Privacy Policy

1Introduction & Scope

This Privacy Policy ("Policy") describes how mp007 ("we", "us", "our") collects, uses, stores, shares, and protects personal data in connection with the online gaming and sports-betting platform accessible at mp007.cam (the "Platform").

This Policy applies to:

• All registered player accounts on the mp007 Platform, including accounts created by Indonesian residents accessing the service;
• All visitors to the mp007 website, regardless of whether they complete registration;
• All interactions with mp007's customer support team via live chat, email, or any other channel.

This Policy should be read together with the Terms & Conditions and the Responsible Gaming Policy, both of which are incorporated by reference. By using the mp007 Platform, you confirm that you have read and understood this Policy.

2Data Controller

For the purposes of applicable data protection law, the data controller responsible for your personal data is the entity operating mp007 under its international gaming license (the "Operator"). The Operator is the entity that determines the purposes and means of processing your personal data collected through the Platform.

For all data-related enquiries, correction requests, access requests, and formal complaints, the designated contact is:

3Data We Collect

mp007 collects personal data in the following categories. All collection is proportionate to the purpose for which the data is required:

mp007 does not collect or process sensitive personal data (also known as special-category data) such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where the provision of a government-issued ID photograph is necessary for KYC identity verification as required by our AML obligations.

4How We Collect Data

mp007 collects personal data through the following methods:

1. Direct Submission: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, contacting customer support, or completing any in-platform form.
2. Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers, session data, page interaction data, and cookie-based identifiers. See Section 10 for full cookie details.
3. Payment Processors: Transaction confirmation data received from Indonesian banking partners (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) when you initiate a deposit or withdrawal.
4. Identity Verification Services: Confirmation signals from third-party KYC verification partners when processing your identity documents. These partners process data under strict confidentiality agreements with mp007.
5. Security and Fraud Prevention Systems: Behavioral data and device fingerprint signals collected for the purpose of detecting unauthorized account access, bonus abuse, and money-laundering activity.

5Purposes & Legal Basis for Processing

mp007 processes your personal data only where a valid legal basis exists. The following table summarizes our principal processing activities:

6Sharing Your Personal Data

mp007 does not sell your personal data. We share data only in the following limited circumstances, and only to the extent necessary for each purpose:

1. Payment Service Providers: Indonesian banking partners (BCA, BRI, BNI, Mandiri) and e-wallet platforms (OVO, DANA, GoPay) receive transaction data necessary to process deposits and withdrawals. These providers are bound by their own regulatory privacy obligations and by contractual data-processing agreements with mp007.
2. KYC Verification Partners: Specialist identity-verification service providers process your KYC documents for the purpose of age and identity verification. These providers act under strict data-processing agreements and are not permitted to use your data for any purpose other than verification.
3. Technology Infrastructure Providers: Cloud hosting, CDN, and security service providers that support platform operation. Data shared is limited to what is technically necessary, and all providers are bound by confidentiality agreements.
4. Regulatory and Law Enforcement Authorities: mp007 may disclose personal data to competent regulatory, tax, or law-enforcement authorities where required by applicable law, a court order, or our gaming license conditions. We will notify you of such disclosure where legally permitted to do so.
5. Business Transfers: In the event of a merger, acquisition, or sale of the business, personal data may be transferred to the acquiring entity, subject to equivalent data-protection commitments. Players will be notified in advance of any such transfer.

In all cases where data is shared with third parties, mp007 maintains records of the sharing arrangement and conducts appropriate due diligence on the recipient's data-protection practices.

7International Data Transfers

mp007's platform infrastructure includes services provided by technology partners located in multiple countries. As a result, personal data collected from Indonesian players may be stored or processed in jurisdictions outside Indonesia, including the jurisdiction in which mp007 holds its gaming license.

Where personal data is transferred internationally, mp007 ensures that:

• The transfer is made only to countries or recipients that provide an adequate level of data protection as assessed by mp007's compliance team;
• Appropriate contractual safeguards — including standard data-processing clauses — are in place with all third-party recipients; and
• Technical security measures (encryption, access controls) are maintained regardless of the geographic location of data storage.

You may request information about specific international transfer mechanisms applied to your data by contacting [email protected].

8Data Retention

mp007 retains personal data for as long as is necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in a manner that makes re-identification impossible. Data subject to ongoing legal proceedings or regulatory investigations may be retained beyond standard retention periods for the duration of such proceedings.

