Privacy Policy

Introduction

mpo20 ("we", "us", "our") operates the online betting and casino platform accessible at https://mpo20.cam (the "Platform"). This Privacy Policy describes how mpo20 collects, processes, stores, shares, and protects personal data relating to individuals who access or use the Platform, including registered players, applicants for registration, and visitors browsing the Platform without an account.

mpo20 serves English-preference players based primarily in Indonesia. In designing our data practices, we have applied internationally recognized privacy principles and standards, with particular attention to the trust expectations of Indonesian players who choose an internationally operated platform for their online betting and gaming activity.

This Privacy Policy should be read alongside our Terms & Conditions, which govern the overall relationship between mpo20 and its players. In the event of a conflict between the two documents on a data-related matter, this Privacy Policy shall prevail.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, national ID number, contact details, IP address, and financial account information.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, erasure, or destruction.
• "Data Controller" refers to mpo20 as the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" refers to any third party that processes Personal Data on behalf of mpo20 under a contractual data processing agreement.
• "Player" means any individual who has registered or is in the process of registering a real-money account on the mpo20 Platform.
• "KYC Data" means identity verification documents and associated data collected as part of mpo20's Know Your Customer compliance program.
• "Cookies" means small text files placed on a user's device by the Platform for the purposes of session management, analytics, and personalization.

Data We Collect

mpo20 collects Personal Data in the following categories, depending on the nature of the interaction between you and the Platform:

3.1 — Registration Data

When you create an account, we collect your full legal name, date of birth, email address, mobile telephone number (Indonesian format), and the username and hashed password you select. This data is required to establish and maintain your account.

3.2 — Identity Verification (KYC) Data

To comply with our international anti-money laundering (AML) obligations and to protect the integrity of the Platform, we collect copies of government-issued photo identification (such as Indonesian KTP or passport), selfie photographs for liveness checks, and proof of address documentation. KYC data may also include bank statements or e-wallet transaction histories submitted to verify ownership of payment methods.

3.3 — Financial Data

We collect bank account details, e-wallet identifiers (such as OVO, DANA, GoPay, ShopeePay, or LinkAja account numbers), deposit and withdrawal records, and transaction reference numbers. All financial data is processed and stored in Indonesian Rupiah (IDR / Rp). We do not store full card numbers or full bank account credentials on our servers; this data is tokenized and managed by our payment service providers.

3.4 — Behavioral and Activity Data

We record your wagering history, game session data, login timestamps, device identifiers, IP addresses, browser type, operating system, and approximate geolocation. This data is used for fraud prevention, responsible gaming monitoring, and improving the Platform experience.

3.5 — Communications Data

When you contact our customer support team via live chat or email, we retain records of those communications, including the content of your messages and our responses. This data is used for quality assurance, dispute resolution, and training purposes.

3.6 — Voluntary Data

Any additional information you voluntarily provide — for example, when completing optional profile fields, responding to a satisfaction survey, or participating in a promotion — is collected and stored as part of your account record.

How We Use Your Data

mpo20 uses Personal Data for the following specific and documented purposes:

mpo20 does not use your Personal Data for automated decision-making that produces significant legal effects without human oversight. Where automated screening tools are used — for example, in fraud detection or AML transaction monitoring — flagged cases are reviewed by a qualified compliance team member before any account action is taken.

Legal Basis for Processing

mpo20 processes Personal Data on the following legal grounds:

• Contractual Necessity: Processing your registration data, KYC data, and financial data is necessary to fulfill the contractual relationship established when you accept our Terms & Conditions and create an account.
• Legal Obligation: We are required under applicable international AML standards and our licensing obligations to collect, retain, and in certain circumstances disclose KYC and financial data to authorized authorities.
• Legitimate Interests: We process behavioral and activity data on the basis of our legitimate interests in operating a secure, fraud-free platform and in monitoring for responsible gaming risk signals. These interests are balanced against your privacy rights and do not override them.
• Consent: Where we send you promotional or marketing communications, we do so only on the basis of your explicit opt-in consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Data Sharing & Disclosure

6.1 — Service Providers

mpo20 engages carefully selected third-party service providers who process Personal Data on our behalf as Data Processors. These include payment gateway operators (who facilitate bank transfers via BCA, BRI, BNI, Mandiri, CIMB Niaga, and supported e-wallets), KYC and identity verification providers, fraud detection technology vendors, cloud infrastructure and hosting providers, and customer support platform operators. All Data Processors are contractually bound to process your data only on our documented instructions, to implement appropriate security measures, and to refrain from using your data for their own purposes.

6.2 — Game Content Providers

When you play games on the mpo20 Platform — including slots from Pragmatic Play, Microgaming, NetEnt, or Pocket Games Soft, or live casino tables from Evolution Gaming — certain technical session data (such as a session token and game result records) may be shared with the relevant game studio to deliver the game experience and resolve disputes. No personally identifiable information beyond what is technically required is shared with game providers.

6.3 — Regulatory and Law Enforcement Disclosure

mpo20 may disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts of law where we are legally compelled to do so. We will notify you of such disclosures where permitted by law. We will not disclose more data than is strictly required to satisfy any such legal obligation.

6.4 — Business Transfers

In the event that mpo20 undergoes a merger, acquisition, or sale of all or a substantial portion of its assets, your Personal Data may be transferred to the successor entity as part of that transaction. You will be notified via the email address registered to your account prior to any such transfer, and the successor entity will be bound by this Privacy Policy or an equivalent standard of protection.

6.5 — No Sale of Data

mpo20 does not sell, rent, license, or otherwise commercially exploit your Personal Data to any third party for their own marketing, profiling, or commercial purposes. This commitment is unconditional and applies regardless of jurisdiction.

