Privacy Policy

1. Definitions

In this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly, including but not limited to name, identification number, location data, online identifiers, or factors specific to that person's identity.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Member" means any individual who has registered an account on the mpo25 Platform.
• "Visitor" means any individual who accesses the Platform without completing registration.
• "Third-Party Provider" means any external entity engaged by mpo25 to provide services in connection with the Platform, including payment processors, game studios, KYC verification providers, and analytics services.
• "Sensitive Data" means Personal Data that warrants heightened protection by virtue of its nature, including identity document numbers, financial account details, and biometric data where collected.
• "Retention Period" means the duration for which mpo25 retains Personal Data following the relevant triggering event (e.g., account closure, last transaction date).

2. Data Controller

2.1 mpo25, operating the Platform at https://mpo25.cam, acts as the data controller in respect of all Personal Data collected from Members and Visitors. As data controller, mpo25 determines the purposes and means of processing and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

2.2 Where mpo25 engages Third-Party Providers to process Personal Data on its behalf, those providers act as data processors under written agreements that bind them to process data only on mpo25's instructions and to maintain appropriate security standards.

2.3 For all privacy-related enquiries, requests, or complaints, you may contact us at: support at mpo25.cam (plain text — not a clickable link). Please mark the subject line "Privacy Enquiry" to ensure prompt routing to our data protection team.

3. Data We Collect

3.1 Identity and Registration Data

When you register an account on mpo25, we collect your full legal name, date of birth, Indonesian national identity card (KTP) number or passport number, and — where required for enhanced KYC verification — a photograph or scan of the relevant identity document alongside a selfie photograph for liveness verification.

3.2 Contact Data

We collect your email address, Indonesian mobile telephone number, and residential address in Indonesia. This information is used to communicate account-related notifications, respond to support requests, and deliver marketing communications where you have provided consent.

3.3 Financial Data

To facilitate deposits and withdrawals, we collect the details of your nominated payment methods. For bank transfers, this includes the account holder name, bank name (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata), branch, and account number. For e-wallet payments (OVO, DANA, GoPay, ShopeePay, LinkAja), we collect the registered mobile number or account identifier associated with the wallet. We do not store full card numbers; card payment data is handled exclusively by our PCI-DSS compliant payment processor.

3.4 Transaction and Gaming Data

We maintain records of all financial transactions (deposits, withdrawals, bonus credits, and adjustments) as well as your betting and gaming history on the Platform. This includes stakes placed, games or markets selected, outcomes, wagering patterns, and bonus utilisation. This data is essential for account management, responsible gaming monitoring, and regulatory compliance.

3.5 Technical and Device Data

When you access the Platform, we automatically collect certain technical data, including your IP address, device type and model, operating system version, browser type and version, unique device identifiers, and network connection type. We also record session metadata such as login and logout timestamps, pages visited, and interaction events within the Platform interface.

3.6 Communications Data

If you contact our support team via live chat, email, or any other channel, we retain records of those communications, including the content of messages exchanged. This data is used for quality assurance, staff training, and dispute resolution purposes.

4. How We Collect Data

4.1 Directly from you: The majority of Personal Data we hold is provided directly by you during account registration, KYC submission, transaction processing, and when you communicate with our support team.

4.2 Automatically: Technical and usage data is collected automatically through server logs, session tracking technology, and cookies placed on your device when you access the Platform. See Section 10 (Cookies & Tracking) for full detail.

4.3 From Third Parties: We may receive additional data about you from KYC verification providers (e.g., for document authentication or sanctions screening), payment processors (e.g., transaction status confirmations), and fraud detection services. Where this occurs, we ensure that the third party is entitled to share the data with us and that such sharing is lawful.

