Privacy Policy — mpo300

This Privacy Policy ("Policy") sets out how mpo300 ("Company", "Platform", "we", "us", "our"), the operator of the online gaming and sports betting platform at https://mpo300.click ("Website"), collects, uses, stores, and processes the personal data of registered players and website visitors ("User", "you", "your").

mpo300 takes data privacy seriously. We operate within a framework designed to protect your personal information in accordance with applicable data protection standards. This Policy explains the types of personal data we hold, the purposes for which it is processed, and the rights available to you regarding that data.

By accessing the Website, registering an Account, making a deposit, or otherwise engaging with our services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information, online identifiers, and behavioural data.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is mpo300.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a contractual arrangement (e.g., payment processors, KYC providers).
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, deletion, or destruction.
• "Consent" — freely given, specific, informed, and unambiguous agreement to the processing of personal data for a defined purpose.
• "Account" — a registered player profile on the mpo300 Platform.
• "KYC" — Know Your Customer identity verification procedures carried out for compliance, fraud prevention, and anti-money-laundering purposes.
• "Cookies" — small text files placed on your device by the Website to support functionality, session management, and analytics.

mpo300 is the Data Controller responsible for the personal data collected and processed through the Website and its associated services. As Data Controller, mpo300 determines the purposes for which your personal data is used and ensures that appropriate security and compliance measures are in place to protect it.

Where mpo300 engages third-party service providers — such as payment processors, identity verification services, or analytics providers — those parties act as Data Processors and are bound by contractual obligations to process your data only as directed by mpo300 and in accordance with applicable data protection requirements.

mpo300 collects the following categories of personal data in connection with the provision of our services:

4.1 Identity & Contact Data

• Full legal name as it appears on government-issued identification
• Date of birth (used for age verification — 21+ requirement)
• Malaysian Identity Card (MyKad) number, passport number, or equivalent identifier
• Residential address (including city — Kuala Lumpur, Petaling Jaya, Penang, Shah Alam, Johor Bahru, or otherwise)
• Email address and mobile phone number

4.2 Financial Data

• Bank account number and name (for withdrawal processing)
• E-wallet identifiers associated with Touch 'n Go eWallet, Boost, or GrabPay accounts
• Transaction records including deposit amounts, withdrawal requests, and bonus credits in MYR
• Source of funds documentation (where required by compliance procedures)

4.3 Technical & Usage Data

• IP address and approximate geolocation
• Browser type, version, and operating system
• Device identifiers and session data
• Pages visited, time spent, and navigation paths within the Website
• Login timestamps and session durations

4.4 Gaming & Behavioural Data

• Wager history, game type, stake amounts, and outcomes
• Sports betting selections including EPL, Liga Super Malaysia, UFC, and other markets
• Bonus usage, wagering progress, and promotion interactions
• Responsible gambling tool usage (deposit limits set, self-exclusion requests)

4.5 Communications Data

• Live chat transcripts, email correspondence, and support ticket records
• Feedback and complaint submissions
• Marketing preferences and opt-in/opt-out records

mpo300 collects personal data through the following methods:

• Direct Collection: Information you provide when registering an Account, completing KYC, making a deposit, submitting a withdrawal request, contacting support, or responding to a promotion.
• Automated Collection: Technical and behavioural data collected automatically as you navigate and interact with the Website, through cookies, server logs, and session tracking technologies.
• Third-Party Sources: Identity and fraud-check data received from KYC verification service providers; payment confirmation data from DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, Touch 'n Go eWallet, Boost, and GrabPay; and risk screening data from anti-money-laundering compliance services.

mpo300 processes your personal data for the following specific purposes:

mpo300 processes personal data only where a recognised legal basis applies. The principal legal bases we rely upon are as follows:

• Contract Performance: Processing necessary to fulfil our contractual obligations to you under the Terms & Conditions — including managing your Account, processing deposits and withdrawals, and administering bonuses.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including age verification, KYC identity checks, anti-money-laundering (AML) compliance, and responsible gambling record-keeping.
• Legitimate Interests: Processing carried out for mpo300's legitimate business interests — including fraud prevention, platform security, service improvement, and analytics — provided those interests are not overridden by your data protection rights.
• Consent: Processing based on your freely given and specific consent, principally for direct marketing communications. You may withdraw consent at any time by contacting our support team.

mpo300 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly for the purposes outlined in this Policy:

• Payment Service Providers: DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, Touch 'n Go eWallet, Boost, and GrabPay — to process deposit and withdrawal transactions in MYR.
• Identity Verification Services: Third-party KYC and AML screening providers engaged to verify player identity, source of funds, and compliance with regulatory obligations.
• Game Content Providers: Licenced game studio partners who may receive anonymised session data required for game delivery and technical performance. These providers do not receive identifiable personal data.
• Technology & Infrastructure Providers: Cloud hosting, content delivery, and cybersecurity service providers who process data on mpo300's behalf under binding data processing agreements.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or regulatory direction, mpo300 will disclose personal data to competent authorities without prior notification to the User.
• Professional Advisors: Legal counsel, auditors, and compliance consultants, subject to strict confidentiality obligations.

