Privacy Policy

Definitions

In this Privacy Policy, the following terms shall have the meanings set out below unless the context requires otherwise:

• "Platform" — The mpo21 website accessible at https://mpo21.bet, including all web pages, mobile-optimized interfaces, progressive web app (PWA) installations, and all services accessible thereon.
• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to names, identification numbers, location data, online identifiers, and data relating to the physical, economic, or social identity of that person.
• "Processing" — Any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, or erasure.
• "Controller" — mpo21, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" — Any third party that processes Personal Data on behalf of mpo21 under a data processing agreement.
• "Player / You" — Any individual who registers an account on, accesses, or uses any service provided through the mpo21 Platform.
• "KYC" — Know Your Customer; the identity and age verification process required before withdrawal processing or upon request by mpo21's compliance team.
• "Cookies" — Small text files placed on your device by the Platform to store session information, preferences, and analytics data.
• "IDR / Rp" — Indonesian Rupiah; the sole currency denomination used on the mpo21 Platform.

Data We Collect

mpo21 collects the following categories of Personal Data from Players. We collect only the data that is necessary and proportionate to the purposes set out in Section 04 of this Policy.

How We Collect Data

mpo21 collects Personal Data through the following means:

• Direct Submission: Data you provide actively when registering an account, completing your profile, submitting KYC documents, making a deposit or withdrawal, contacting support, or responding to a survey.
• Automated Collection: Technical and behavioral data collected automatically as you interact with the Platform, including via server logs, session tracking, and first-party analytics tools embedded in our web interface.
• Cookies and Tracking Technologies: First-party cookies, local storage, and session tokens that enable core Platform functionality (authentication, session management, preference storage) and aggregate analytics. See Section 07 for full details.
• Payment Processors: Transaction confirmation data shared back to mpo21 by our payment gateway partners (including local Indonesian bank transfer APIs and e-wallet integrations) to confirm deposit and withdrawal statuses.
• KYC Verification Providers: Identity verification outcomes (pass/fail, confidence scores) returned to mpo21 by our third-party KYC service providers after document review. Raw document scans may be processed by these providers under separate data processing agreements.
• Game Content Providers: Aggregate gameplay and session data returned to mpo21 by licensed game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, Spribe) for settlement, responsible gaming monitoring, and fraud detection purposes.

How We Use Your Data

mpo21 processes your Personal Data for the following specific, legitimate purposes:

1. Account Management: To create, maintain, and secure your mpo21 account; to authenticate you each time you log in; and to enable all account management functions including password resets and two-factor authentication.
2. Age and Identity Verification (KYC): To confirm that you meet the minimum age requirement of 21 years and to verify your identity in accordance with internationally recognised anti-money laundering (AML) and Know Your Customer standards.
3. Payment Processing: To process deposits from and withdrawals to your verified Indonesian bank account or e-wallet (BCA, BRI, BNI, Mandiri, DANA, OVO, GoPay, ShopeePay, LinkAja) accurately and securely.
4. Service Delivery: To provide you access to all mpo21 products including sports betting (BRI Liga 1, EPL, Champions League, Timnas Indonesia matches), live casino games, slot games, togel (Indonesia's traditional numbers lottery), Capsa Susun, Dragon Tiger, and e-sports markets (MPL Indonesia, PUBG Mobile, Free Fire).
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, account takeovers, multi-accounting, money laundering, and other prohibited conduct as defined in our Terms & Conditions.
6. Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling, to enforce deposit limits and self-exclusion requests, and to provide responsible gaming interventions where appropriate.
7. Customer Support: To respond to your enquiries, resolve disputes, and process complaints via live chat and email support.
8. Legal and Regulatory Compliance: To comply with applicable international laws, court orders, regulatory directives, and AML reporting obligations.
9. Platform Improvement: To analyze aggregate usage patterns, optimize platform performance, and develop new features based on player behavior (using anonymized or pseudonymized data wherever possible).
10. Marketing Communications (opt-in only): To send you promotional offers, bonus notifications, and seasonal campaign information (including promotions tied to Idul Fitri, Ramadhan, Indonesian Independence Day, and major sporting events) — only where you have expressly opted in to receive such communications.

