mpo35 Privacy Policy

Introduction & Scope

This Privacy Policy ("Policy") describes how mpo35 ("we", "us", "our") collects, uses, stores, and discloses personal data in connection with the operation of the mpo35 online casino and sportsbook platform accessible at mpo35.bio (the "Platform"). It applies to all visitors who browse the Platform without registering, to registered Members who hold an active mpo35 account, and to former Members whose accounts have been closed but whose data is retained in accordance with our legal obligations.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. If you do not agree to these practices, you should discontinue use of the Platform immediately and contact us to arrange the erasure of any data already collected.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming policy, both of which contain additional provisions that interact with data protection obligations.

Data Controller

For the purposes of this Privacy Policy, the data controller responsible for your personal data is mpo35, the operator of the Platform at mpo35.bio. As data controller, mpo35 determines the purposes for which your personal data is processed and the means by which that processing takes place.

Where mpo35 engages third-party service providers (such as payment processors, game studios, or identity verification providers) to process personal data on its behalf, those parties act as data processors under written agreements that bind them to mpo35's data-protection standards. mpo35 remains accountable for the security and appropriate use of your data by any such processor.

All data-related enquiries, including requests to exercise your rights under Section 11, should be directed to our dedicated Privacy team at the contact details provided in Section 15 of this Policy.

Personal Data We Collect

mpo35 collects only the categories of personal data that are necessary for the specific purposes described in Section 5. The table below summarises the main categories of data we hold:

We do not collect sensitive categories of personal data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) except where a government-issued photo ID submitted for KYC incidentally contains such information, in which case we process only the minimum fields required for age and identity verification.

How We Collect Your Data

4.1 Directly From You

The majority of personal data we hold is provided directly by you when you: register a mpo35 account; complete identity verification (KYC); make a deposit or withdrawal; contact our customer support team via live chat or email; update your account profile or responsible gaming settings; or respond to a promotional offer.

4.2 Automatically

When you access the Platform, our servers and analytics tools automatically record Technical Data (see Section 3) about your device and session. This data is collected via server logs, session cookies, and lightweight analytics scripts that run entirely on mpo35 infrastructure — we do not use Google Analytics, Facebook Pixel, or other third-party tracking pixels that would transmit your browsing data to external advertisers.

4.3 From Third Parties

In limited circumstances, we may receive personal data about you from third parties, including:

• Identity verification providers — who confirm the authenticity of documents you submit for KYC
• Payment processors — such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja — who confirm the successful completion of financial transactions
• Fraud and risk screening services — who provide signals about known fraudulent actors or compromised credentials, used solely to protect the integrity of the Platform and your account

Where data is received from third parties, mpo35 verifies that each provider has a lawful basis for sharing that data with us and that appropriate data-processing agreements are in place.

Purposes & Legal Basis for Processing

We process your personal data only where we have a clear, documented purpose and a valid legal basis for doing so. The primary purposes and their corresponding legal bases are set out below:

Data Sharing & Disclosure

mpo35 does not sell, rent, or commercially share your personal data with any third party. We disclose personal data only in the following limited circumstances, and only to the minimum extent necessary for the stated purpose:

6.1 Service Providers (Data Processors)

We share data with carefully vetted third-party service providers who process it strictly on our behalf and under our documented instructions. These include:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja — to execute deposit and withdrawal transactions
• Identity verification providers: to authenticate KYC documents and confirm age eligibility (21+)
• Game studios: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — who receive only the minimum session data required to deliver game content and maintain game integrity
• Hosting and infrastructure providers: who provide the servers, content delivery networks, and database infrastructure on which the Platform runs
• Cybersecurity and fraud prevention providers: who receive Technical and Usage data to identify and block malicious activity

6.2 Legal and Regulatory Disclosures

We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are legally required to do so, including in response to a valid court order, subpoena, or regulatory investigation. We will notify you of such a disclosure unless prohibited by law from doing so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of mpo35's assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer and the applicable privacy terms at least 30 days before the transfer takes effect, and you will have the right to request deletion of your data before the transfer occurs.

International Data Transfers

mpo35 operates globally and some of our service providers are located outside Indonesia. Where personal data is transferred to a country that does not provide a level of data protection equivalent to Indonesian standards, mpo35 ensures that appropriate safeguards are in place before the transfer takes place. These safeguards include:

• Standard contractual clauses that bind the recipient to mpo35-equivalent data protection obligations
• Adequacy assessments confirming that the destination country or recipient organisation provides an adequate level of protection
• Data processing agreements with enhanced security, audit, and breach-notification obligations tailored to cross-border transfers

You may request details of the specific safeguards applicable to any cross-border transfer that affects your data by contacting our Privacy team using the details in Section 15.

Data Retention

mpo35 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to the following minimum retention periods required by our legal and regulatory obligations:

Once a retention period expires, data is securely deleted or anonymised so that it can no longer be linked to you as an individual. Anonymised, aggregated data (e.g., platform-wide betting statistics with no individual identifiers) may be retained indefinitely for business intelligence purposes.