mpo300 uses cookies and similar tracking technologies to operate and improve the Website. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the basic functioning of the Website, including session management, login state, and security token storage. These cannot be disabled without disrupting core functionality.
• Functional Cookies: Store your preferences such as language settings, responsible gambling limit configurations, and interface layout choices to improve your experience across sessions.
• Analytics Cookies: Collect anonymised data about how users navigate the Website — which pages are visited, how long sessions last, and where users encounter difficulties — to enable continuous service improvement.
• Security Cookies: Used to detect and prevent fraudulent activity, bot access, and unusual account behaviour.

You may adjust your browser settings to block or delete cookies; however, doing so may impair certain Website functions including session persistence and personalisation features. mpo300 does not use third-party advertising cookies or cross-site tracking technologies.

mpo300 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention standards apply:

• Account Data: Retained for the duration of the active Account and for a period of five (5) years following Account closure, to meet AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of seven (7) years in accordance with standard financial compliance obligations.
• KYC Documentation: Retained for five (5) years after the business relationship ends, unless a longer period is required by regulatory direction.
• Communications Records: Support chat transcripts and email correspondence are retained for three (3) years for quality assurance and dispute resolution purposes.
• Gaming Activity Logs: Wager history and session records are retained for five (5) years to support responsible gambling monitoring and regulatory reporting.
• Marketing Data: Retained until you withdraw your consent or opt out of communications, at which point it is deleted or anonymised within thirty (30) days.

Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised.

mpo300 implements a multi-layered approach to data security, combining technical, administrative, and physical safeguards to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the mpo300 Platform is encrypted using industry-standard TLS protocols, equivalent to the security standard used by major Malaysian banks including Maybank and CIMB.
• Data Minimisation: We collect only the personal data strictly necessary for the stated processing purposes. Redundant data is not retained.
• Access Controls: Personal data is accessible only to authorised mpo300 personnel with a documented business need. Access is role-based, logged, and subject to periodic review.
• Encrypted Storage: Sensitive data at rest — including financial records and identity documents — is stored in encrypted form on secured infrastructure.
• Vulnerability Management: Regular security assessments, penetration testing, and patch management cycles are conducted to identify and remediate potential weaknesses in our systems.
• Incident Response: mpo300 maintains a formal data breach response procedure. In the event of a breach that materially affects your personal data, we will notify affected Users without undue delay.

Notwithstanding the above measures, no system is entirely impenetrable. You are also responsible for maintaining the security of your own Account credentials and for reporting any suspected unauthorised access to [email protected] promptly.

Subject to applicable law, you have the following rights in respect of your personal data held by mpo300. To exercise any of these rights, contact our support team at [email protected]. We will respond to all verified requests within thirty (30) calendar days.

Please note that certain rights are subject to limitations where legal obligations require retention of data (e.g., AML record-keeping). mpo300 will clearly communicate any such limitations when responding to your request.

The mpo300 Website may contain references to third-party payment providers and service integrations. mpo300 is not responsible for the privacy practices or data handling procedures of any third-party service. When you interact with a third-party payment gateway — such as completing a DuitNow transfer or authenticating through your Maybank2u or Touch 'n Go eWallet account — that interaction is governed by the respective provider's own privacy policy.

We recommend that you review the privacy policies of any third-party services you engage with in connection with your mpo300 Account. mpo300 has no control over, and assumes no responsibility for, the data practices of external platforms or services.

mpo300 is strictly an adult platform. Registration and use of the Platform is prohibited for any individual under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If we become aware that personal data has been collected from a person who does not meet the minimum age requirement, we will immediately suspend the associated Account, delete the collected data, and withhold any associated balance pending investigation.

mpo300 reserves the right to revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. Where amendments are material — for example, changes to the categories of data we collect, the purposes for which data is used, or the parties with whom it is shared — we will notify registered Users by email to their registered address at least seven (7) calendar days prior to the changes taking effect.

Minor updates, such as clarifications of existing language or corrections of typographical errors, may be made without advance notice. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Continued use of the Platform following any amendment constitutes acceptance of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or mpo300's data processing practices, please contact our Data Privacy team using the details below. We are committed to responding to all privacy-related enquiries promptly and transparently.

When submitting a data subject access request or erasure request, please include your registered Account username, the email address associated with your Account, and a clear description of your request. We may require identity verification before processing your request to ensure data security and prevent unauthorised access to another person's information.