mpo50 Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") applies to all personal data collected, processed, stored, and transmitted by mpo50 ("mpo50", "we", "us", "our") in connection with the operation of the mpo50 platform accessible at https://mpo50.bet and any associated mobile applications, APIs, or digital services ("Platform"). It governs the privacy practices applicable to all registered members, prospective members who visit the Platform without completing registration, and any other individuals whose personal data is processed by mpo50 in connection with the delivery of our services.

By accessing the mpo50 Platform, completing the registration process, or submitting any personal data to mpo50 through any channel, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue your use of the Platform immediately.

This Policy should be read alongside the mpo50 Terms & Conditions and the Responsible Gaming policy, both of which form part of the overall legal framework governing your relationship with mpo50.

2 Data Controller

mpo50 is the data controller responsible for personal data processed through the Platform. As data controller, mpo50 determines the purposes for which, and the means by which, personal data is processed. Where mpo50 engages third-party service providers to process data on its behalf — such as payment processors, KYC verification providers, and game content studios — those parties act as data processors and are bound by contractual obligations consistent with applicable data protection standards.

All privacy-related enquiries, data subject access requests, and formal complaints should be directed to the mpo50 Data Privacy Team at: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request — [Your Account Username]" to ensure prompt routing to the relevant team.

3 Data We Collect

mpo50 collects personal data through several channels: directly from you when you register an account or interact with the Platform; automatically through technical means as you browse and use the Platform; and, where necessary, from authorised third-party sources for identity verification purposes. The categories of data we collect are as follows:

3.1 Registration & Identity Data

When you create an mpo50 account, we collect your full legal name, date of birth, Indonesian National Identity Card number (NIK), residential address, email address, and mobile phone number. This information is required to create your account, verify your identity, and comply with our know-your-customer (KYC) obligations.

3.2 Financial & Transaction Data

We collect records of all deposits, withdrawals, and wagers made through your mpo50 account, including the payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja), transaction amounts in Indonesian Rupiah (IDR), timestamps, and transaction reference numbers. We do not store full bank account credentials or card numbers; payment authentication is handled directly by the relevant payment provider.

3.3 Usage & Behavioural Data

As you use the Platform, we automatically collect information about your interactions, including pages visited, games played, bet history, session duration, search queries entered, and features accessed. This data is used to improve platform performance, personalise your experience, and detect unusual activity that may indicate fraud or problem gambling behaviour.

3.4 Technical & Device Data

We collect technical data including your IP address, device type, operating system, browser type and version, screen resolution, time zone setting, and unique device identifiers. This information supports platform security, fraud prevention, and geo-compliance monitoring.

3.5 Communications Data

If you contact mpo50 via live chat, email, or any other support channel, we retain records of that correspondence, including the content of messages, timestamps, and the support agent's responses. This data is used for quality assurance, dispute resolution, and regulatory compliance purposes.

3.6 KYC Verification Documents

Where KYC verification is required — for example, prior to processing a withdrawal or in response to a compliance review — we may collect copies of identity documents such as your Indonesian National Identity Card (KTP), Indonesian passport, and proof-of-address documents such as a recent utility bill or bank statement issued in your name.

4 How We Use Your Data

mpo50 processes your personal data for the following purposes:

Purpose	Data Categories Used
Account creation and management — registering your account, authenticating logins, and maintaining your member profile.	Registration & Identity Data, Technical & Device Data
Service delivery — processing deposits, withdrawals, bets, and game play across all mpo50 products including sports betting, live casino, slots, and togel (Indonesia's traditional numbers lottery).	Financial & Transaction Data, Usage & Behavioural Data
Identity verification (KYC) — verifying that you meet the age and identity requirements for mpo50 membership, in compliance with applicable regulations.	Registration & Identity Data, KYC Verification Documents
Fraud prevention & security — detecting, investigating, and preventing fraudulent transactions, account takeovers, bonus abuse, and other prohibited conduct.	All data categories as relevant to the investigation
Responsible gambling monitoring — identifying behavioural patterns that may indicate problem gambling and, where appropriate, applying protective measures or contacting affected members.	Usage & Behavioural Data, Financial & Transaction Data
Customer support — responding to your queries, resolving disputes, and providing account assistance via live chat and email.	Communications Data, Registration & Identity Data
Marketing communications — sending promotional offers, bonus notifications, and platform updates to members who have opted in to receive such communications.	Registration & Identity Data, Usage & Behavioural Data
Legal & regulatory compliance — meeting our obligations under applicable international licensing conditions, anti-money-laundering (AML) requirements, and data protection laws.	Registration & Identity Data, Financial & Transaction Data, KYC Verification Documents
Platform improvement — analysing aggregate usage patterns to improve the performance, stability, and user experience of the mpo50 Platform.	Usage & Behavioural Data, Technical & Device Data

