Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how mpotop ("Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://mpotop.cam, collects, processes, stores, shares, and protects personal information about users ("User", "Player", "you", "your") who access or use our Services.

This Policy applies to all personal data collected through the mpotop website, any mobile-optimised version of our Platform, customer support communications, marketing interactions, and any other touchpoints between you and mpotop. It covers Indonesian players and all other individuals whose data we handle in connection with our Services.

By registering an Account with mpotop or continuing to use our Services, you acknowledge that you have read, understood, and accepted the data practices described in this Policy. If you do not agree with this Policy, please do not use our Platform or Services.

mpotop is committed to handling personal data responsibly, lawfully, and transparently. This Policy is drafted in accordance with internationally recognised data protection principles, including the General Data Protection Regulation (GDPR) framework principles, where applicable, and the data protection obligations associated with our international gaming licence.

2. Personal Data We Collect

mpotop collects personal data through several channels, including direct submissions by you during registration and Account management, automatic collection during your use of the Platform, and from third-party sources where permitted.

2.1 Data You Provide Directly

When you register an Account, make deposits or withdrawals, contact customer support, or respond to promotional communications, you may provide us with:

• Identity Data: Full legal name (as it appears on your KTP), date of birth, and gender.
• Contact Data: Email address, Indonesian mobile phone number, and residential address.
• Verification Data: Copies of your Indonesian National Identity Card (KTP), and in some circumstances additional documents such as a selfie photograph for facial verification during KYC review.
• Financial Data: Bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, or BSI account numbers), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction history.
• Account Credentials: Username and hashed password used to access your Account.
• Communications Data: Records of your interactions with our customer support team via live chat, email, or other channels.
• Preference Data: Gaming preferences, promotional opt-in choices, and responsible gaming limit settings you configure within your Account.

2.2 Data We Collect Automatically

When you access or use the mpotop Platform, we automatically collect certain technical and behavioural data, including:

• Device and Access Data: IP address, device type and model, operating system and version, browser type and version, and device identifiers.
• Usage Data: Pages visited, features accessed, games played, bets placed, session duration, click-stream data, and other interactions with the Platform.
• Location Data: Approximate geographic location derived from your IP address, used to comply with geographic access restrictions and regulatory requirements.
• Technical Logs: Server logs recording access times, error logs, and security event records.
• Cookie and Tracking Data: Information stored by or retrieved from your browser via cookies and similar technologies, as further described in Section 7 of this Policy.

2.3 Data from Third Parties

We may receive personal data about you from third-party sources, including:

• Payment processors and Indonesian banks, confirming the status of deposit and withdrawal transactions.
• Identity verification service providers used to authenticate KYC documentation.
• Fraud detection and anti-money laundering screening services that cross-reference your information against sanctions lists and fraud databases.
• Analytics providers that help us understand Platform usage patterns at an aggregate level.

3. How We Use Your Personal Data

mpotop uses your personal data for the following purposes, each grounded in a legitimate legal basis:

Purpose	Data Categories Used	Legal Basis
Account registration and management	Identity, Contact, Credentials	Contract performance
KYC identity verification and age confirmation (21+)	Identity, Verification	Legal obligation
Processing deposits and withdrawals	Financial, Identity	Contract performance
Anti-money laundering and fraud prevention	Financial, Usage, Device	Legal obligation; Legitimate interest
Providing and improving gaming services	Usage, Preference, Device	Contract performance; Legitimate interest
Customer support communications	Identity, Contact, Communications	Contract performance
Responsible gaming monitoring and intervention	Usage, Financial, Preference	Legal obligation; Legitimate interest
Promotional communications (with consent)	Contact, Preference	Consent
Platform security and abuse prevention	Device, Usage, Technical Logs	Legitimate interest
Regulatory reporting and legal compliance	Identity, Financial	Legal obligation

3.1 Marketing Communications

If you have opted in to receive marketing communications, mpotop may send you promotional emails, SMS messages, or in-Platform notifications about bonuses, special offers, and gaming news. You may withdraw your marketing consent at any time by updating your communication preferences within your Account settings or by contacting our support team. Withdrawal of marketing consent does not affect our ability to send essential transactional communications relating to your Account.

