Privacy Policy — mp076 Data Protection

1 Introduction

mp076 ("the Company", "we", "us", "our") operates the online betting and casino platform accessible at https://mp076.cam ("the Platform" or "the Website"). We are committed to protecting the privacy and personal data of every individual who accesses or uses our Services. This Privacy Policy ("Policy") describes in clear terms what personal data we collect, the purposes for which it is processed, the legal bases we rely upon, how long we retain it, and the rights available to you as a data subject.

This Policy applies to all users of the Platform, including registered account holders, visitors browsing without an account, and former players whose data is subject to retention obligations. By accessing the Website or registering an account, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy is to be read alongside — and forms an integral part of — our Terms & Conditions and Responsible Gaming Policy. Where a conflict arises between this Policy and those documents on matters of data privacy, this Policy shall prevail.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly. This includes your name, email address, phone number, payment details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of Processing. mp076 is the Data Controller for all Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of mp076, under documented instructions and contractual safeguards. Examples include KYC verification providers and payment gateway operators.
• "KYC" means Know Your Customer — the mandatory identity and age verification process conducted before withdrawal privileges are activated on a player's account.
• "Services" means the full range of betting, gaming, lottery, and support services available on the Platform, including sports betting, live casino, slots, and lottery products such as togel (Indonesia's traditional numbers lottery).

3 Information We Collect

3.1 Registration Data

When you create an account on the Platform, we collect: your full legal name, date of birth, email address, mobile phone number, and your chosen payment method. This information is required to open and maintain your account and to verify your eligibility to use the Services.

3.2 KYC and Identity Verification Data

To comply with anti-money laundering (AML) obligations and to verify your age, we collect copies of government-issued identity documents (such as KTP, SIM, or Passport), proof of residential address, and evidence of ownership of your deposit payment method. These documents are processed through our certified KYC verification partner and are encrypted at rest within our systems.

3.3 Financial and Transaction Data

We collect records of all deposit and withdrawal transactions, including the amount, date, time, and payment method used (e.g., BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, or LinkAja). We do not store full bank account numbers or e-wallet login credentials — only the last four digits and the institution name are retained for reference purposes.

3.4 Gameplay and Betting Activity

We maintain a complete record of your betting and gaming activity on the Platform, including wager amounts, game titles, bet outcomes, session timestamps, and bonus usage. This data is used to manage your account, resolve disputes, detect bonus abuse, and fulfil our regulatory record-keeping obligations.

3.5 Technical and Device Data

When you access the Platform, our servers automatically collect certain technical information: your IP address, browser type and version, operating system, device model, screen resolution, referring URL, and session duration. This data is used for platform security, fraud prevention, and aggregate traffic analytics. It is not used to build individual marketing profiles.

3.6 Communications Data

If you contact our support team, we retain a record of the communication — including emails, live-chat transcripts, and any attachments you submit — for a minimum of two years. This record enables us to track complaint resolution, maintain service quality, and provide context for any regulatory inquiry.

4 How We Use Your Information

mp076 processes your personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your registered account, including password resets and two-factor authentication support.
• Identity Verification: Conducting KYC checks to confirm your age, identity, and payment method ownership before processing withdrawals.
• Transaction Processing: Handling deposits and withdrawals via your selected Indonesian payment channel accurately and promptly.
• Regulatory Compliance: Meeting our anti-money laundering (AML), counter-terrorist financing (CTF), and record-keeping obligations under applicable international regulations.
• Fraud Prevention and Security: Detecting and preventing unauthorized account access, bonus abuse, collusion, match-fixing involvement, and other prohibited activities described in our Terms & Conditions.
• Customer Support: Responding to your enquiries, resolving disputes, and maintaining service quality records.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve the performance, reliability, and user experience of the Platform.
• Responsible Gaming: Monitoring gameplay patterns to identify potential problem gambling behavior and proactively offering self-exclusion, deposit limit, or time-out tools where warranted.
• Direct Communications: Sending you transactional notifications (deposit confirmations, withdrawal receipts, KYC status updates) and, where you have opted in, promotional communications about bonuses and events relevant to your account.

We do not use your personal data to make fully automated decisions — including automated profiling — that produce legal or similarly significant effects on you without human review being available upon request.

5 Legal Basis for Processing

mp076 relies on the following legal bases when processing your personal data:

• Contractual Necessity: Processing your registration data, transaction records, and KYC documentation is necessary to perform the contract between you and mp076 as set out in our Terms & Conditions. Without this processing, we cannot provide the Services.
• Legal Obligation: Certain processing activities — particularly AML record-keeping, KYC documentation retention, and reporting obligations — are required by applicable law and international regulatory standards. We have no discretion to limit or waive this processing.
• Legitimate Interests: We process technical data, gameplay records, and communications data to detect fraud, maintain platform security, resolve disputes, and improve the Platform. We have assessed that our legitimate interests in doing so do not override your fundamental privacy rights.
• Consent: Where we send you optional promotional communications (bonus offers, event alerts, seasonal promotions tied to events such as Idul Fitri, Ramadhan, or Indonesian Independence Day), we rely on your explicit opt-in consent. You may withdraw consent at any time by contacting our support team or updating your account notification preferences.

6 Data Sharing and Third Parties

6.1 Authorized Data Processors

mp076 shares your personal data only with carefully selected third-party processors that support the delivery of our Services. These processors act exclusively under our documented instructions and are contractually bound to maintain confidentiality and implement appropriate security measures. Categories of authorized processors include:

• KYC and identity verification service providers;
• Payment gateway operators and Indonesian banking partners (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja);
• Cloud infrastructure and data hosting providers operating under certified data security standards;
• Fraud detection and AML screening service providers;
• Customer support platform operators;
• Certified game content providers (e.g., Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, Microgaming, NetEnt), solely to the extent necessary for game session management.

