Privacy Policy — mpo17

This Privacy Policy ("Policy") applies to all personal data processed by mpo17 (referred to throughout as "we", "us", or "our") in connection with the operation of the mpo17 online gaming platform accessible at mpo17.ws and any associated mobile-optimised interfaces or sub-domains (collectively, the "Platform").

This Policy applies to all individuals who visit, register on, or interact with the Platform — including prospective players browsing the site, registered Account Holders, and former Account Holders whose data we are required to retain for compliance purposes. It does not apply to the data-processing practices of third-party game suppliers, payment processors, or other external services accessed through the Platform, each of which operates under its own privacy framework.

By accessing the Platform or creating a mpo17 Account, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree with any aspect of this Policy, you should discontinue your use of the Platform immediately.

The following terms carry the meanings set out below wherever they appear in this Policy:

mpo17 collects Personal Data across several categories, depending on the nature of your interaction with the Platform. The categories and specific data points collected are detailed below:

mpo17 collects Personal Data through the following channels:

• Direct submission: Data you actively provide when registering an Account, completing the KYC process, submitting a deposit or withdrawal request, contacting support, or responding to a survey or promotion.
• Automated technical collection: Data gathered automatically as you interact with the Platform, including IP addresses, device fingerprints, cookie identifiers, and session activity logs. This collection occurs even during anonymous browsing sessions before account registration.
• Payment processors: When you initiate a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri) or e-wallet (OVO, DANA, GoPay), the relevant payment processor transmits a transaction confirmation and masked account reference to mpo17 to enable reconciliation.
• KYC verification providers: Where mpo17 uses a third-party identity verification service to cross-reference the documents you submit, that provider returns a verification result and confidence score to mpo17. The underlying document image is processed by the provider under their own privacy framework.
• Fraud and risk screening: mpo17 may receive data from third-party fraud-detection and anti-money-laundering screening services as part of our obligation to identify suspicious account activity.
• Publicly available sources: In limited circumstances related to KYC or fraud prevention, mpo17 may cross-reference data against publicly available government databases or commercially licensed identity data sources.

mpo17 processes your Personal Data only where a lawful basis exists for doing so. The table below maps each processing purpose to its corresponding legal basis:

mpo17 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. We disclose Personal Data only in the following circumstances and only to the extent strictly necessary:

• Game content providers: Studios such as Evolution Gaming, Pragmatic Play, Pocket Games Soft, Microgaming, Spribe, and NetEnt receive the minimum data required to initialise a game session (a pseudonymous player token and currency denomination). These providers do not receive your name, payment details, or government-issued ID.
• Payment processors and banks: Your account name and transaction reference are shared with the relevant Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) to process your deposit or withdrawal instruction.
• KYC and fraud prevention providers: Identity documents and verification data are shared with licensed third-party KYC providers under strict data processing agreements.
• Legal and regulatory authorities: mpo17 will disclose Personal Data to law enforcement, regulatory bodies, or courts where required by a lawful order, warrant, or statutory obligation. We will notify you of such disclosure where legally permitted to do so.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of mpo17's assets, your Personal Data may be transferred to the acquiring entity, which will be bound by the same data protection obligations as set out in this Policy.
• Professional advisers: Lawyers, auditors, and compliance consultants engaged by mpo17 may access Personal Data on a need-to-know, confidential basis to provide their professional services.

mpo17 operates as an internationally licensed gaming platform. Some of the third-party processors engaged by mpo17 — including certain game content providers and KYC verification platforms — are headquartered or operate server infrastructure outside Indonesia. When your Personal Data is transferred to a jurisdiction that does not offer the same level of data protection as Indonesia's prevailing personal data protection framework, mpo17 applies the following safeguards:

• Execution of data processing agreements incorporating internationally recognised standard contractual clauses or equivalent binding transfer mechanisms.
• Restricting the data transferred to the minimum necessary for the specific processing purpose.
• Requiring the receiving entity to maintain security standards equivalent to those described in Section 10 of this Policy.
• Verifying that the receiving entity does not onward-transfer the data to sub-processors without mpo17's prior written consent.

You may request further information about the specific safeguards applied to any international transfer by contacting our support team at [email protected].

mpo17 retains Personal Data for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by law or licensing conditions. The following standard retention periods apply:

When the applicable retention period expires, Personal Data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Anonymised data derived from your account activity may be retained in aggregate form for statistical and product improvement purposes without limitation.

mpo17 uses cookies and similar tracking technologies to operate the Platform efficiently, remember your preferences, secure your session, and understand how players interact with the Platform. The categories of cookies used are as follows:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, security cookies that detect fraudulent login attempts, and load-balancing cookies. These cannot be disabled without rendering the Platform unusable.
• Functional Cookies: Remember your preferences such as preferred game category, display language, and responsible gaming limit settings. Disabling these cookies will result in the loss of personalised settings between sessions.
• Analytics Cookies: Used to collect aggregate statistics about how pages are accessed and which features are used, enabling mpo17 to improve Platform performance and game selection. Data collected is pseudonymous and not linked to your registered identity unless you are logged in.
• Marketing and Attribution Cookies: Used to record which promotional channel or campaign directed you to the mpo17 Platform, enabling mpo17 to evaluate the effectiveness of marketing spend. These cookies do not track your activity on third-party websites.