Cookies & Tracking Technologies

9.1 What We Use

mpo35 uses the following categories of cookies and similar technologies when you access the Platform:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancer routing cookies. These cannot be disabled without breaking core Platform functionality.
• Performance Cookies: First-party analytics cookies that record aggregate, anonymised data about page load times, error rates, and navigation paths. These help us identify and fix technical issues. No data is shared with third-party analytics providers.
• Functional Cookies: Remember your preferences such as language settings and responsible gaming tool configurations so you do not need to re-enter them on each visit.
• Fraud Prevention Cookies: Technical fingerprinting tokens used to detect and block automated bots, credential-stuffing attacks, and multi-account abuse.

9.2 What We Do Not Use

mpo35 does not deploy advertising cookies, retargeting pixels, social media tracking scripts (Facebook Pixel, TikTok Pixel, Twitter/X Pixel), or any cross-site tracking technology that would share your browsing behaviour with third-party advertisers.

9.3 Managing Cookies

You can control cookie behaviour through your browser settings. Blocking strictly necessary cookies will impair your ability to log in and use the Platform. Blocking performance or functional cookies will not affect your ability to place bets or process transactions but may reduce the quality of your experience.

Data Security

mpo35 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers
• AES-256 encryption at rest for all sensitive personal and financial data stored in our databases
• Multi-factor authentication enforced for all administrative access to production systems
• Penetration testing conducted by independent security firms at least twice per year
• Intrusion detection systems (IDS) that monitor network traffic and alert our security team to anomalous activity in real time
• Role-based access controls (RBAC) ensuring that only employees with a legitimate need can access specific categories of personal data
• Regular security awareness training for all staff with access to personal data

Your Rights

As a Member or visitor of mpo35, you have the following rights in relation to your personal data. To exercise any of these rights, please contact our Privacy team using the details in Section 15. We will respond to all verifiable requests within 30 calendar days.

• Right of Access: You may request a copy of all personal data mpo35 holds about you, together with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held about you. Some corrections (such as changes to your registered bank account name) may require supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data after your account is closed, subject to our legal retention obligations set out in Section 8. Data subject to a mandatory retention period cannot be deleted until that period expires.
• Right to Restriction of Processing: In certain circumstances, you may request that we restrict the processing of your data — for example, while you contest the accuracy of data we hold, or while a complaint is under investigation.
• Right to Data Portability: You may request a machine-readable copy of personal data you have provided to us, for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing based on legitimate interests. Where the objection relates to direct marketing communications, we will honour the request immediately with no exceptions.
• Right to Withdraw Consent: Where processing relies on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To protect your privacy, we will verify your identity before acting on any data rights request. Verification is typically completed via your registered email address and, for higher-risk requests (such as data portability or erasure), may require a KYC document resubmission.

Children & Minors

The mpo35 Platform is strictly for adults aged 21 and over. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that an account has been registered by, or that personal data has been submitted by, an individual under 21, we will:

• Immediately suspend the account
• Refund any deposits to the original payment method after deducting any winnings generated
• Void all bonus funds and promotional rewards
• Permanently delete all personal data associated with the account within 30 days, subject to any mandatory legal retention obligations

If you are a parent or guardian and you believe your child has accessed or registered on the mpo35 Platform, please contact us immediately at the details provided in Section 15. We take all such reports seriously and will investigate and respond within 24 hours.

Responsible Gaming & Data

The responsible gaming tools available on mpo35 — including deposit limits, session time reminders, cooling-off periods, and self-exclusion — necessarily involve the collection and use of personal data about your gambling activity. Specifically:

• Deposit limit records are stored to enforce the limits you set and to maintain an audit trail of any changes you request.
• Self-exclusion records are retained indefinitely to prevent you from registering a new account — even with different credentials — while your self-exclusion remains in effect. This is a protective measure, not a punitive one.
• Activity data (session duration, bet frequency, loss patterns) may be processed by our responsible gaming algorithms to identify signs of potentially harmful gambling behaviour and trigger proactive support outreach. This processing is carried out in your interest and is based on our legitimate interest in promoting safe gambling.

You can review and update your responsible gaming settings at any time from your account dashboard. For comprehensive guidance on responsible gaming, please visit our dedicated Responsible Gaming page.

Policy Amendments

mpo35 reviews this Privacy Policy at least once every 12 months and whenever there is a material change to our data processing activities. Where a change is material — such as the introduction of a new category of data collection, a new sharing arrangement, or a change to retention periods — we will provide at least 14 days' advance notice via email to your registered address and/or via a prominent notification on the Platform.

The effective date displayed at the top of this Policy indicates when the current version entered into force. The version number is incremented for all substantive changes. Non-substantive changes (such as typographical corrections or clarifications that do not alter the meaning of any provision) may be made without advance notice.

Your continued use of the Platform after the effective date of a revised Policy constitutes your acknowledgement of the changes. If you do not agree to the revised Policy, you must cease using the Platform and contact us to arrange account closure and data erasure per Section 11.

Contact & Complaints

For all privacy-related enquiries, data rights requests, or complaints relating to mpo35's handling of your personal data, please contact our Privacy team through any of the following channels:

• Live Chat: Available 24/7 directly from the mpo35 Platform — select "Privacy & Data" as the enquiry category
• Email: [email protected] (plain text — not a clickable link) — include "Privacy Request" in the subject line
• Response Time: All privacy requests acknowledged within 24 hours; substantive response within 30 calendar days
• Languages: Requests may be submitted in English; native Indonesian-speaking privacy staff are available on all shifts

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the data protection supervisory authority in your jurisdiction, or to the independent dispute resolution body designated by mpo35's licensing authority.