Privacy Policy — mpo39

mpo39 is an internationally operated online betting and gaming platform accessible at mpo39.bet. The platform offers a comprehensive suite of gambling products including sportsbook betting (covering BRI Liga 1, EPL, Champions League, and other major leagues), live casino games, slot titles from studios such as Pragmatic Play, Evolution Gaming, NetEnt, and Pocket Games Soft, togel number-draw games, and the sakong card game vertical.

mpo39 is designed specifically for Indonesian players and accepts deposits and withdrawals exclusively in Indonesian Rupiah (IDR) via major local banks including BCA, BRI, BNI, Mandiri, CIMB Niaga, and OCBC NISP, as well as Indonesian e-wallets OVO, DANA, GoPay, ShopeePay, and LinkAja.

For all privacy-related enquiries, data subject requests, and formal complaints, the mpo39 data contact point is reachable at [email protected]. We aim to respond to all privacy correspondence within five business days.

mpo39 collects personal data across several categories. The table below summarises each category, provides examples of the specific data points collected, and identifies the primary reason each category is necessary.

mpo39 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, biometric data for identification purposes, or health data, except where a Member voluntarily discloses health context in a responsible gaming self-exclusion request — in which case it is processed solely for the purpose of administering that self-exclusion.

mpo39 collects personal data through the following channels and mechanisms:

• Direct submission by you: Information you provide when completing the account registration form, the KYC verification upload, deposit or withdrawal request forms, live chat conversations, email correspondence, and promotional opt-in selections.
• Automated platform collection: Technical and behavioural data collected automatically as you interact with the mpo39 platform — including server access logs, browser fingerprint signals, session activity records, and in-game event data captured by the game engine.
• Cookies and similar technologies: First-party cookies and local storage tokens used to maintain your session state, remember your login, and track aggregate usage patterns for platform analytics. See Section 9 (Cookies & Tracking) for full detail.
• Payment processors: Transaction confirmation data returned to mpo39 by bank transfer gateways and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal. mpo39 receives transaction status, reference numbers, and payment account identifiers — never your full bank PIN or card security codes.
• KYC verification partners: Where mpo39 uses a third-party automated identity verification service to validate government-issued documents, that service returns a verification outcome (pass/fail/review) and a confidence score to mpo39. The raw document data is processed by the KYC partner under a data processing agreement with equivalent security obligations.
• Third-party game studios: Game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, Spribe) transmit bet placement, game outcome, and session duration data to mpo39 in real time as part of the game integration. This data is used for wallet settlement, dispute resolution, and responsible gaming monitoring.

mpo39 processes personal data for the following defined purposes. We do not use personal data for any purpose not listed here without first updating this Privacy Policy and, where required, seeking your consent.

• Account creation and management: To register your account, maintain your Member profile, and provide you with access to the full range of mpo39 Services.
• Identity and age verification (KYC): To confirm that you meet the minimum age requirement of 21 years and to verify your identity before processing your first withdrawal, as required by our operating obligations.
• Payment processing: To receive and credit deposits to your wallet, to execute withdrawal requests to your verified payment account, and to maintain a full transaction ledger for your account history and for financial compliance purposes.
• Fraud prevention and security: To detect, investigate, and prevent unauthorised account access, multi-accounting, payment fraud, money laundering, match-fixing, and bonus abuse — protecting both the integrity of the platform and the security of every Member's funds.
• Responsible gaming: To monitor betting and deposit patterns for indicators of problem gambling behaviour, to administer Member-requested deposit limits, session time limits, cooling-off periods, and self-exclusion orders, and to proactively reach out to Members displaying high-risk patterns.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and maintain records of our interactions for quality assurance and regulatory compliance purposes.
• Promotional communications: To send you personalised bonus offers, promotional notifications, and seasonal campaigns — such as Idul Fitri, Imlek (Chinese New Year), and Indonesian Independence Day promotions — where you have opted in to receive marketing communications. You may withdraw this consent at any time through your account settings.
• Platform improvement: To analyse aggregate, anonymised usage data to improve product design, game selection, performance, and overall user experience.
• Legal and regulatory compliance: To meet the obligations imposed on mpo39 by the laws and regulations of the jurisdiction in which it operates, including record-keeping requirements and cooperation with lawful authority requests.