6.2 Legal Disclosures

We may disclose your personal data to law enforcement agencies, financial intelligence units, or regulatory bodies where we are required to do so by a valid legal order, court order, or applicable regulation. In such circumstances we will, to the extent legally permissible, notify you of the disclosure.

6.3 No Sale of Personal Data

mp076 does not sell, rent, trade, or otherwise transfer your personal data to unaffiliated third parties for marketing, advertising, data brokerage, or any commercial purpose unrelated to the delivery of our Services. This prohibition is absolute and is not subject to exceptions based on anonymization or aggregation unless the data is genuinely irreversibly de-identified.

7 Data Retention

We retain your personal data only for as long as is necessary for the purposes described in this Policy or as required by applicable law. The following table outlines our standard retention periods by data category:

Data Category	Retention Period	Legal Basis
Account registration data	Duration of account + 5 years after closure	AML legal obligation
KYC identity documents	Duration of account + 5 years after closure	AML legal obligation
Financial transaction records	Duration of account + 7 years after closure	AML / financial regulation
Gameplay and betting history	Duration of account + 3 years after closure	Contractual / dispute resolution
Customer support communications	2 years from last interaction	Legitimate interests
Technical / device / IP logs	12 months from collection	Legitimate interests (security)
Marketing consent records	Until consent is withdrawn + 1 year	Consent

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted or irreversibly anonymized. Where anonymization is applied, the resulting dataset cannot reasonably be used to re-identify you and is therefore no longer subject to this Policy.

8 Security Measures

mp076 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your browser and our servers;
• AES-256 encryption for sensitive data at rest, including KYC documents and payment reference data;
• Role-based access controls ensuring that only authorized personnel with a documented business need can access Personal Data;
• Multi-factor authentication requirements for all staff with administrative access to production systems;
• Regular penetration testing and vulnerability assessments conducted by independent third-party security specialists;
• Intrusion detection and real-time anomaly monitoring across all production infrastructure;
• Formal data breach response procedures, including a commitment to notify affected users within 72 hours of confirming a breach that poses a risk to their rights and interests.

9 Your Rights as a Data Subject

As an individual whose personal data is processed by mp076, you are entitled to exercise the following rights at any time by submitting a written request to our Data Protection contact (see Section 13):

• Right of Access (Article 15): You may request confirmation of whether we process your personal data and, if so, receive a copy of that data along with supplementary information about how it is used.
• Right to Rectification (Article 16): If any personal data we hold about you is inaccurate or incomplete, you may request that we correct or supplement it without undue delay.
• Right to Erasure / "Right to Be Forgotten" (Article 17): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that certain data must be retained to satisfy AML and financial regulation obligations and cannot be erased on request.
• Right to Restriction of Processing (Article 18): You may request that we temporarily restrict processing of your data — for example, while the accuracy of data you have disputed is being verified.
• Right to Data Portability (Article 20): You may request that we provide your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV), and have that data transmitted directly to another controller where technically feasible.
• Right to Object (Article 21): You may object at any time to processing based on our legitimate interests. We will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We will respond to all verifiable data subject requests within 30 calendar days of receipt. In cases of complexity or high volume, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason within the initial 30-day window. There is no fee for submitting a data subject request unless the request is manifestly unfounded or excessive.

10 Cookies and Tracking Technologies

10.1 Types of Cookies We Use

mp076 uses the following categories of cookies on the Platform:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without preventing core functionality.
• Functional Cookies: Store your preferences such as language display settings, game volume, and layout choices so you do not need to reconfigure them on each visit.
• Analytics Cookies: First-party analytics cookies help us understand aggregate traffic patterns — which pages are most visited, where users encounter errors, and how session lengths vary across device types. These cookies do not collect personally identifying information and are never shared with advertising networks.

10.2 What We Do Not Use

mp076 does not deploy third-party advertising cookies, cross-site tracking pixels, social media retargeting tags, or any technology designed to build behavioral advertising profiles. We do not participate in real-time bidding (RTB) advertising ecosystems.

10.3 Managing Cookies

You may control cookie behavior through your browser settings. Blocking strictly necessary cookies will impair your ability to log in and use the Platform. Blocking functional or analytics cookies will not prevent access but may affect your experience. Instructions for managing cookies are available in the help documentation of all major browsers.

11 Minors and Age Restriction

The Platform is strictly intended for adults aged 21 years and over. mp076 does not knowingly collect, store, or process personal data belonging to individuals under the age of 21. Age is verified as part of the mandatory KYC process, and any account found to belong to an underage user is immediately closed and all associated personal data is deleted.

If you are a parent or guardian and believe that a minor has created an account on the Platform using false information, please contact us immediately at [email protected]. We will investigate and take appropriate action, including account closure and data deletion, as a matter of priority.

12 Amendments to This Policy

mp076 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable regulations, or Platform functionality. Where changes are material — such as a new category of data being collected or a new third-party processor being engaged — we will provide notice via email to your registered address and/or a prominent banner on the Website at least 14 days before the changes take effect.

Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with the revised Policy, you must cease using the Platform and may request account closure by contacting our support team.

13 Contact and Data Controller Details

mp076 is the Data Controller for all personal data processed through the Platform. If you wish to exercise any of your data subject rights, raise a concern about how your data is being handled, or submit a general privacy enquiry, please contact our Data Protection team using the details below. We are available 24 hours a day, 7 days a week (WIB), and aim to acknowledge all privacy-related requests within one business day.

Please include your registered email address, a description of your request, and any relevant account details in your message to help us locate your records and respond as efficiently as possible. We may need to verify your identity before processing certain requests in order to protect the security of your account.