prominent notice on the platform for at least 14 days before the revised policy takes effect.
• Send an email notification to registered users where the changes materially affect how we use their data.

Your continued use of the platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. We recommend reviewing this page periodically.

14. Contact and Complaints

If you have questions about this Privacy Policy, wish to exercise any of your data-subject rights, or want to report a privacy concern, please reach out through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 through your account dashboard; Indonesian-speaking agents are on hand.
• Response Time: Privacy requests are handled within 30 calendar days. Complex requests may take up to 60 days; we will inform you if an extension is needed.

If you are dissatisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data-protection authority or regulatory body in your jurisdiction.