mpo39 processes your personal data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual necessity: Processing required to deliver the Services you have signed up for — including account management, payment processing, game access, and customer support — is carried out on the basis that it is necessary to perform the contract between you and mpo39 (as set out in the Terms & Conditions).
• Legal obligation: Processing carried out to comply with applicable legal and regulatory requirements — including KYC identity verification, AML transaction monitoring, and maintaining financial records — is carried out on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming oversight, platform analytics, and internal audit is carried out on the basis of mpo39's legitimate interest in operating a secure, fair, and sustainable gaming platform. mpo39 has assessed these legitimate interests against your right to privacy and has determined that they are proportionate and do not override your fundamental rights.
• Consent: Processing for marketing communications and for the use of non-essential analytics cookies is carried out on the basis of your freely given, specific consent. You may withdraw consent for marketing at any time through your account settings without affecting the lawfulness of processing carried out prior to withdrawal.

mpo39 does not sell your personal data. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for each stated purpose.

• Payment processors and banking partners: When you initiate a deposit or withdrawal, the relevant transaction details (amount, reference number, your registered account name) are shared with the payment gateway or bank facilitating the transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, OVO, DANA, GoPay, ShopeePay, or LinkAja). These entities receive only the information necessary to complete the specific transaction.
• KYC and identity verification providers: Your identity documents and personal details are shared with our contracted KYC partner(s) for the purpose of verifying your identity and age before your first withdrawal. KYC partners are contractually prohibited from using this data for any purpose other than providing verification services to mpo39.
• Game studios and content providers: Your Member ID, session tokens, and wallet balance are shared with integrated game studios (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, Spribe) in real time during a game session to enable gameplay, bet settlement, and jackpot calculation. Studio data handling is governed by the studio's own security policies and our integration agreements.
• IT and security service providers: Hosting providers, cybersecurity firms, and cloud infrastructure partners who process data on mpo39's behalf under data processing agreements that require them to apply equivalent technical and organisational security measures.
• Legal and regulatory authorities: mpo39 will disclose personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required to do so by a lawful order or where mpo39 reasonably believes disclosure is necessary to prevent fraud, money laundering, or other serious criminal activity.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of mpo39's business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and of any material changes to the way your data is handled as a result.

mpo39 retains personal data only for as long as it is needed for the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is either securely deleted from mpo39's systems or irreversibly anonymised so that it can no longer be linked to an identifiable individual. Anonymised, aggregated data may be retained indefinitely for statistical and business analytics purposes.

mpo39 applies a layered security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• Transport Layer Security (TLS 1.3): All data in transit between your browser or app and the mpo39 servers is encrypted using TLS 1.3. Our SSL certificate is publicly verifiable and renewed automatically before expiry.
• Data encryption at rest: Sensitive data fields — including payment account details, government ID numbers, and KYC document content — are encrypted using AES-256 encryption in our database layer. Encryption keys are stored separately from the encrypted data.
• Tokenisation: Bank account numbers and e-wallet identifiers are tokenised immediately upon receipt. The actual account numbers are stored only by our payment processor partners; mpo39 systems store only the corresponding token.
• Access control: Internal systems access operates on the principle of least privilege. Staff access to Member personal data is role-based, logged, and subject to regular access reviews. No member of the mpo39 team has unrestricted access to the full database.
• Two-factor authentication (2FA): mpo39 offers two-factor authentication for Member accounts to significantly reduce the risk of unauthorised login. We strongly recommend enabling 2FA in your account security settings.
• Penetration testing and security audits: The mpo39 platform undergoes periodic independent security assessments, including penetration testing, vulnerability scanning, and code reviews. Identified vulnerabilities are remediated according to a risk-prioritised schedule.
• Incident response: mpo39 maintains a documented data breach response plan. In the event of a breach that is likely to result in a risk to affected Members, mpo39 will notify affected Members and the relevant regulatory authority within the timeframes required by applicable law.

