Privacy Policy

1 Introduction

mpoas ("we", "us", "our") operates the online casino and sports betting platform accessible at mpoas.cam ("the Platform"). We are deeply committed to the responsible handling of personal information belonging to users across Malaysia — including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other regions.

This Privacy Policy ("Policy") describes in clear terms what personal data we collect from you, the purposes for which that data is processed, the legal bases on which we rely, how long we retain your information, and what rights you hold in respect of your personal data.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. By registering an account or using the Platform in any capacity, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, please cease use of the Platform and contact us to close your account.

2 Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that directly or indirectly identifies a living individual, including name, identification number, contact details, financial information, and behavioural data.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, retrieval, correction, and deletion.
• "Data Controller" means mpoas, the entity that determines the purposes and means of processing your Personal Data.
• "Third-Party Processor" means a company or individual that processes Personal Data on behalf of mpoas under a contractual agreement, subject to data protection obligations.
• "KYC" means Know Your Customer — the identity and address verification process required under anti-money laundering obligations.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "Sensitive Personal Data" means Personal Data relating to identity documents, financial account information, and other categories that require heightened protection.

3 Data We Collect

3.1 Data You Provide Directly

When you register for an account, interact with the Platform, or contact our support team, we collect the following categories of information:

• Identity Data: Full legal name, date of birth, nationality, and gender as stated on your identity document;
• Contact Data: Email address, mobile phone number, and residential address (city, state, postcode — e.g., Kuala Lumpur, Selangor);
• Identity Document Data: Scanned copies or photographs of your MyKad, passport, or driver's licence, submitted as part of the KYC process;
• Financial Data: Payment method details including e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), bank account numbers (Maybank, CIMB, Public Bank, Hong Leong Bank), and cryptocurrency wallet addresses (BTC, ETH, USDT, LTC);
• Account Credentials: Username and encrypted password hash (we do not store your plaintext password);
• Support Correspondence: Messages, chat transcripts, and any information you share when contacting our live chat or email support.

3.2 Data Collected Automatically

When you access the Platform, our systems automatically collect certain technical information:

• Device & Technical Data: IP address, device type (mobile/desktop), operating system, browser type and version;
• Usage Data: Pages visited, games played, betting markets accessed, session duration, click patterns, and feature usage;
• Transaction Data: Deposit and withdrawal amounts, timestamps, payment method used, and transaction reference numbers;
• Location Data: Approximate geographic location derived from your IP address — used to detect potential access from restricted jurisdictions.

3.3 Data from Third Parties

We may receive Personal Data about you from third-party sources, including:

• KYC verification service providers that confirm the authenticity of your identity documents;
• Payment processors that confirm the status of your deposit or withdrawal transactions; and
• Fraud prevention and anti-money laundering screening services.

4 Legal Basis for Processing

mpoas processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing is necessary to provide the services described in our Terms & Conditions — including account creation, deposit processing, wager settlement, and withdrawal execution;
• Legal Obligation: Processing is required to comply with applicable anti-money laundering (AML) laws, KYC regulations, and any reporting obligations imposed by relevant authorities;
• Legitimate Interests: Processing is carried out for our legitimate business interests, including fraud prevention, platform security, and service improvement — provided these interests are not overridden by your fundamental rights; and
• Consent: Where we rely on your consent — for example, for optional marketing communications — you have the right to withdraw that consent at any time by contacting our support team or using opt-out mechanisms provided.

5 How We Use Your Data

Your Personal Data is used solely for the following purposes:

• To create and manage your player account on mpoas;
• To verify your identity and age (21+ requirement) through the KYC process;
• To process deposits and withdrawals through your chosen Malaysian payment method (e.g., DuitNow, FPX, Touch 'n Go eWallet, USDT);
• To settle wagers, award winnings, and apply bonus credits in accordance with applicable terms;
• To detect, investigate, and prevent fraudulent activity, collusion, and money laundering;
• To provide multilingual customer support in English, Bahasa Melayu, and Mandarin Chinese;
• To enforce our Responsible Gambling Policy, including implementing deposit limits and self-exclusion requests;
• To send transactional communications (e.g., deposit confirmations, withdrawal receipts, security alerts);
• To send promotional communications where you have provided consent or where we have a legitimate interest to do so; and
• To comply with legal and regulatory requirements imposed on mpoas by applicable law.

6 Data Sharing & Disclosure

6.1 We Do Not Sell Your Data

mpoas does not sell, rent, or trade your Personal Data to third parties for marketing purposes. Full stop.

