Privacy Policy

In this Privacy Policy, the following terms carry the meanings set out below. Singular terms include the plural and vice versa where context requires.

• "mpo35", "we", "us", "our" — the mpo35 platform, owned and operated by its internationally licensed holding entity, accessible at https://mpo35.cam.
• "Platform" — the website at https://mpo35.cam, together with all associated subdomains, mobile experiences, and services provided thereunder.
• "Member", "you", "your" — any individual who has registered a valid account on the Platform or who browses the Platform without registration.
• "Personal Data" — any information that directly or indirectly identifies a living natural person, including but not limited to names, email addresses, device identifiers, IP addresses, and payment details.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. mpo35 acts as Data Controller for all Personal Data collected through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of mpo35 under a binding data-processing agreement.
• "KYC" — Know Your Customer identity verification conducted to confirm a Member's identity, age, and payment method ownership before withdrawal requests are processed.
• "Cookies" — small text files placed on your device by the Platform to store session state, user preferences, and analytics data.
• "Effective Date" — 1 January 2026, from which date this Privacy Policy applies.

This Privacy Policy applies to all Personal Data collected by mpo35 through the Platform, including data collected during account registration, identity verification, financial transactions, customer support interactions, and general Platform browsing.

mpo35 acts as the Data Controller in respect of all Personal Data collected directly from Members and Platform visitors. Where mpo35 engages third-party service providers to process data on its behalf — such as payment processors, identity verification providers, and analytics vendors — those parties act as Data Processors under binding contractual agreements that prohibit them from using your data for their own independent purposes.

This policy is directed specifically at Members and prospective members who are residents of Indonesia. If you are accessing the Platform from outside Indonesia, please be aware that your data may be transferred to and processed in a jurisdiction other than your own.

mpo35 collects Personal Data through three primary channels: information you provide directly, information generated automatically by your use of the Platform, and information we receive from authorised third parties.

3.1 Data You Provide Directly

3.2 Data Generated Automatically

• Device & Technical Data: IP address, browser type and version, operating system, device type, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, features accessed, time spent on page, clickstream data, search queries entered within the Platform, and error logs.
• Transaction Data: Bet history, game session logs, wagering volumes, bonus redemption activity, and win/loss records — all denominated in Indonesian Rupiah (IDR / Rp).
• Cookie Data: Session tokens, preference settings, and analytics identifiers placed on your device in accordance with Clause 7 of this policy.

3.3 Data from Third Parties

• Identity Verification Providers: Confirmation of identity document authenticity and age verification results.
• Payment Processors: Transaction status updates, chargeback notifications, and fraud-screening signals from Indonesian banking partners and e-wallet providers.
• Fraud & AML Screening Services: Sanctions list data, politically exposed persons (PEP) screening results, and adverse media reports used to satisfy our anti-money laundering obligations.
• Analytics Providers: Aggregated or pseudonymised behavioural data used to understand Platform usage patterns and improve user experience.

mpo35 uses the Personal Data it collects for the following specific purposes. We do not use your data for any purpose that is incompatible with those listed here without first seeking your consent.

• Account Management: Creating and maintaining your member account, authenticating your login sessions, and managing your account preferences and notification settings.
• Transaction Processing: Facilitating deposits and withdrawals in IDR / Rp via your chosen Indonesian bank or e-wallet, reconciling transaction records, and managing currency conversion where applicable.
• Identity Verification (KYC): Confirming your identity, age (21+), and residential status in Indonesia prior to processing withdrawal requests, in compliance with our licence obligations.
• Regulatory Compliance: Meeting our obligations under applicable anti-money laundering (AML) regulations, sanctions screening requirements, and responsible gaming mandates — including the operation of self-exclusion registers and deposit limit systems.
• Customer Support: Responding to your queries, resolving complaints, and maintaining records of support interactions for quality assurance purposes.
• Platform Security: Detecting and preventing fraud, multi-accounting, bonus abuse, unauthorised access, and other prohibited activities as defined in our Terms and Conditions.
• Service Improvement: Analysing anonymised and aggregated usage data to improve Platform performance, identify popular features, and develop new products and promotions.
• Marketing Communications: Sending you promotional offers, bonus notifications, and event announcements by email or SMS — but only where you have opted in to receive such communications. You may withdraw consent at any time via your account settings or by contacting support.
• Responsible Gaming: Monitoring wagering behaviour to identify patterns that may indicate problem gambling and, where appropriate, initiating contact to offer responsible gaming support tools including deposit limits, cooling-off periods, and self-exclusion.

