Privacy Policy

2.1 Information You Provide Directly

When you register an account, complete the KYC process, contact customer support, or participate in promotions, you voluntarily provide us with Personal Data including:

• Full legal name as it appears on your Indonesian KTP (identity card) or other government-issued identification document.
• Date of birth, to verify that you meet the minimum age requirement of 21 years.
• Residential address in Indonesia (province, city/kabupaten, postal code).
• Valid email address used for account notifications and communications.
• Active Indonesian mobile phone number for OTP verification and support contact.
• Bank account details (bank name, account number, account holder name) for deposit and withdrawal processing — accepted banks include BCA, BRI, BNI, and Mandiri.
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay) where used as your payment method.
• KTP scan or photograph and selfie submitted during KYC verification.
• Communications you send to our customer support team via live chat, WhatsApp, or email.

2.2 Information Collected Automatically

When you access or interact with the mpo606 Platform, our servers and analytics tools automatically record certain technical information:

• IP address and approximate geographic location derived therefrom.
• Device type, operating system, browser type and version, and screen resolution.
• Pages visited, features used, time spent on each page, clickstream data, and navigation paths through the Platform.
• Date and time of each Platform visit and session duration.
• Referral URL (the webpage from which you arrived at our Platform, if applicable).
• Transaction history, including deposit amounts, withdrawal requests, bets placed, games played, and bonus usage.
• Session logs and game-round data for dispute resolution and fraud prevention purposes.

2.3 Cookies and Tracking Technologies

mpo606 uses cookies, web beacons, and similar technologies to operate and improve the Platform. Cookies serve the following purposes: authenticating your logged-in session; remembering your language and display preferences; preventing fraud by identifying unusual access patterns; and generating aggregated analytics that help us understand how users interact with our service. You may configure your browser to block or delete cookies, but doing so may impair certain Platform functions including session persistence and security features. We do not use tracking technologies to serve targeted advertisements on third-party websites.

4.1 Service Providers

We engage trusted third-party service providers to assist in operating the mpo606 Platform. These providers act solely on our documented instructions and are prohibited from using your data for their own purposes. Categories of service providers include:

• Payment processors and banking partners (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay) — for transaction processing.
• Game software providers (Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and others) — who may receive session-level data to deliver game services.
• Identity verification and KYC technology providers — who process identity document data solely to confirm your identity and age.
• Hosting and cloud infrastructure providers — who store data on secured servers.
• Fraud detection and cybersecurity vendors — who analyze device and behavioral signals to identify suspicious activity.
• Customer support platform providers — who facilitate live chat and ticketing systems.

4.2 Legal and Regulatory Disclosure

mpo606 may disclose Personal Data to governmental authorities, law enforcement agencies, financial intelligence units, or other regulatory bodies where we are legally required to do so, or where disclosure is necessary to: protect the rights or safety of mpo606, our users, or the public; investigate or prevent fraud, money laundering, or other illegal activity; comply with a legally binding court order, subpoena, or equivalent legal process; or enforce our Terms and Conditions or other agreements.

4.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all assets of mpo606, your Personal Data may be transferred to the acquiring entity as part of that transaction. We will provide you with notice prior to the transfer taking effect and will ensure the acquiring entity is bound by privacy standards at least equivalent to those described in this Policy.

4.4 No Sale of Personal Data

mpo606 does not sell, rent, or trade your Personal Data to third parties for their independent marketing or commercial purposes under any circumstances. Any sharing of data described in this Policy is strictly for the operational purposes outlined above.

5.1 Retention Periods

We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply as a general guide:

• Account and identity data — retained for the duration of your account and for a minimum of five (5) years following permanent account closure, to meet anti-money laundering record-keeping requirements.
• Transaction records — retained for a minimum of five (5) years from the date of each transaction.
• KYC documents — retained for the duration of your account plus five (5) years, or as required by applicable regulation.
• Customer support communications — retained for three (3) years from the date of the interaction.
• Session and game logs — retained for two (2) years for dispute resolution and fraud prevention purposes.
• Marketing preferences and consent records — retained until you withdraw consent, plus one (1) year thereafter to evidence the consent history.
• Cookies and analytics data — aggregated and anonymised data may be retained indefinitely; individual session data is deleted within thirteen (13) months.

Once the applicable retention period has expired, we securely delete or irreversibly anonymise your Personal Data so that it can no longer be attributed to you.

6.1 Technical and Organisational Measures

mpo606 implements industry-standard technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL (Secure Socket Layer) encryption for all data transmitted between your device and our servers.
• Encryption of sensitive data fields (including financial account numbers and identity document images) at rest using AES-256 encryption.
• Role-based access controls ensuring that only authorised personnel with a legitimate need can access identifiable Personal Data.
• Multi-factor authentication required for all administrative access to production systems.
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• Intrusion detection and 24/7 network monitoring to identify and respond to anomalous activity.
• Documented incident response procedures, including breach notification processes.

6.2 Your Responsibilities

While we take every reasonable precaution to secure your data, no transmission over the internet is completely risk-free. You share responsibility for the security of your account by keeping your login credentials confidential, using a strong and unique password, logging out of your account when using shared or public devices, and notifying us immediately at [email protected] if you suspect unauthorised access to your account.

6.3 Data Breach Notification

In the event of a confirmed data breach that is likely to result in a high risk to your rights and freedoms, mpo606 will notify affected users without undue delay, providing details of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures we have taken or propose to take to address it. Notification will be made via email to the address registered on your account.

7.1 Right of Access

You have the right to request confirmation of whether mpo606 processes Personal Data relating to you, and if so, to receive a copy of that data along with information about the purposes of processing, the categories of data involved, the recipients to whom it has been disclosed, and the retention period applied.

7.2 Right to Rectification

If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated. For account details such as your email address or phone number, you may update these directly within your account settings. For identity data submitted during KYC, please contact support with updated documentation.

7.3 Right to Erasure

You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where the data has been unlawfully processed. This right is subject to limitations where retention is required by law (for example, financial transaction records required under anti-money laundering regulations cannot be deleted on request).

7.4 Right to Restriction of Processing

You may request that we restrict the processing of your Personal Data in circumstances where you contest its accuracy (pending verification), where processing is unlawful but you prefer restriction over erasure, where we no longer need the data but you require it for the establishment or exercise of legal claims, or where you have objected to processing pending verification of our legitimate grounds.

7.5 Right to Data Portability

Where processing is based on your consent or on contract performance, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format (such as CSV or JSON), and to transmit it to another data controller of your choosing. This right covers data you have provided to us directly, such as your account profile information and transaction history.

7.6 Right to Object

You have the right to object at any time to the processing of your Personal Data for direct marketing purposes, including profiling for marketing purposes. Where you exercise this right, we will cease processing your data for those purposes immediately. You may also object to processing carried out on the basis of our legitimate interests, in which case we will cease unless we can demonstrate compelling legitimate grounds that override your interests.

7.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, use the unsubscribe link in any marketing email or contact our support team directly.