Privacy Policy

Definitions

Throughout this Privacy Policy, the following terms carry the meanings set out below:

• "mp500" / "we" / "us" / "our" — the mp500 online gambling platform and its operating entity, responsible for determining how your personal data is collected and processed.
• "Player" / "you" / "your" — any individual who visits mp500.ws, registers an account, or uses any service provided by the platform.
• "Personal Data" — any information that identifies or could reasonably be used to identify you as an individual, including your name, email address, phone number, national identity number, bank account details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. For the purposes of this policy, mp500 is the Data Controller.
• "Data Processor" — a third party that processes Personal Data on behalf of mp500, such as a payment provider or cloud infrastructure vendor, acting under mp500's documented instructions.
• "KYC" — Know Your Customer; the identity and document verification process required to activate full account functionality and process withdrawals.
• "Cookie" — a small text file stored on your device by a website, used to remember preferences and support analytics.

Data We Collect

mp500 collects the following categories of Personal Data. We collect only what is genuinely necessary for the purposes described in Section 4.

We do not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, or health information, except where such information is volunteered by you in the context of a responsible gaming support request. In that case, it is used solely to provide you with appropriate assistance and is not shared with third parties beyond what is strictly necessary.

How We Collect Data

mp500 collects Personal Data through the following channels:

• Direct registration: When you create an account on mp500.ws, you provide your name, date of birth, email address, and phone number directly through the registration form.
• KYC document submission: When you submit identity documents (KTP, passport, driver's licence) and proof-of-payment screenshots to complete the verification process, we collect the data contained in those documents.
• Financial transactions: When you make a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction records are generated and retained by both the payment provider and mp500.
• Platform activity: Technical and usage data is collected automatically as you browse mp500.ws, log in, play games, and interact with features. This collection is carried out via server logs, session tracking scripts, and first-party cookies.
• Customer support: When you contact the mp500 support team by email or live chat, the content of your message, your account details, and any attachments you send are collected and stored as part of your support record.
• Third-party sources: We may receive data about you from our licensed game studio partners (Pragmatic Play, Evolution Gaming, Microgaming, PG Soft, Spribe, NetEnt) for the purpose of resolving disputed game rounds, and from fraud-prevention and identity-verification services used during the KYC process.

Purposes of Processing

mp500 processes your Personal Data for the following defined purposes. We do not use your data for any purpose incompatible with the purpose for which it was originally collected without first obtaining your consent.

Legal Basis for Processing

mp500 processes your Personal Data on one or more of the following legal grounds:

• Contractual necessity: Processing is required to deliver the services described in the Terms & Conditions you agreed to at registration — including account management, payment processing, and game delivery.
• Legal obligation: mp500 is required by its international gambling licence to perform KYC verification, retain transaction records, and cooperate with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations. This data must be retained regardless of your preferences.
• Legitimate interests: mp500 has a legitimate interest in processing Technical and Usage Data to detect fraud, prevent platform abuse, improve service quality, and ensure the security of other players' accounts. We balance this interest against your privacy rights and collect only the minimum data necessary.
• Consent: Where we send you personalised promotional communications (bonus offers, seasonal promotions, event announcements), we do so based on your explicit consent given at registration or updated in your Account Settings. You may withdraw this consent at any time without affecting your account standing.

Data Sharing & Third Parties

mp500 does not sell, rent, or trade your Personal Data. We share data only in the following strictly controlled circumstances:

• Payment processors: Your financial data (bank account number, e-wallet identifier, transaction amount in IDR) is shared with the relevant Indonesian bank or e-wallet provider solely to execute your deposit or withdrawal instruction. This includes BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, and LinkAja. These providers act as independent Data Controllers for their own services and are subject to their own privacy policies.
• Game studio providers: When a game dispute arises, limited transaction and session data may be shared with the relevant licensed studio (such as Pragmatic Play, Evolution Gaming, Microgaming, PG Soft, Spribe, or NetEnt) to retrieve the authoritative round result. These studios operate under strict data processor agreements and may not use your data for their own independent purposes.
• Identity verification services: During KYC, identity document data may be processed by a third-party verification service operating under a data processor agreement with mp500. This service verifies document authenticity and checks against sanctions lists and politically exposed persons (PEP) databases.
• Cloud infrastructure providers: mp500 uses enterprise-grade cloud hosting services to store and process data securely. These providers have no access to your data beyond what is technically necessary to maintain the infrastructure and operate solely under mp500's instructions.
• Regulatory and law enforcement bodies: mp500 will disclose Personal Data to a competent authority, law enforcement agency, or court where required to do so by applicable law, a valid court order, or a regulatory instruction issued under our licensing obligations. We will notify you of any such disclosure unless prohibited from doing so by law.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of mp500's assets, your Personal Data may be transferred to the acquiring entity. You will be notified at least 30 days in advance of any such transfer and provided with the opportunity to request deletion of your account.

International Data Transfers

mp500 operates globally and some of our service providers are located outside Indonesia. Where your Personal Data is transferred to a country outside Indonesia — including to cloud infrastructure or game studio partners — mp500 ensures that appropriate safeguards are in place to maintain a level of data protection equivalent to that provided within Indonesia.

These safeguards include, as appropriate: standard contractual clauses (SCCs) approved by relevant data protection authorities, binding corporate rules where applicable, or transfer to countries recognised as providing an adequate level of data protection by Indonesia's national data protection framework.

Your Indonesian Rupiah balances, transaction records, and bank account data are processed primarily within infrastructure hosted in the Asia-Pacific region to minimise latency and comply with applicable data localisation expectations. If you require further information about the specific safeguards in place for any particular transfer, you may contact our Data Protection Officer at the address listed in Section 15.

Data Retention

mp500 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our licensing obligations. The following retention periods apply as a general guide:

When retention periods expire, data is securely deleted or anonymised so that it can no longer be linked to an individual. Where data has been anonymised, it may be retained indefinitely for aggregate statistical analysis.

Security Measures

mp500 implements a layered technical and organisational security architecture to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption on all data transmitted between your browser or device and mp500's servers. All connections to mp500.ws are forced to HTTPS; unencrypted HTTP requests are automatically redirected.
• Encryption at rest for all databases containing Personal Data, including KYC documents, financial records, and account credentials.
• Password hashing using industry-standard one-way hashing algorithms (bcrypt or equivalent). Plaintext passwords are never stored or transmitted by mp500.
• Role-based access controls (RBAC) ensuring that internal staff can only access Personal Data to the extent necessary for their specific job function. Access to sensitive data categories requires elevated authorisation.
• Two-factor authentication (2FA) available for all Player accounts. We strongly encourage all players to activate 2FA in Account Settings.
• Intrusion detection and monitoring systems that alert the mp500 security team to anomalous access patterns, potential brute-force attacks, or suspicious data export activity in real time.
• Regular penetration testing conducted by independent third-party security specialists to identify and remediate vulnerabilities before they can be exploited.
• Physical security at all data centre facilities used by mp500's infrastructure providers, including biometric access controls, 24/7 CCTV, and environmental monitoring.

In the event of a data breach that is likely to result in a high risk to your rights and freedoms, mp500 will notify affected Players without undue delay and take all reasonable steps to contain and remediate the breach.

Cookies & Tracking Technologies

mp500.ws uses cookies and similar tracking technologies to provide a functional, secure, and personalised experience. The following categories of cookies are used:

mp500 does not use third-party advertising cookies or serve behavioural advertising through its platform. You can manage or delete cookies through your browser's built-in settings. Note that disabling functional or analytics cookies will not prevent you from accessing the platform but may reduce personalisation features. Disabling strictly necessary or fraud-prevention cookies may prevent login or trigger additional security checks.