mpo35 processes your Personal Data under one or more of the following legal bases, depending on the specific purpose of the processing activity:

• Contractual Necessity: Processing required to perform the contract between mpo35 and you as a Member — including account creation, transaction processing, KYC verification, and customer support. Without this processing, we cannot provide the service.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including AML obligations, sanctions screening, age verification requirements, and licensed operator reporting duties.
• Legitimate Interests: Processing carried out to pursue mpo35's legitimate business interests where those interests are not overridden by your rights and freedoms — including fraud prevention, platform security, service improvement analytics, and responsible gaming monitoring.
• Consent: Processing based on your freely given, specific, and informed consent — principally for marketing communications and optional analytics cookies. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

mpo35 does not sell, rent, or trade your Personal Data to any third party. We share data only in the limited circumstances described below, and always subject to contractual safeguards that restrict the recipient's use of your data to the specified purpose.

6.1 Service Providers (Data Processors)

We engage carefully selected third-party service providers to support the operation of the Platform. These providers process your data solely on our instructions and are prohibited from using it for their own purposes. Categories of processor include:

• Payment processing partners — Indonesian bank transfer networks and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) for deposit and withdrawal execution.
• Identity verification and KYC providers — for document authentication and sanctions/PEP screening.
• Cloud hosting and infrastructure providers — for secure Platform operation and data storage.
• Customer support platform providers — for live chat, email ticketing, and support call management.
• Analytics and product improvement tools — operating on anonymised or pseudonymised data only.

6.2 Regulatory & Law Enforcement Disclosure

mpo35 may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so — for example, in response to a lawful court order, a regulatory investigation, or an AML reporting obligation. We will notify you of any such disclosure where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the assets of mpo35, your Personal Data may be transferred to the successor entity as part of that transaction. We will provide reasonable notice of any such transfer and the successor entity will be bound by this Privacy Policy or a policy offering equivalent protections.

6.4 What We Never Do

• We do not sell your Personal Data to advertising networks or data brokers.
• We do not share your financial details with any party other than the payment processors required to execute your specific transaction.
• We do not share your KYC documents with any party other than accredited identity verification service providers operating under binding confidentiality agreements.

mpo35 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and understand how members interact with our services. The following categories of cookie are in use:

mpo35 does not use advertising or cross-site tracking cookies. We do not permit third-party advertising networks to place cookies on the Platform.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in or using the Platform. Changes to cookie preferences take effect from your next session.

mpo35 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, satisfy applicable legal and regulatory obligations, or resolve outstanding disputes or claims. The following retention schedule applies:

• Account and Identity Data: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, in accordance with AML record-keeping obligations.
• Financial and Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, as required by applicable financial regulation.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the last interaction, or longer where the interaction relates to an unresolved dispute.
• Analytics and Usage Data: Aggregated and anonymised within thirteen (13) months of collection; raw pseudonymised data is deleted at that point.
• Marketing Consent Records: Retained for the duration of your membership plus three (3) years, to evidence compliance with consent obligations.

When the applicable retention period expires, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with any identified or identifiable individual.

mpo35 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Key measures include:

• Encryption in Transit: All data transmitted between your device and the Platform is encrypted using industry-standard 256-bit SSL/TLS protocols. Connections over unencrypted HTTP are automatically redirected to HTTPS.
• Encryption at Rest: Sensitive data fields — including financial details and KYC document references — are encrypted at the database level using AES-256 encryption.
• Access Controls: Access to Personal Data within mpo35's systems is restricted to authorised personnel on a strict need-to-know basis. All internal access is logged and regularly audited.
• Network Security: The Platform infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and distributed denial-of-service (DDoS) mitigation services.
• Vulnerability Management: We conduct regular internal and third-party security assessments, including penetration testing, to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: mpo35 maintains a documented data breach response procedure. In the event of a confirmed breach that poses a risk to your rights and freedoms, we will notify affected Members and relevant authorities within the timeframes required by applicable law.