5. How We Use Your Data

5.1 mpo25 processes your Personal Data only for the purposes set out below and only where a valid lawful basis exists for doing so:

• Account creation and management: To register your account, authenticate your identity at login, manage your account settings, and communicate important account-related updates. Lawful basis: contractual necessity.
• Payment processing: To process deposits and withdrawals via your nominated local bank (BCA, BRI, BNI, Mandiri, or others) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), and to maintain accurate transaction records. Lawful basis: contractual necessity.
• KYC and AML compliance: To verify your identity, screen against sanctions lists, monitor for suspicious transaction patterns, and meet our obligations under applicable anti-money laundering frameworks. Lawful basis: legal obligation.
• Responsible gaming: To monitor your gaming activity for signs of problem gambling behaviour, to enforce deposit limits and self-exclusion requests, and to provide you with the tools described on our Responsible Gaming page. Lawful basis: legal obligation; legitimate interest.
• Platform security and fraud prevention: To detect, investigate, and prevent fraud, account takeover attempts, bonus abuse, and other prohibited conduct. Lawful basis: legitimate interest.
• Customer support: To respond to your queries, resolve disputes, and deliver after-sales service. Lawful basis: contractual necessity; legitimate interest.
• Service improvement and analytics: To analyse aggregated usage patterns, identify technical issues, and improve Platform performance, game selection, and user experience. Lawful basis: legitimate interest.
• Marketing and promotions: To send you promotional communications about bonuses, seasonal offers (e.g., Idul Fitri, Ramadhan, Indonesian Independence Day promotions), and new features, where you have provided consent or where we have a legitimate interest in marketing to existing Members. Lawful basis: consent; legitimate interest.

5.2 We will not use your Personal Data for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your consent.

6. Data Sharing & Disclosure

6.1 mpo25 does not sell your Personal Data. We share your data only in the following circumstances and with the following categories of recipient:

• Payment processors and banking partners: To execute deposit and withdrawal instructions via BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja, and other supported channels. These processors receive only the minimum data necessary to complete the transaction.
• KYC and identity verification providers: To verify identity documents, screen against global sanctions and politically exposed persons (PEP) databases, and perform liveness checks where applicable.
• Game studio and content providers: Third-party game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive technical session identifiers to deliver game content. These studios do not receive your name, financial data, or contact details.
• IT infrastructure and cloud service providers: For hosting, data storage, and platform operations, under strict data processing agreements.
• Fraud prevention and cybersecurity providers: For real-time threat detection, bot identification, and account security monitoring.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory directive, mpo25 may disclose Personal Data to law enforcement agencies, financial intelligence units, or other competent authorities.
• Professional advisors: Lawyers, auditors, and compliance consultants engaged by mpo25 on a confidential basis.

6.2 All Third-Party Providers who receive Personal Data are required to maintain appropriate technical and organisational security measures and are prohibited from using your data for any purpose other than the specific service they are engaged to provide.

7. International Data Transfers

7.1 As an internationally operated platform, mpo25 may transfer your Personal Data to servers and service providers located outside Indonesia. Where such transfers occur, we implement appropriate safeguards to ensure that your data receives a level of protection equivalent to that required by internationally recognised data protection standards.

7.2 Safeguards used for international transfers may include: standard contractual clauses incorporated into agreements with receiving entities; binding corporate rules where applicable; or transfers to jurisdictions that provide an adequate level of data protection as recognised by competent authorities.

7.3 By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in countries outside Indonesia. mpo25 takes all reasonable steps to ensure such transfers are conducted lawfully and securely.

8. Data Retention

8.1 mpo25 retains your Personal Data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or regulatory requirements.

8.2 The following indicative Retention Periods apply:

• Account and identity data: Retained for the duration of your active membership plus a minimum of five (5) years following permanent account closure, in compliance with AML record-keeping requirements.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the relevant transaction.
• KYC documents: Retained for a minimum of five (5) years following the completion of the relevant verification process or account closure, whichever is later.
• Support and communications data: Retained for three (3) years from the date of the communication, or longer where the communication relates to an ongoing dispute.
• Technical and usage data: Retained for up to twenty-four (24) months on a rolling basis, after which data is anonymised or deleted.
• Marketing preference data: Retained until you withdraw consent or close your account, plus a further twelve (12) months for audit trail purposes.

8.3 Where Personal Data is no longer required for the purposes for which it was collected and no legal retention obligation applies, mpo25 will securely delete or anonymise that data.

9. Security Measures

9.1 mpo25 implements a comprehensive information security programme designed to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption for all data in transit between the Member's device and our servers.
• Encryption at rest for all Sensitive Data stored in our databases.
• Role-based access controls ensuring that staff can access Personal Data only to the extent required for their specific job function.
• Multi-factor authentication for all internal administrative systems that handle Member data.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Comprehensive audit logging of all access to production data environments.
• A formal incident response plan governing the detection, containment, and notification process in the event of a data breach.