Your Data Rights

As a Player on mp500, you have the following rights with respect to your Personal Data. To exercise any of these rights, contact our Data Protection Officer at the address provided in Section 15. We will respond within 30 calendar days of a valid request.

• Right of Access: You may request a copy of all Personal Data mp500 holds about you, along with information about how it is being processed and on what legal basis.
• Right to Rectification: If any of your Personal Data is inaccurate or incomplete, you may request that it be corrected or updated. Where possible, you can update Contact Data directly in Account Settings without needing to contact us.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where it has been unlawfully processed. This right is subject to overriding legal retention obligations — in particular, AML/CTF record-keeping requirements mean that certain financial and identity data cannot be deleted for the legally mandated retention period.
• Right to Restrict Processing: You may request that mp500 restrict the processing of your Personal Data while a dispute about its accuracy or the lawfulness of its processing is being resolved.
• Right to Data Portability: You may request that mp500 provide your Personal Data to you in a structured, commonly used, machine-readable format (JSON or CSV) for transfer to another service, where technically feasible and where processing is based on consent or contractual necessity.
• Right to Object: You may object to processing of your Personal Data where that processing is based on mp500's legitimate interests. If you object, mp500 must cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., promotional communications), you may withdraw that consent at any time without penalty by updating your preferences in Account Settings or by contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Protection of Minors

mp500 enforces a strict 21+ age policy across all services. The platform is not directed at, and does not knowingly collect Personal Data from, any person under the age of 21. All account registrations are subject to mandatory KYC identity verification, which includes confirmation of date of birth against a government-issued identity document.

If mp500 discovers or receives a credible report that Personal Data belonging to a person under the age of 21 has been collected, we will immediately suspend the relevant account, void any associated winnings, return any uncontested real-money deposit balance via the original payment method, and delete or anonymise the minor's Personal Data to the extent permitted by our legal retention obligations.

Parents or guardians who believe that their child may have registered an account on mp500 are encouraged to contact our support team immediately at [email protected]. We will prioritise all such cases and act with urgency. We also strongly recommend the use of internet filtering software to prevent underage access to gambling sites.

Third-Party Links

The mp500 platform may contain references to third-party services, including licensed game studios, payment providers, and sports data feeds. While mp500 selects its partners carefully and requires data processor agreements where applicable, we have no control over the privacy practices of independent third-party platforms and their own websites.

This Privacy Policy applies exclusively to data collected and processed by mp500 through the mp500.ws platform. If you follow any link to an external service — including the individual websites of game studios such as Pragmatic Play or Evolution Gaming, or the consumer portals of payment providers such as OVO or DANA — you should review the privacy policy of that third party before submitting any personal information. mp500 accepts no responsibility or liability for the privacy practices of third-party websites or services.

Policy Amendments

mp500 reviews this Privacy Policy on a regular basis and reserves the right to update or amend it at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Where changes are material — meaning they affect how your data is used in a way that could impact your rights — mp500 will provide at least 14 days' advance notice by displaying a prominent notice on the platform and, where a registered account email address is available, by sending an email notification to affected Players.

Minor amendments — such as clarifications, corrections to typographical errors, or updates to reflect non-substantive regulatory guidance — may be published without advance notice. The "Last Updated" date at the top of this policy reflects the most recent revision date. Your continued use of the mp500 platform after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any changes, you should stop using the platform and request account closure in accordance with the Terms & Conditions.

Contact & Data Protection Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 11, please contact the mp500 Data Protection Officer (DPO):

Our support team operates 24 hours a day, 7 days a week, including Indonesian public holidays such as Idul Fitri and Nyepi. For time-sensitive matters — such as suspected unauthorised access to your account, an active data breach, or an urgent self-exclusion request — please mark your message "URGENT" in the subject line for priority handling.

If you are not satisfied with mp500's response to a privacy complaint, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction in which mp500 holds its international gambling licence.