mpo25 Privacy Policy

1 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person ("data subject"), including name, national identity number (KTP), date of birth, address, email address, phone number, IP address, device identifiers, financial account details, and any other data that can be used directly or in combination to identify an individual.
• "Processing" — any operation performed on personal data, whether by automated means or otherwise, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, mpo25 is the Data Controller for all player data collected via the platform.
• "Data Processor" — a third party that processes personal data on behalf of mpo25 under a contractual data processing agreement, such as payment gateways, KYC verification providers, and cloud hosting services.
• "Consent" — a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their personal data for a stated purpose.
• "Platform" — the mpo25 website, mobile interface, and associated services accessible at https://mpo25.bio.

2 Data Controller

mpo25 acts as the Data Controller for all personal data collected and processed through the platform. As Data Controller, mpo25 is responsible for ensuring that all processing activities are conducted lawfully, transparently, and in accordance with this Privacy Policy and applicable data protection law.

For all data-related enquiries, requests, or complaints, the designated point of contact is the mpo25 Data Protection team, reachable via [email protected] or through the in-platform live chat. Correspondence should be marked clearly as a "Data Protection Matter" to ensure prompt routing to the responsible team.

3 Data We Collect

3.1 Registration Data

When you create an mpo25 account, we collect the following information: full legal name; date of birth; nationality; residential address (including city, province — e.g., Jakarta, Surabaya, Bandung, Bali — and postal code); email address; mobile phone number; and the username and hashed password you choose for your account.

3.2 Identity Verification (KYC) Data

To comply with our anti-money laundering (AML) and know-your-customer (KYC) obligations, we may collect copies of government-issued identity documents (national identity card / KTP, or passport); a selfie or live photograph for liveness verification; and proof of address (e.g., a recent utility bill or bank statement). For Indonesian players, the KTP number is treated as a highly sensitive data point and is stored in a segregated, access-controlled environment.

3.3 Financial Data

We collect the details necessary to process your deposits and withdrawals, including: bank account number and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, or other accepted institutions); e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, or LinkAja account references); and transaction records including amounts in Indonesian Rupiah (IDR), timestamps, and processing status. We do not store full card numbers or CVV codes — card payment processing is handled exclusively by PCI-DSS-compliant payment processors.

3.4 Usage & Technical Data

When you use the mpo25 platform, we automatically collect: IP address and approximate geolocation derived from it; device type, operating system, and browser version; session timestamps, login history, and activity logs; pages visited, games played, bets placed, and features accessed; and referral source data where applicable. This data is collected primarily for security monitoring, fraud prevention, and platform performance optimisation.

3.5 Communications Data

We retain records of communications between you and the mpo25 support team, including live chat transcripts, email correspondence, and any documents or screenshots you submit during a support interaction. These records are used for quality assurance, dispute resolution, and compliance documentation.

4 How We Collect Data

mpo25 collects personal data through the following channels:

• Directly from you — when you register an account, submit KYC documents, make a deposit or withdrawal request, contact support, or respond to a survey or promotion.
• Automatically through platform use — via server logs, session cookies, analytics tools, and device fingerprinting technologies as you interact with the platform.
• From third-party verification providers — KYC and identity verification partners may return enriched data (e.g., document validity confirmation, sanctions screening results) in response to verification requests we initiate based on the documents you submit.
• From payment service providers — transaction confirmation data, payment status updates, and fraud signals returned by banks and e-wallet providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) when processing your financial transactions.

5 Purpose & Legal Basis for Processing

The table below summarises the primary purposes for which mpo25 processes personal data, together with the legal basis relied upon for each activity:

Where mpo25 relies on legitimate interest as a legal basis, we have conducted a balancing assessment and determined that our interests do not override your fundamental rights and freedoms. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6 Data Sharing

6.1 Service Providers (Data Processors)

mpo25 engages a limited number of carefully vetted third-party service providers to assist with platform operations. These providers act as Data Processors and are permitted to process your personal data only for the specific purposes for which they have been engaged and under binding contractual data protection terms. Categories of providers include: cloud hosting and infrastructure providers; identity verification and KYC platforms; payment gateway and fraud detection services; customer support platform operators; and analytics and platform performance monitoring tools.

6.2 Game Content Providers

Certain game studios whose content is featured on mpo25 — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive limited technical data (such as a pseudonymous player session token) necessary to deliver the game experience. These providers do not receive your full identity data and are contractually prohibited from using session data for any purpose beyond game delivery.

6.3 Regulatory and Law Enforcement Disclosure

mpo25 may disclose personal data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where we are legally required to do so, or where disclosure is necessary to prevent or investigate suspected fraud, money laundering, or other criminal activity. We will inform you of any such disclosure to the extent permitted by applicable law.

6.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or a portion of mpo25's business assets, personal data held about players may be transferred to the relevant successor entity. We will notify affected players prior to any such transfer and will ensure that the receiving entity is bound by data protection terms no less protective than those in this Privacy Policy.

6.5 No Commercial Data Sales

mpo25 does not sell, rent, barter, or otherwise commercially transfer your personal data to any third party for their own independent marketing, advertising, or commercial purposes. This prohibition is absolute and applies regardless of any commercial offer made to mpo25.