4. Sharing Your Personal Data

mpotop does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

4.1 Service Providers and Data Processors

We engage carefully selected third-party service providers who process personal data on our behalf under binding data processing agreements. These providers include:

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) to execute deposit and withdrawal transactions.
• KYC Verification Providers: Identity verification specialists who authenticate copies of KTP and other documents against authoritative data sources.
• Fraud and AML Screening Services: Providers that screen user information against sanctions lists, politically exposed persons databases, and fraud intelligence networks.
• IT Infrastructure Providers: Cloud hosting, content delivery, and database management services that store and process Platform data on our behalf.
• Customer Communication Platforms: Live chat and email platforms that facilitate customer support interactions.
• Analytics Providers: Services that generate aggregate, anonymised reports on Platform usage to help us improve the user experience.

4.2 Regulatory and Legal Disclosures

mpotop may disclose personal data to governmental authorities, regulators, law enforcement agencies, or courts when required to do so by applicable law, court order, or regulatory direction. Such disclosures may include information shared in connection with anti-money laundering investigations, fraud prosecution, or licensing compliance audits. Where legally permissible, we will notify you of such disclosure requests.

4.3 Business Transfers

In the event that mpotop undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, your personal data may be transferred to the successor entity as part of that transaction. We will notify registered users of any such transfer via email or Platform notice, and the successor entity will be required to honour the commitments made in this Privacy Policy.

4.4 International Data Transfers

mpotop operates internationally, and your personal data may be transferred to and processed in countries outside Indonesia. Where such transfers occur, we implement appropriate safeguards — including standard contractual clauses and data processing agreements — to ensure your data receives an equivalent level of protection as it would under Indonesian data protection standards. We do not transfer personal data to jurisdictions that lack adequate data protection frameworks without implementing compensating controls.

5. Data Security

mpotop takes the security of your personal data seriously and has implemented a comprehensive set of technical and organisational controls designed to protect against unauthorised access, disclosure, alteration, and destruction. Our security measures include:

• Transport Layer Security: All data transmitted between your device and mpotop servers is encrypted using 256-bit SSL/TLS encryption, preventing interception during transit.
• Database Encryption: Personal data stored in our databases is encrypted at rest using AES-256 encryption. Financial data and identity documents are stored in dedicated, access-restricted vaults.
• Access Controls: Internal access to personal data is governed by role-based access control (RBAC) policies. Only personnel with a demonstrated operational need may access identifiable personal data, and all access is logged and regularly audited.
• Two-Factor Authentication: Account access can be protected with two-factor authentication (2FA) to prevent unauthorised logins even if your password is compromised.
• Penetration Testing: Our Platform and infrastructure undergo regular third-party penetration testing and vulnerability assessments to identify and remediate security weaknesses proactively.
• Incident Response: We maintain a documented security incident response plan. In the event of a data breach affecting your rights and freedoms, we will notify you and relevant authorities within legally required timeframes.

6. Cookies and Similar Technologies

mpotop uses cookies and similar browser-based technologies to operate the Platform, personalise your experience, and analyse usage patterns. A cookie is a small text file placed on your device by a website you visit. We use the following categories of cookies:

Cookie Type	Purpose	Duration
Strictly Necessary	Session management, authentication, fraud prevention, and core Platform functionality. These cookies cannot be disabled without breaking core features.	Session / up to 30 days
Functional	Storing your language preferences, display settings, and responsible gaming limit configurations so they persist between sessions.	Up to 12 months
Analytical	Aggregate, anonymised traffic analytics helping us understand which features are used, identify technical issues, and improve the Platform experience.	Up to 24 months

mpotop does not deploy third-party advertising or behavioural targeting cookies. You may control cookie settings through your browser preferences. Disabling strictly necessary cookies may impair core Platform functionality, including Account login and payment processing. Disabling analytical cookies will not affect your ability to use the Platform but will limit our ability to improve the service based on usage data.