Subject to applicable law and certain limited exceptions, you have the following rights in respect of your Personal Data held by mpo35. To exercise any of these rights, please contact our support team using the details in Clause 14.

• Right of Access: You may request a copy of the Personal Data mpo35 holds about you, together with information about how it is used and with whom it has been shared. We will respond to access requests within thirty (30) calendar days.
• Right to Rectification: You may request that we correct any inaccurate or incomplete Personal Data we hold about you. Minor corrections (e.g., updating a phone number) can be made directly within your Account settings.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where processing is unlawful. Note that we may be required by law to retain certain data for AML or other regulatory purposes notwithstanding a deletion request.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability: Where processing is based on your consent or the performance of a contract, you may request a structured, machine-readable copy of the Personal Data you have provided to us for transfer to another service provider.
• Right to Object: You may object to processing based on mpo35's legitimate interests at any time. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights Related to Automated Decision-Making: Where mpo35 makes decisions that significantly affect you using solely automated processing — such as automated fraud detection — you have the right to request human review of that decision.

mpo35 will not charge a fee to process rights requests made in good faith. We reserve the right to refuse requests that are manifestly unfounded or excessive, in which case we will explain our reasons in writing.

The mpo35 Platform is strictly intended for adults who are at least 21 years of age. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is conducted as part of the mandatory KYC process for all Members prior to withdrawal.

If we become aware that Personal Data has been collected from an individual under the age of 21 — whether through misrepresentation during registration or any other means — we will immediately suspend the relevant Account, permanently delete all associated Personal Data, return any Real Money Funds deposited to the verified source payment method, and void any Bonus Funds or winnings generated by the account.

If you are a parent or guardian and believe that your child has registered on the mpo35 Platform without your knowledge, please contact us immediately at [email protected] so that we can take the appropriate action without delay.

mpo35's primary target market is Indonesia, and we endeavour to store and process Personal Data within regions that offer adequate data protection standards. However, the nature of our international operations means that certain Personal Data may be transferred to, stored in, or processed in a country outside Indonesia.

Where such transfers occur, mpo35 takes steps to ensure that your Personal Data receives a level of protection equivalent to that provided under this Privacy Policy. These steps may include:

• Executing standard contractual data transfer clauses with the recipient entity.
• Transferring data only to recipients in countries or territories that have been assessed as providing an adequate level of data protection.
• Implementing supplementary technical safeguards — such as end-to-end encryption of transferred data — where the destination jurisdiction's protections are assessed as insufficient on their own.

By using the Platform, you acknowledge and consent to the transfer of your Personal Data as described in this Clause, subject to the safeguards set out above.

mpo35 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. When material changes are made, we will notify active Members by email to their registered address and by displaying a prominent notice on the Platform for a period of no less than fourteen (14) calendar days before the changes take effect.

Minor amendments — such as correcting typographical errors, adding clarifying language that does not substantively change the meaning of any provision, or reflecting minor operational changes — may take effect immediately upon publication without advance notice.

The version date at the top of this document reflects when this policy was last substantively updated. We recommend reviewing this page periodically. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or want to raise a concern about the way mpo35 handles your Personal Data, please contact our Data Protection team using the details below. All contact details are provided as plain text and are not clickable links.

• Email: [email protected]
• Subject Line: Please include "Privacy Request" or "Data Rights" in the subject line of your email to ensure prompt routing to the correct team.
• Response Time: We target a response to all privacy-related enquiries within five (5) business days. Complex requests — such as full data access or portability requests — may require up to thirty (30) calendar days.
• Support Hours: 24 hours a day, 7 days a week, including Indonesian public holidays.
• Languages: English and Bahasa Indonesia.

For general account or platform queries unrelated to data privacy, please use the standard support channel listed on our FAQ page. For responsible gaming support and self-exclusion requests, please visit our Responsible Gaming page.