Cookies & Tracking Technologies

7.1 — What We Use

The mpo20 Platform uses the following categories of cookies and similar tracking technologies:

• Strictly Necessary Cookies: These are essential for the Platform to function. They manage your login session, maintain your account security state, and remember your language and currency preferences. These cookies cannot be disabled without impairing Platform functionality.
• Analytics Cookies: We use anonymized analytics tools to understand aggregate patterns of how players navigate the Platform — for example, which pages are visited most frequently and where players encounter difficulty. No personally identifiable data is transmitted to analytics providers.
• Functional Cookies: These remember your preferences and settings between sessions, such as your preferred deposit method or notification settings, to provide a more seamless experience.
• Security Cookies: Short-lived cookies used to validate user requests and protect against cross-site request forgery (CSRF) and session hijacking attacks.

7.2 — Managing Cookies

You may control non-essential cookie categories through your browser settings. Most modern browsers allow you to block or delete cookies on a per-site basis. Please note that disabling strictly necessary cookies will prevent you from logging into your mpo20 account. Disabling analytics or functional cookies will not affect your ability to place bets or use core Platform features, but may reduce the personalization of your experience.

7.3 — No Cross-Site Tracking

mpo20 does not use third-party advertising cookies or tracking pixels that follow you across other websites after you leave the Platform. We do not participate in cross-site behavioral advertising networks.

Data Retention

mpo20 retains Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention schedule applies as a general guide:

• Active Account Data: Retained for the full duration of the account's active lifetime, plus a minimum period after closure as required by our AML obligations (typically five years from the date of last transaction).
• KYC Documentation: Retained for a minimum of five (5) years from account closure, in compliance with internationally recognized AML standards applicable to our licensing jurisdiction.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Customer Support Communications: Retained for a maximum of three (3) years from the date of the last communication in a support thread, unless the thread is linked to an open dispute.
• Analytics Data: Retained in anonymized, aggregated form indefinitely for statistical and product improvement purposes. No personally identifiable data is retained in analytics systems beyond twelve (12) months.
• Marketing Consent Records: Retained for the duration of consent plus three (3) years, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. If you request deletion of your account prior to the expiry of a mandatory retention period, we will suppress active use of your data and delete it as soon as the retention obligation permits.

Security Measures

mpo20 implements a layered set of technical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS Encryption: All data in transit between your device and the mpo20 Platform is encrypted using industry-standard TLS protocols.
• At-Rest Encryption: Sensitive data fields — including KYC documents, bank account identifiers, and hashed passwords — are encrypted at rest in our database infrastructure.
• Access Controls: Access to production systems containing Personal Data is restricted to a limited number of authorized personnel on a strict need-to-know basis, enforced through role-based access control (RBAC) and multi-factor authentication (MFA).
• Penetration Testing: The Platform undergoes periodic third-party security assessments and penetration tests to identify and remediate vulnerabilities.
• Incident Response: In the event of a data security incident that may affect your Personal Data, mpo20 maintains a documented incident response procedure. Affected players will be notified without undue delay via their registered email address.
• Employee Training: All mpo20 personnel with access to Personal Data receive regular data protection training and are bound by strict confidentiality obligations.

Your Data Rights

As a player on the mpo20 Platform, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team at the details provided in Clause 14. We will respond to verified requests within thirty (30) days.

Minors & Age Policy

The mpo20 Platform is strictly intended for adults aged 21 and above. We do not knowingly collect or process Personal Data from any individual under the age of 21. During the registration process, you are required to confirm that you meet this minimum age requirement. Where mpo20 has reasonable grounds to suspect that an account is held by a person under 21, the account will be suspended, KYC age verification will be requested, and — if the suspicion is confirmed — the account will be permanently closed and any deposited funds returned to the payment source.

If you are a parent or guardian and believe that a minor under your care has registered an account on the mpo20 Platform, please contact our support team immediately using the contact details in Clause 14. We take underage gambling extremely seriously and will investigate and act on all credible reports promptly.

Third-Party Services

The mpo20 Platform may display or reference third-party services — such as the game studios whose titles are available on the Platform (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Pocket Games Soft) and the payment networks that facilitate local bank transfers and e-wallet transactions (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja). Each of these third parties operates under its own privacy policy and data protection framework.

mpo20 is not responsible for the privacy practices of any third party beyond the data processing agreements we have in place with them as described in Clause 6. We encourage you to review the privacy policies of any third-party service you interact with directly — for example, when completing a bank transfer or e-wallet top-up — to understand how your data is handled outside of the mpo20 Platform environment.

Policy Amendments

mpo20 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or Platform features. When material changes are made, we will notify registered players via the email address on file at least seven (7) days before the revised Policy takes effect, except where immediate changes are required for legal or security reasons.

The "Last updated" date displayed at the top of this page will be revised each time the Policy is amended. We encourage you to review this page periodically to stay informed about how your data is protected. Your continued use of the Platform following notification of a revised Privacy Policy constitutes acceptance of the updated terms.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to report a privacy concern, please reach out to the mpo20 data protection team through the following channels:

• Email (plain text — not a clickable link): support @ mpo20.cam
• Live Chat: Available 24/7 via the chat widget on the Platform. Our Indonesian-speaking support agents are on hand around the clock (WIB, UTC+7).
• Response Time: Data rights requests submitted by email are acknowledged within 48 hours and fully responded to within thirty (30) calendar days of receipt of a verified request.

For responsible gaming-related data concerns — such as requesting a record of your wagering history for self-assessment, or initiating a self-exclusion that requires data suppression — please visit our dedicated Responsible Gaming page for additional guidance.