7 Data Retention

mpo25 retains personal data only for as long as is necessary for the purposes for which it was collected, and in compliance with applicable legal retention obligations. The following general retention periods apply:

• Active account data: retained for the lifetime of your account plus a minimum of five (5) years after account closure, to comply with AML record-keeping obligations.
• KYC documentation: retained for a minimum of five (5) years from the date of verification, in accordance with international KYC standards.
• Financial transaction records: retained for a minimum of five (5) years from the date of each transaction.
• Customer support communications: retained for three (3) years from the date of each interaction, or longer if the matter relates to an unresolved dispute.
• Marketing consent records: retained for three (3) years from the date of consent, or until consent is withdrawn, whichever is earlier.
• Technical and usage logs: retained for thirteen (13) months on a rolling basis for security and fraud monitoring purposes, then anonymised or deleted.

Where data is no longer required, it is securely deleted or irreversibly anonymised using industry-standard data destruction protocols.

8 Security Measures

mpo25 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key technical and organisational measures in place include:

• TLS 1.3 encryption for all data in transit between clients and platform servers.
• AES-256 encryption for sensitive data fields stored at rest, including identity documents and financial account references.
• Role-based access controls (RBAC) ensuring that staff access to personal data is limited strictly to what is necessary for their specific job function.
• Multi-factor authentication required for all internal systems that process player personal data.
• Regular third-party penetration testing and vulnerability assessments of the platform infrastructure.
• Continuous automated monitoring for anomalous access patterns, login attempts, and data exfiltration signals.
• Documented incident response procedures with defined escalation paths and regulatory notification timelines.

While mpo25 employs substantial security measures, no digital platform can guarantee absolute security. You also bear responsibility for protecting your own account credentials — use a strong, unique password for your mpo25 account and do not share it with anyone.

9 Cookies & Tracking Technologies

9.1 What We Use

mpo25 uses cookies and similar tracking technologies (including session tokens, local storage objects, and device fingerprinting) to operate the platform, maintain your login session, remember your preferences, detect fraud, and analyse aggregate platform usage patterns.

9.2 Cookie Categories

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing your ability to use the platform.
• Functional Cookies: Store your language preferences, display settings, and other personalisation choices to improve your experience across sessions.
• Analytics Cookies: Collect anonymised data about how players navigate and use the platform, enabling us to identify usability issues and optimise the interface. These do not identify you personally.
• Security & Fraud Prevention Cookies: Assist in identifying and blocking suspicious activity, including credential stuffing attacks, automated bot traffic, and account takeover attempts.

9.3 Managing Cookies

You may configure your browser to refuse or delete non-essential cookies. Please be aware that disabling strictly necessary cookies will prevent you from logging into or using the mpo25 platform. Detailed cookie management instructions for major browsers (Chrome, Firefox, Safari, Edge) are available in each browser's help documentation.

10 Your Rights

As a data subject whose personal data is processed by mpo25, you hold the following rights, subject to applicable legal limitations and our legitimate operational requirements:

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (particularly AML and KYC record-keeping requirements, which may override erasure requests).
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances — for example, while a data accuracy dispute is being resolved.
• Right to Data Portability: You may request a machine-readable copy of personal data you have provided to us, for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interest, including profiling for marketing purposes. You may withdraw marketing consent at any time via your account settings.
• Right to Complain: You have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction if you believe your data rights have been infringed.

To exercise any of the above rights, contact the mpo25 Data Protection team via [email protected] or in-platform live chat. We will acknowledge your request within five (5) business days and provide a full response within thirty (30) calendar days. Where a request is complex or involves a large volume of data, we may extend this period by a further thirty (30) days with notice.

11 Minors

The mpo25 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the account registration and KYC process. If mpo25 discovers that personal data has been collected from a person under 21 years of age, that account will be immediately closed, all associated data will be deleted, and any balance will be returned to the payment source after identity confirmation. Parents or guardians who believe their child has registered on the mpo25 platform should contact our support team immediately.

12 International Data Transfers

mpo25 operates infrastructure across multiple jurisdictions to ensure platform reliability and performance for Indonesian players. As a result, your personal data may be transferred to and processed in countries outside Indonesia. Where such transfers occur, mpo25 ensures that appropriate safeguards are in place, which may include: standard contractual clauses approved by relevant data protection authorities; binding corporate rules where data is shared within the mpo25 corporate group; and transfer to jurisdictions that provide an adequate level of data protection as determined by applicable law.

By registering for and using the mpo25 platform, you acknowledge and consent to such international transfers of your personal data, subject to the safeguards described above.

13 Policy Changes

mpo25 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, operational procedures, or applicable law. Material changes — meaning changes that significantly affect your rights or how your data is used — will be communicated to registered players via in-platform notification or email to the registered address, with a minimum of fourteen (14) days' notice before the revised Policy takes effect. The "Last updated" date at the top of this page will reflect the most recent revision at all times.

Your continued use of the mpo25 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the changes, you should cease using the platform and request account closure before the effective date.

14 Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by mpo25, please contact us through the following channels:

• Live Chat: Available 24/7 via the in-platform chat widget — mark your message as a "Data Protection Matter" for priority routing.
• Email: [email protected] — please include "Privacy Policy Enquiry" in the subject line.
• WhatsApp: +62 811 0000 2025 (plain text — not a clickable link)
• Support Hours: 00:00–24:00 WIB (UTC+7) daily, including all Indonesian public holidays.

If you are not satisfied with our response to a data-related complaint, you have the right to escalate the matter to the relevant supervisory authority. mpo25 will cooperate fully with any regulatory investigation and will not penalise players for exercising their data protection rights in good faith.