Legal Basis for Processing

mpo21 relies on the following legal bases to process your Personal Data:

• Contractual Necessity: Processing that is necessary to perform the contract we have with you (the Terms & Conditions you agreed to at registration), including account management, payment processing, and service delivery.
• Legal Obligation: Processing required to comply with applicable law, including KYC / AML obligations, tax record-keeping requirements, and responses to valid law enforcement requests.
• Legitimate Interests: Processing for purposes that serve our legitimate business interests — specifically fraud detection, platform security, responsible gaming monitoring, and aggregate analytics — where these interests are not overridden by your fundamental privacy rights.
• Consent: Processing that depends on your freely given, specific, and informed consent — primarily marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Sharing & Disclosure

mpo21 does not sell, rent, or trade your Personal Data. We share data only in the circumstances described below, and only to the extent necessary for each purpose:

• Payment Gateway Partners: Your name, bank account / e-wallet identifier, and transaction amount are shared with our Indonesian payment processing partners (bank transfer APIs, DANA, OVO, GoPay, ShopeePay, LinkAja integrations) solely to process your deposit and withdrawal requests.
• KYC Verification Providers: Identity documents submitted for KYC verification are processed by our contracted third-party verification service provider under a strict data processing agreement. Verification outcomes are returned to mpo21; raw documents are retained only as long as required by the provider's regulatory obligations.
• Game Content Providers: Your account identifier and gameplay session data are shared with licensed game studios (Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, Spribe) to facilitate game delivery, settle game outcomes, and support responsible gaming monitoring. These providers are bound by contractual confidentiality obligations.
• Customer Support Platforms: Live chat transcripts and support ticket data may be processed by our customer support software provider under a data processing agreement. Indonesian-speaking agents have access to your account information solely for the purpose of resolving your support requests.
• Law Enforcement and Regulatory Authorities: mpo21 will disclose Personal Data to competent law enforcement agencies, courts, regulatory bodies, or other public authorities where required by applicable law, a valid court order, or a regulatory directive — and only to the extent mandated by such legal instrument.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or substantially all of mpo21's assets, your Personal Data may be transferred to the acquiring entity, subject to that entity assuming the same data protection obligations as set out in this Policy. You will be notified of any such transfer via your registered email address.

Cookies & Tracking Technologies

mpo21 uses cookies and similar technologies on the Platform. The following table summarizes the types of cookies we deploy:

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will prevent you from logging in to your mpo21 account and accessing core Platform features. mpo21 does not use third-party advertising cookies or tracking pixels for cross-site behavioral advertising.

Data Retention

mpo21 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, or accounting requirements. The following retention periods apply:

• Active Account Data: Retained for the full duration of your account relationship with mpo21, plus a minimum of five (5) years after account closure to satisfy AML record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification in accordance with international AML standards. Copies are stored in an encrypted document vault with access restricted to compliance personnel.
• Transaction Records (deposits, withdrawals, bets): Retained for a minimum of five (5) years from the transaction date. These records may be required by financial regulators or law enforcement.
• Customer Support Communications: Retained for three (3) years from the date of the last interaction, or longer if the communication relates to an active dispute or legal matter.
• Technical / Server Log Data: Retained for twelve (12) months in rolling logs, then automatically purged unless required for an active security investigation.
• Marketing Preferences: Retained until you withdraw consent or request deletion. Unsubscribe records are kept indefinitely to ensure we do not accidentally re-add you to marketing lists.

When Personal Data is no longer required for its original purpose and no legal retention obligation applies, mpo21 will securely delete or anonymize the data so that it can no longer be associated with you as an individual.

Data Security

mpo21 implements a comprehensive set of technical and organizational measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or alteration. Our security framework includes:

• Encryption in Transit: All data exchanged between your browser or device and mpo21's servers is encrypted using TLS 1.2 or TLS 1.3 (256-bit SSL). Our SSL certificate is monitored continuously for validity.
• Encryption at Rest: Sensitive Personal Data stored in our databases — including KYC documents, financial data, and hashed authentication credentials — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data within mpo21's internal systems is governed by a strict role-based access control (RBAC) policy. Only personnel with a documented, legitimate business need are granted access to player data, and all access events are logged and audited.
• Password Security: Passwords are never stored in plain text. mpo21 uses a modern adaptive hashing algorithm (bcrypt with a sufficient cost factor) to store password credentials. Players are encouraged to use a strong, unique password and to enable two-factor authentication (2FA) from their account security settings.
• Penetration Testing: mpo21 conducts periodic third-party penetration tests and vulnerability assessments of the Platform. Critical findings are remediated on a priority basis.
• Incident Response: In the event of a Personal Data breach that poses a high risk to Player rights, mpo21 will notify affected Players via their registered email address within 72 hours of becoming aware of the breach, describing the nature of the breach, the data affected, and the steps being taken to mitigate harm.