6.2 Authorised Sharing

We share your data only in the following limited circumstances, and only to the extent necessary for the stated purpose:

• Payment Processors: To facilitate deposit and withdrawal transactions through e-wallets, bank transfer services (FPX, DuitNow), and cryptocurrency networks;
• KYC & Identity Verification Providers: To confirm the authenticity of your identity documents as required for account activation and withdrawal processing;
• Fraud & AML Screening Services: To cross-reference your details against sanctions lists and fraud databases as required by law;
• IT Infrastructure & Security Providers: Cloud hosting, CDN, and cybersecurity vendors who process data on our behalf under strict data processing agreements;
• Legal & Regulatory Authorities: Where disclosure is required by a court order, regulatory investigation, or mandatory reporting obligation under applicable law. We will notify you of such disclosure where legally permitted to do so.

All third-party processors are bound by contractual data protection obligations that require them to process your data only for the purposes specified by mpoas and to maintain appropriate technical and organisational security measures.

7 International Data Transfers

Some of our third-party service providers are located outside Malaysia. Where Personal Data is transferred to servers or processors in other countries, mpoas ensures that appropriate safeguards are in place, including:

• Contractual clauses requiring the recipient to apply data protection standards equivalent to those described in this Policy;
• Technical measures ensuring data is encrypted in transit and at rest; and
• Restriction of data access to personnel who have a legitimate operational need.

By using the Platform, you acknowledge that your data may be processed outside Malaysia subject to these safeguards. If you have concerns about international transfers, please contact us at support@mpoas.cam.

8 Data Retention

mpoas retains your Personal Data for as long as your account is active and for a period thereafter as required by applicable laws and regulations. Specific retention periods are as follows:

• Account & Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in line with standard AML record-keeping requirements;
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction;
• KYC Documentation: Retained for the period required by the applicable AML framework, which is typically five (5) years from the end of the business relationship;
• Support Correspondence: Retained for two (2) years from the date of the last interaction, unless a longer period is required to resolve an open dispute; and
• Technical & Log Data: Retained for up to twelve (12) months for security and debugging purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual.

9 Security Measures

mpoas implements a range of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in Transit: All data exchanged between your browser and our servers is encrypted using 256-bit SSL/TLS;
• Encryption at Rest: Sensitive data fields (including financial information and identity document references) are encrypted in our database;
• Access Controls: Strict role-based access controls ensure that only authorised personnel can access Personal Data, and only to the extent required for their specific function;
• Network Security: Our infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability assessments;
• Incident Response: mpoas maintains a documented data breach response procedure. In the event of a breach that creates a risk to your rights, we will notify you and relevant authorities as required by applicable law within the required timeframes.

10 Cookies & Tracking Technologies

mpoas uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage patterns, and detect fraud. The following categories of cookies are used:

You may manage cookie preferences through your browser's settings. Disabling non-essential cookies will not prevent you from using the Platform, but may affect certain personalisation features. We do not use third-party advertising cookies or share browsing data with ad networks.

11 Your Rights

Subject to applicable law and certain conditions, you have the following rights in respect of your Personal Data held by mpoas:

To exercise any of the above rights, please contact us at support@mpoas.cam with the subject line "Data Rights Request". We will acknowledge your request within five (5) business days and respond substantively within thirty (30) days. Identity verification may be required before we can action a request.

12 Children & Minors

The mpoas Platform is strictly intended for use by individuals who are 21 years of age or older. We do not knowingly collect Personal Data from individuals under 21. Any account found to belong to a person under this age threshold will be immediately closed and any associated data will be deleted in accordance with our data retention procedures.

13 Changes to This Policy

mpoas may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. Where changes are material — for example, a change in the categories of data we collect or a new purpose for which we use your data — we will notify registered users via email and/or a prominent notice on the Platform before the change takes effect.

Minor or administrative updates (such as corrections of typographical errors or clarifications that do not alter the substantive meaning of any clause) will be made without prior notice. The "Last Reviewed" date at the top of this page will be updated to reflect all revisions.

We encourage you to review this Policy periodically to stay informed of how mpoas protects your personal information. Continued use of the Platform after the effective date of any change constitutes your acceptance of the revised Policy.

14 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or mpoas's data practices, please contact us through the following channels:

• Email (plain text — not clickable): support@mpoas.cam — please include "Privacy Policy Enquiry" in your subject line.
• Live Chat: Available 24/7 on the Platform. Average first response: 3–5 minutes. Support available in English, Bahasa Melayu, and Mandarin Chinese.
• Response Time: Privacy-related requests will be acknowledged within five (5) business days and fully resolved within thirty (30) days.

If you are not satisfied with our response, or believe that we have handled your Personal Data in a manner inconsistent with this Policy or applicable law, you have the right to lodge a formal complaint with the relevant data protection authority in your jurisdiction.