You may manage your cookie preferences through your browser settings. Note that disabling all cookies may impair certain Platform functions including session persistence and game loading. mpo17 does not use third-party advertising network cookies that track your activity across unrelated websites.

mpo17 implements a multi-layered security architecture to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our technical and organisational security measures include:

• 256-bit SSL/TLS encryption on all data in transit between your device and mpo17's servers.
• AES-256 encryption at rest for all sensitive data stored in mpo17's databases, including KYC documents and financial records.
• Bcrypt password hashing with individual salting — plaintext passwords are never stored or accessible to mpo17 staff.
• Role-based access control (RBAC) — mpo17 employees access Personal Data only to the extent required by their specific job function, and all access is logged and subject to periodic audit.
• Real-time anomaly detection — automated systems monitor for unusual login patterns, multiple failed authentication attempts, and suspicious transaction sequences, triggering account locks and security alerts where thresholds are breached.
• Regular third-party security audits and penetration testing conducted by independent cybersecurity firms on a minimum annual basis.
• Incident response procedures — in the event of a confirmed data breach affecting your Personal Data, mpo17 will notify affected players and relevant authorities within the timeframes required by applicable law.

As a Data Subject, you hold the following rights in relation to your Personal Data held by mpo17. Requests to exercise any of these rights should be directed to [email protected]. mpo17 will acknowledge all requests within 5 business days and provide a substantive response within 30 calendar days.

• Right of Access: You may request a copy of all Personal Data mpo17 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: If any Personal Data mpo17 holds about you is inaccurate or incomplete, you may request that it be corrected or updated. Account details such as email address and phone number can be updated directly from your Account profile.
• Right to Erasure ("Right to be Forgotten"): You may request that mpo17 delete your Personal Data. Note that this right is subject to exceptions where mpo17 is legally required to retain data — for example, transaction records subject to AML retention obligations cannot be deleted on request during the mandatory retention period.
• Right to Restriction of Processing: You may request that mpo17 pause processing of your Personal Data while a rectification or erasure request is being assessed, or where you have objected to a processing activity based on legitimate interests.
• Right to Data Portability: You may request a machine-readable copy of the Personal Data you provided to mpo17 (account profile data and transaction history) for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing of your Personal Data based on mpo17's legitimate interests, including profiling for personalised promotional content. If you opt out of marketing communications, mpo17 will stop sending promotional emails and SMS messages within 5 business days.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing opt-in), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

The mpo17 Platform is strictly intended for adults aged 21 and over. mpo17 does not knowingly collect Personal Data from any person under the age of 21. The Platform employs automated age-verification checks at registration and mandatory KYC document verification before any withdrawal is processed.

If mpo17 discovers or is notified that an Account has been registered by a person under 21 years of age, the Account will be permanently closed immediately, all gaming activity associated with the Account will be voided, deposited funds will be returned to the payment source on record, and all Personal Data associated with the Account will be permanently deleted within 30 days of the discovery — except for any records that mpo17 is legally required to retain to document the remediation action.

If you believe that a minor has accessed or registered on the mpo17 Platform, please contact us immediately at [email protected] with the relevant details so that we can take prompt action.

The mpo17 Platform may contain references to third-party services — such as game content providers, payment platforms, and sports data feeds — that operate independently of mpo17 and are governed by their own privacy policies. mpo17 is not responsible for the data practices of any third-party service, and the inclusion of a reference to a third-party service on the Platform does not constitute mpo17's endorsement of that service's privacy practices.

We encourage you to review the privacy policies of any third-party service you access in connection with your use of the mpo17 Platform, including the privacy policies of your chosen Indonesian bank (BCA, BRI, BNI, Mandiri) or e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja) when making payment transactions.

mpo17 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made — defined as changes that substantively alter the categories of data collected, the purposes for which data is used, or the rights available to Data Subjects — mpo17 will notify registered players by email at least 14 days before the updated Policy takes effect.

The "Effective Date" displayed at the top of this page will be updated each time a new version is published. We recommend that you review this Policy periodically. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you must close your Account before the effective date of the change.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mpo17 processes your Personal Data, please contact our support team through any of the following channels:

• Live Chat: Available 24/7 directly from the mpo17 Platform. Average response time: under 2 minutes. Native Indonesian-speaking agents are available at all hours.
• Email: [email protected] — responses within 24 hours for general queries; priority handling for data rights requests and security concerns.

All formal data rights requests (access, rectification, erasure, portability) must be submitted in writing via email and will be acknowledged within 5 business days. A full written response will be provided within 30 calendar days of acknowledgement. In complex cases where an extension is required, mpo17 will notify you within the initial 30-day window and provide an estimated completion date.