mpo39 uses cookies and similar technologies (local storage tokens, session identifiers) on the mpo39.bet platform. The table below explains the categories of cookies in use and their purpose.

mpo39 does not use third-party advertising cookies or cross-site tracking pixels. We do not participate in any advertising network that would allow your browsing behaviour on mpo39.bet to be tracked across other websites.

You can control or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent the platform from functioning correctly — you will not be able to log in or maintain a session without them. For optional analytics cookies, you may withdraw consent through your account's privacy settings.

As an mpo39 Member, you hold the following rights in respect of the personal data we hold about you. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request" and your Member ID. We will respond within 30 days of receiving a valid request.

The mpo39 platform is strictly for adults aged 21 years and older. mpo39 does not knowingly collect personal data from any individual under the age of 21. Age verification is a mandatory step in the mpo39 KYC process and must be completed before any withdrawal is processed.

During KYC review, Members are required to submit a valid government-issued identity document (KTP for Indonesian nationals, or a valid passport for non-Indonesian nationals) confirming their date of birth. Any account found to belong to a person under 21 years of age will be immediately suspended, all funds will be withheld pending investigation, and the matter may be escalated to relevant authorities.

mpo39 operates internationally, and your personal data may be transferred to, stored, or processed in countries outside Indonesia. This may occur, for example, when data is processed by our hosting infrastructure, KYC partner, or a game studio's backend systems located in a different jurisdiction.

Whenever personal data is transferred outside the jurisdiction of origin, mpo39 ensures that appropriate safeguards are in place to protect that data to a standard at least equivalent to the protections described in this Privacy Policy. These safeguards may include:

• Contractual data processing agreements incorporating standard data protection clauses that impose binding obligations on the recipient to protect personal data;
• Transfers to recipients in jurisdictions that maintain an adequate level of data protection as assessed by recognised international standards;
• Technical measures such as end-to-end encryption during transfer and access-controlled storage at the destination.

By registering an mpo39 account, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described in this section.

mpo39 may update this Privacy Policy from time to time to reflect changes in our data practices, new product features, changes in applicable law, or the recommendations of our compliance advisors. The "Last Updated" date at the top of this document will always reflect when the most recent revision was made.

Where a change is material — meaning it significantly affects how we collect, use, or share your personal data — mpo39 will notify you by email to your registered address and by a prominent notice displayed on the platform at your next login, at least 14 days before the change takes effect. Continued use of the mpo39 platform after the effective date of a material change constitutes your acceptance of the updated Privacy Policy.

For minor or administrative updates (such as clarifying existing language, correcting typographical errors, or updating contact details), mpo39 will update the document without individual notification, though the "Last Updated" date will be revised accordingly. We encourage you to review this Privacy Policy periodically.

For all privacy-related enquiries, data subject access requests, consent withdrawal requests, or complaints regarding the handling of your personal data by mpo39, please contact us through the following channels:

• Email (Privacy & Data Rights): [email protected] — include "Privacy Request" or "Data Rights Request" in the subject line along with your registered Member ID to ensure your enquiry reaches the correct team without delay.
• Live Chat: Available on the mpo39 platform 07:00–23:00 WIB, seven days a week. For complex data rights requests, the live chat team will escalate your request internally and confirm receipt within one business day.
• Response time: mpo39 commits to acknowledging all privacy-related requests within 3 business days and providing a substantive response within 30 calendar days. Where a request is complex or voluminous, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason before the initial 30-day deadline expires.