9Security Measures

mp007 implements a layered security architecture to protect your personal data against unauthorized access, loss, alteration, or disclosure. Key security measures include:

• Transport Security: All data transmitted between your device and mp007 servers is encrypted using TLS 1.2 or TLS 1.3 (256-bit encryption). HTTP connections are automatically redirected to HTTPS.
• Data-at-Rest Encryption: Sensitive personal data and financial records stored on mp007 infrastructure are encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a need-to-know basis. Staff members are granted the minimum level of access required for their role. Access privileges are reviewed quarterly.
• Two-Factor Authentication: Administrative access to systems storing personal data requires multi-factor authentication. Players may also enable two-factor authentication on their own accounts.
• Segregated Storage: Player funds and KYC documents are stored in segregated, access-controlled environments separate from operational systems.
• Annual Security Audits: Independent penetration testing and vulnerability assessments are conducted at least annually by qualified third-party security firms.
• Incident Response: mp007 maintains a documented data-breach response procedure. In the event of a material security incident affecting player data, affected players will be notified within 72 hours of mp007 becoming aware of the breach, including the nature of the incident and steps taken to mitigate harm.

10Cookies & Tracking Technologies

mp007 uses cookies and similar technologies to enable core platform functionality, remember your preferences, and analyze aggregate usage patterns. The following categories of cookies are used:

1. Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cookies cannot be disabled without impairing platform functionality.
2. Functional Cookies: Remember your preferences such as language settings, preferred currency display (IDR/Rp), and login persistence. These improve your experience but are not essential to core functionality.
3. Analytics Cookies: Used to collect aggregated, anonymized data about how players navigate the Platform — which pages are visited, how long sessions last, and which features are used most. This data informs product improvements. No individual player is identified in analytics reports.

mp007 does not use:

• Third-party advertising or behavioral tracking cookies;
• Social media tracking pixels;
• Cross-site tracking technologies that follow your behavior outside the mp007 Platform.

You may control cookie behavior through your browser settings. Disabling strictly necessary cookies may impair your ability to log in or use core platform features. Disabling analytics cookies does not affect your ability to use the Platform.

11Your Data Rights

Subject to applicable law and the limitations described below, you have the following rights with respect to your personal data held by mp007:

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request — [Your Name]." We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where a request cannot be fully accommodated due to legal obligations, we will explain the limitation in writing.

12Children & Minors (Under 21)

The mp007 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from individuals under the age of 21, and we do not permit anyone under 21 to register an account or participate in any betting or gaming activity.

Age verification is a mandatory step in the KYC process. Where mp007 becomes aware that personal data has been collected from an individual under 21 — whether through registration, a parental complaint, or any other means — the account will be immediately closed, all associated data will be securely deleted (except where legal retention obligations require otherwise), and any deposited funds will be returned to the originating payment method after standard identity checks.

If you believe a minor has registered an account on mp007 without authorization, please contact us immediately at [email protected].

13Third-Party Services & Links

The mp007 Platform may reference or link to third-party services in certain operational contexts (for example, payment gateway redirects during deposit processing). This Privacy Policy applies solely to data processed by mp007 directly. Any data submitted to or collected by third-party services — including Indonesian payment partners such as BCA, BRI, BNI, Mandiri, OVO, and DANA — is governed by the privacy policies of those respective services.

mp007 conducts due diligence on all third-party service providers before engagement, including review of their data-protection practices. However, mp007 cannot be held responsible for the data practices of independent third parties once data leaves mp007's processing environment.

Game content provided through certified third-party studio integrations is subject to the studio's own compliance with applicable gaming and data regulations. All studios integrated on mp007 are required to meet minimum security and data-handling standards as a condition of integration.

14Updates to This Policy

mp007 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or regulatory guidance. When material changes are made, we will notify registered players via:

• A prominent notice displayed on the Platform for a minimum of 14 days prior to the effective date of the change; and / or
• An email notification to your registered email address.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. Your continued use of the mp007 Platform after the effective date of a revised Policy constitutes acceptance of the updated terms.

Minor clarifications or typographic corrections that do not materially alter your rights may be made without prior notice. Such corrections are identified by an updated "Last Updated" date.

We encourage you to review this Policy periodically. Previous versions of the Policy are available on request by contacting [email protected].

15Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or mp007's data practices, please contact our Privacy & Compliance Team using the details below. Note that email addresses are displayed as plain text — they are not clickable links.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. mp007 will cooperate fully with any regulatory investigation into our data practices.

This Privacy Policy was last reviewed and approved on 1 January 2026. The version displayed on this page supersedes all previous versions.