9.2 In the event of a data security incident that is likely to result in a risk to your rights and freedoms, mpo25 will notify affected Members without undue delay and will take all reasonable steps to mitigate the impact of the incident.

10. Cookies & Tracking Technologies

10.1 mpo25 uses cookies and similar tracking technologies (including pixel tags and local storage objects) to operate and improve the Platform. Cookies are small text files stored on your device that allow us to recognise your browser across sessions and collect usage information.

10.2 We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies and security tokens. You cannot opt out of these without impairing Platform functionality.
• Performance and Analytics Cookies: Used to measure how Members interact with the Platform — including pages visited, time on page, and error events — to help us improve performance and user experience.
• Functional Cookies: Used to remember your preferences, such as your preferred language display or notification settings, to provide a more personalised experience.
• Marketing Cookies: Used to deliver relevant promotional content and to measure the effectiveness of our marketing campaigns. These are set only with your consent.

10.3 You can manage your cookie preferences through your browser settings. Blocking or deleting certain cookies may affect the functionality of the Platform. For Marketing Cookies, you may also withdraw consent at any time by contacting our support team.

11. Your Data Rights

11.1 As a Member of mpo25, you hold the following rights in respect of your Personal Data, exercisable by submitting a written request to our support team:

• Right of Access: You may request a copy of the Personal Data mpo25 holds about you, together with information about how it is processed.
• Right to Rectification: You may request the correction of inaccurate or incomplete Personal Data. For account profile details, you may also update certain information directly through your account settings.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other lawful basis applies, or where processing is unlawful. This right is subject to legal retention obligations — for example, we are required to retain AML-related records for a minimum of five years.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interest, including direct marketing. Where you object to direct marketing, we will cease processing for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

11.2 We will respond to all valid rights requests within thirty (30) days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further sixty (60) days, in which case we will notify you of the extension and the reasons for it.

11.3 We will not charge a fee for processing rights requests unless the request is manifestly unfounded or excessive. In such cases, we reserve the right to charge a reasonable administrative fee or to decline to act on the request.

12. Minors

12.1 The mpo25 Platform is strictly restricted to individuals who are at least 21 years of age. We do not knowingly collect Personal Data from any person under the age of 21. If you are under 21, you must not access, use, or attempt to register on the Platform.

12.2 If mpo25 becomes aware that Personal Data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. Any parent or guardian who believes their child has registered on the Platform should contact us immediately at support at mpo25.cam.

13. Third-Party Services & External Links

13.1 The mpo25 Platform integrates third-party services including game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), payment gateways, and analytics tools. While we carefully vet all Third-Party Providers and require them to maintain appropriate data protection standards, mpo25 is not responsible for the privacy practices of third-party services operating under their own independent privacy policies.

13.2 mpo25 does not include external links to third-party websites within the Platform interface. Where any such link is presented (e.g., in a game description), Members should review the privacy policy of the relevant third party before providing any personal information to that party.

13.3 mpo25 is not responsible for the data practices of third-party payment providers (including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, or LinkAja) when those providers process transactions on their own platforms. Please review the relevant provider's privacy policy for information about how they handle your data.

14. Policy Amendments

14.1 mpo25 reserves the right to amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. Where changes are material, we will provide at least seven (7) days' advance notice by publishing the updated Policy on the Platform and notifying Members via the email address registered to their account.

14.2 The "Last updated" date displayed at the top of this page reflects the date of the most recent revision. We recommend reviewing this Policy periodically. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

14.3 If you do not accept the revised Policy, you must cease using the Platform and contact our support team to close your account and withdraw any remaining balance.

15. Contact & Complaints

15.1 For all privacy-related enquiries, data rights requests, or complaints, please contact our data protection team using the following channel:

• Email: support at mpo25.cam (plain text — not a clickable link). Use subject line "Privacy Enquiry" or "Data Rights Request".
• Live Chat: Available 24/7 via the Platform interface, staffed by native Indonesian-speaking agents who can assist in both English and Bahasa Indonesia.
• Response Time: We aim to acknowledge all privacy-related enquiries within 24 hours and to resolve them within thirty (30) days, with an extension of up to sixty (60) days for complex matters.

15.2 If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.