7. Your Data Rights

Subject to applicable law, you have the following rights in relation to the personal data mpotop holds about you. To exercise any of these rights, please contact our support team using the details in Section 10.

7.1 Right of Access

You have the right to request a copy of the personal data mpotop holds about you, along with information about how it is used, who it has been shared with, and how long it will be retained. We will provide this information free of charge within 30 business days of a verified request.

7.2 Right to Rectification

If personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update many details directly within your Account settings. For changes to identity or verification data, please contact our support team and provide documentary evidence of the correct information.

7.3 Right to Erasure

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where you object to processing based on legitimate interests and those interests are overridden. Please note that we may be required by law to retain certain categories of data — particularly financial transaction records and KYC documentation — for specified periods even after Account closure, in which case we cannot fulfil erasure requests for that data until the mandatory retention period has elapsed.

7.4 Right to Restrict Processing

In certain circumstances, you may request that we suspend processing of your personal data while a dispute regarding its accuracy or lawfulness is resolved. During restriction, we will continue to store your data but will not actively process it except where required by law.

7.5 Right to Data Portability

Where we process your personal data on the basis of your consent or for the performance of a contract, you may request that we provide your data in a structured, commonly used, machine-readable format (such as CSV or JSON) so that you can transfer it to another service provider. This right applies to data you have actively provided to us.

7.6 Right to Object

You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis, including profiling for responsible gaming monitoring or fraud detection purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

7.7 Right to Withdraw Consent

Where processing is based on your consent (for example, marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can manage your consent preferences within your Account settings or by contacting our support team.

8. Data Retention

mpotop retains personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable laws and regulations. Our standard retention periods are as follows:

• Active Account Data: Retained for the full duration of your Account relationship with mpotop, plus an additional period after closure as required by law.
• Financial Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, in compliance with international anti-money laundering regulations and standard financial record-keeping requirements.
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years following Account closure or the completion of the relevant transaction, in accordance with AML compliance obligations.
• Customer Support Records: Retained for three (3) years from the date of the interaction to facilitate quality assurance, dispute resolution, and regulatory review.
• Marketing Consent Records: Retained for the duration of your marketing consent, plus two (2) years thereafter to demonstrate compliance with consent requirements.
• Technical and Access Logs: Retained for twelve (12) months to support security monitoring and incident investigation.
• Analytical Cookie Data: Retained in anonymised, aggregated form for up to twenty-four (24) months.

Upon expiration of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures. Where data must be retained beyond your Account closure due to legal obligations, it is stored in a restricted archive with access limited to compliance personnel only.

9. Minors and Under-21 Policy

mpotop's Services are strictly intended for individuals who are at least twenty-one (21) years of age. We do not knowingly collect personal data from individuals under the age of 21. Our KYC verification process is specifically designed to confirm the age of all registering users before granting full Account access and withdrawal privileges.

If we become aware that we have inadvertently collected personal data from an individual under 21, we will immediately suspend the associated Account, forfeit any funds obtained in breach of our age requirements, delete all associated personal data that we are not legally required to retain, and take appropriate steps to prevent future underage access.

Parents and guardians who believe that a minor under their care may have registered with mpotop are encouraged to contact our support team immediately at [email protected] so that appropriate action can be taken without delay.

10. Contact and Data Enquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way mpotop handles your personal data, please contact our dedicated support and data team through the following channels:

• Email: [email protected] — monitored 24 hours a day, seven days a week. Average email response time is 2–4 hours.
• Live Chat: Available directly through the mpotop Platform, 24/7, with an average first response time of under 60 seconds. Our Indonesian-speaking agents are available at all hours.

When contacting us regarding a data rights request, please include your full registered name, the email address associated with your Account, and a clear description of the request or concern. For identity-sensitive requests such as data access or erasure, we may require verification of your identity before proceeding.

We are committed to resolving all privacy-related enquiries promptly and transparently. If you are not satisfied with our response, you retain the right to escalate the matter to the relevant data protection authority or seek legal remedy through applicable dispute resolution mechanisms.