Your Rights Over Your Personal Data

As a Player on the mpo21 Platform, you have the following rights in relation to your Personal Data. To exercise any of these rights, contact our support team via live chat or email at [email protected] (plain text — not a link).

mpo21 will respond to all verified data rights requests within 30 calendar days. For complex requests, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day window.

Minors & Age Policy

mpo21 is a strictly 21+ only platform. We do not knowingly collect Personal Data from any individual under the age of 21. Registration on the mpo21 Platform is prohibited for persons under 21 years of age.

Where m po21 discovers or has reasonable grounds to believe that a registered account is held by a person under the age of 21, we will:

• Immediately suspend the account pending investigation.
• Freeze all funds associated with the account pending compliance review.
• Delete all Personal Data associated with the underage individual as soon as practicable, subject to any legal hold requirements.
• Refund any net deposits made, minus any bonuses claimed, in accordance with our Terms & Conditions.

If you have reason to believe that a minor has registered an account on the mpo21 Platform, please contact our support team immediately at [email protected] (plain text — not a link). We take all such reports seriously and will investigate promptly.

Third-Party Services & Links

The mpo21 Platform integrates with a number of third-party service providers to deliver its full range of products. These integrations involve limited, purpose-bound data sharing as described in Section 06. For your reference, the primary categories of third-party providers currently engaged by mpo21 include:

• Game Content Providers: Evolution Gaming, Pragmatic Play, NetEnt, Microgaming, Pocket Games Soft, Spribe, and other licensed studios whose games are available on the Platform.
• Payment Gateway Providers: Indonesian bank transfer API partners; e-wallet integration partners for DANA, OVO, GoPay, ShopeePay, and LinkAja.
• KYC / Identity Verification: Third-party automated identity verification and document authentication service providers.
• Customer Support Software: The live chat and ticketing platform used to power our 24/7 support operations, including the Indonesian-speaking agent queue active 08:00–22:00 WIB.
• Infrastructure and Hosting: Cloud hosting, content delivery network (CDN), and database infrastructure providers that host mpo21's Platform under strict data processing agreements.

mpo21 does not control and is not responsible for the privacy practices of third-party websites or services that may be linked from game provider lobbies or payment redirect pages. When you leave the mpo21 Platform and interact with a third-party environment, that third party's own privacy policy governs the collection of your data. We encourage you to review the privacy policies of any third-party service you interact with.

International Data Transfers

mpo21 operates as an internationally licensed online gaming platform. Some of our third-party service providers — including game content providers and cloud infrastructure partners — are based outside Indonesia and may process your Personal Data in jurisdictions other than your country of residence.

When Personal Data is transferred outside Indonesia to a jurisdiction that may not offer an equivalent level of data protection, mpo21 ensures that appropriate safeguards are in place, including:

• Binding contractual clauses (Standard Contractual Clauses or equivalent) between mpo21 and the receiving third-party processor.
• Verification that the receiving entity maintains appropriate technical and organizational security measures consistent with the standards set out in this Privacy Policy.
• Restriction of transferred data to the minimum necessary for the specific contracted purpose.

By using the mpo21 Platform and accepting this Privacy Policy, you acknowledge and consent to the transfer of your Personal Data to these international processors under the safeguards described above.

Policy Amendments

mpo21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. The "Last Updated" date at the top of this page will be revised each time a change is made.

Where amendments are material — meaning they substantively affect your rights or how we use your Personal Data — mpo21 will provide advance notice of at least seven (7) days via your registered email address and via an in-platform notification. For non-material amendments (such as typographical corrections, formatting updates, or clarifications that do not alter the substance of the Policy), no advance notice is required and changes take effect upon publication.

Your continued use of the mpo21 Platform following the effective date of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material change to this Policy, you may close your account by contacting our support team and requesting voluntary account closure.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mpo21 handles your Personal Data, please reach out to our support team through any of the following channels:

• Live Chat: Available 24/7 directly from your account dashboard. Indonesian-speaking agents are online 08:00–22:00 WIB. Average response time during peak hours: 2–5 menit.
• Email: [email protected] — plain text, not a link. Response within 2–6 hours on business days (WIB).
• FAQ: For quick answers to common questions, visit our FAQ page.

When submitting a data rights request (access, rectification, erasure, portability, objection), please include your account username and a clear description of the request. For erasure or portability requests, identity verification will be required before we can action your request.

mpo21 is committed to acknowledging all Privacy Policy enquiries and data rights requests within 24 hours of receipt and providing a substantive response within 30 calendar days.