5 Legal Basis for Processing

mpo50 processes your personal data only where a valid legal basis exists. The applicable legal bases are as follows:

• Contractual necessity: Processing required to perform the contract between mpo50 and you as a registered member — including account management, transaction processing, and service delivery — is carried out on the basis that it is necessary for the performance of that contract.
• Legal obligation: Certain processing activities — particularly KYC, anti-money-laundering checks, and transaction record-keeping — are carried out to comply with mpo50's obligations under applicable international licensing and regulatory frameworks.
• Legitimate interests: mpo50 processes certain data categories (such as usage and technical data) on the basis of its legitimate interests in operating a secure, fraud-free, and commercially sustainable platform, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is based on your consent — for example, receiving marketing communications or the use of non-essential cookies — you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent does not affect your ability to use the Platform for core gambling services.

6 Data Sharing & Disclosure

mpo50 does not sell or rent your personal data to any third party. We may share your data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment service providers: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive transaction data necessary to process deposits and withdrawals on your behalf.
• KYC and identity verification partners: Where we use a third-party identity verification service, your identity documents and personal details may be shared with that provider solely for the purpose of verifying your identity and age.
• Game content providers: Studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, PG Soft, and Spribe receive the minimum data necessary to operate their game products within the mpo50 Platform. This typically consists of a pseudonymous player identifier and session data.
• IT infrastructure and cloud service providers: mpo50 uses contracted cloud hosting, content delivery, and database management providers. These providers process data on our behalf under strict data-processing agreements and have no independent right to use that data.
• Regulatory and law enforcement authorities: mpo50 will disclose personal data to competent authorities where required to do so by applicable law, court order, or our international licensing obligations — for example, in the context of an anti-money-laundering investigation or a formal regulatory enquiry.
• Professional advisors: Our legal counsel, auditors, and compliance consultants may access personal data to the limited extent necessary to provide their professional services, and are bound by confidentiality obligations.

7 International Data Transfers

As an internationally operated platform, mpo50 may transfer your personal data to recipients located in countries outside of Indonesia. Where such transfers occur, mpo50 ensures that appropriate safeguards are in place to protect your data, including contractual data-transfer agreements incorporating internationally recognised standard contractual clauses, or reliance on the data protection frameworks of the jurisdiction in which mpo50 holds its gaming licence.

By using the mpo50 Platform, you acknowledge and consent to the transfer of your personal data to jurisdictions that may have different data protection standards than those applicable in Indonesia. mpo50 takes all reasonable steps to ensure that such transfers are conducted securely and that the receiving parties apply standards of data protection equivalent to those described in this Policy.

8 Data Retention

mpo50 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, or for as long as required by applicable law or regulatory obligation. The following general retention periods apply:

Data Category	Retention Period	Basis
Registration & Identity Data	Duration of account + 5 years after closure	Regulatory / AML compliance
Financial & Transaction Records	Duration of account + 7 years after closure	International licensing obligation
KYC Verification Documents	Duration of account + 5 years after closure	Regulatory / AML compliance
Usage & Behavioural Data	24 months on a rolling basis	Legitimate interest (platform improvement, responsible gambling)
Communications & Support Records	3 years from the date of the interaction	Legitimate interest (dispute resolution)
Technical & Device Data (logs)	12 months on a rolling basis	Legitimate interest (security)
Marketing Consent Records	Until consent is withdrawn + 2 years	Legal obligation (proof of consent)

Where data is no longer required for any of the above purposes, mpo50 will securely delete or anonymise it in a manner that prevents reconstruction. Anonymised, aggregated data — from which individual members cannot be identified — may be retained indefinitely for statistical and analytical purposes.

9 Cookies & Tracking Technologies

The mpo50 Platform uses cookies and similar technologies (such as local storage objects and session tokens) to support platform functionality, security, and — where consented — personalisation. The cookies we deploy fall into the following categories:

• Strictly necessary cookies: These are essential for the Platform to function correctly. They maintain your logged-in session, preserve your account preferences during a visit, and support security features such as CSRF protection. These cookies cannot be disabled without impairing your ability to use the Platform.
• Performance and analytics cookies: These cookies collect anonymised data about how visitors use the Platform — for example, which pages are visited most frequently and where errors occur. This data helps us improve the platform experience. These cookies are only deployed where you have provided consent.
• Functionality cookies: These cookies remember your preferences — such as your preferred language, display settings, and last-visited game category — to provide a more personalised experience on return visits.

mpo50 does not deploy third-party advertising cookies or cross-site tracking pixels from ad networks on the Platform. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies may prevent you from logging in or using core Platform features.

10 Your Rights

As a data subject whose personal data is processed by mpo50, you hold the following rights, subject to any limitations imposed by applicable law or our regulatory obligations:

• Right of access: You may request a copy of the personal data mpo50 holds about you at any time. We will provide this within a reasonable timeframe, typically 30 days of receiving a verifiable request.
• Right to rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. Some data — such as your registered name — may require supporting documentation before a correction can be made.
• Right to erasure: You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. This right does not override our obligation to retain certain data for regulatory or compliance purposes.
• Right to restriction of processing: You may request that mpo50 restrict the processing of your data in certain circumstances — for example, where you contest the accuracy of the data held, or where you have objected to processing and a determination is pending.
• Right to data portability: Where processing is based on consent or contractual necessity, and is carried out by automated means, you may request that your personal data be provided to you in a commonly used, machine-readable format.
• Right to object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gambling monitoring purposes. mpo50 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.

To exercise any of the above rights, please contact the mpo50 Data Privacy Team at [email protected] with the subject line "Data Rights Request — [Your Account Username]". We will acknowledge your request promptly and respond in full within 30 days. In complex cases we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

11 Security Measures

mpo50 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and mpo50 servers.
• AES-256 encryption for sensitive data at rest, including stored KYC documents and financial records.
• Role-based access controls limiting internal staff access to personal data on a strict need-to-know basis, with all access events logged and audited.
• Multi-factor authentication requirements for all staff with access to systems containing member personal data.
• Regular independent penetration testing and vulnerability assessments of Platform infrastructure.
• Intrusion detection systems and 24/7 security monitoring of network traffic and database access patterns.
• A formal data breach response procedure, including notification protocols in the event of a breach that presents material risk to affected members.

While mpo50 takes every reasonable precaution to protect your data, no digital platform can guarantee absolute security against all possible threats. You are responsible for maintaining the confidentiality of your own account credentials and for ensuring that you access the Platform from secure, trusted devices.

12 Children & Minors

The mpo50 Platform is strictly intended for adults aged 21 years and over. mpo50 does not knowingly collect personal data from individuals under the age of 21. If you are under 21 years of age, you must not register an account, access the Platform, or submit any personal data to mpo50 through any channel.

If mpo50 becomes aware that personal data has been collected from a person under the age of 21 — whether through a registration application, an age verification failure, or any other means — that data will be permanently deleted and the associated account application will be declined or the existing account closed without delay. Where applicable, the matter will be escalated to relevant authorities in accordance with our licensing obligations.

Parents and guardians who believe their child may have accessed or attempted to access the mpo50 Platform should contact our support team at [email protected] immediately.

13 Changes to This Policy

mpo50 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the operational requirements of the Platform. Where changes are material — affecting the rights of existing members or the purposes for which their data is used — mpo50 will provide advance notice via the in-platform notification system or by email to the address registered on your account, at least 14 days before the updated Policy takes effect.

The "Last Updated" date at the top of this page will be revised each time the Policy is amended. Your continued use of the mpo50 Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the amended Policy, you should cease using the Platform and may request withdrawal of your available account balance before the effective date of the change.

14 Contact & Complaints

For any privacy-related enquiries, data subject access requests, or formal complaints regarding mpo50's handling of your personal data, please contact the mpo50 Data Privacy Team through the following channels:

• Email: [email protected] — use the subject line "Privacy Request — [Your Account Username]" for data rights requests, or "Privacy Complaint — [Your Account Username]" for formal complaints. We aim to acknowledge all privacy correspondence within 24 hours (WIB business hours) and to respond in full within 30 days.
• Live Chat: Available 24/7 via the mpo50 Platform for general privacy queries and to request the initiation of a formal data rights process.
• Help Centre: Visit the FAQ page for answers to common questions about account data, cookies, and communication preferences.