mop77 Privacy Policy

1 Introduction

mop77 is committed to protecting the privacy and personal data of every individual who uses our platform. This Privacy Policy sets out in plain, professional language exactly how mop77 collects, processes, stores, and protects your personal information when you register for an account, make deposits and withdrawals, place bets, participate in promotions, or contact our customer support team.

We understand that trust is the foundation of any long-term relationship between a gaming platform and its members. Indonesian players entrust us with sensitive personal and financial information, and we take that responsibility seriously. Every system, process, and third-party relationship at mop77 is evaluated against the question of whether it adequately protects our members' data.

This policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, both of which are incorporated by reference into the overall agreement between you and mop77. Defined terms used but not defined in this Privacy Policy carry the meaning assigned to them in the Terms & Conditions.

2 Data Controller

For the purposes of applicable data protection law, mop77 acts as the data controller in respect of all personal data collected through the mop77 platform and its associated services. As data controller, mop77 determines the purposes for which personal data is processed and the means by which that processing is carried out.

If you have any questions about how mop77 processes your personal data, or if you wish to exercise any of your data subject rights described in Section 10, you may contact our dedicated privacy team using the contact details set out in Section 14 of this policy.

3 Data We Collect

mop77 collects personal data across several categories. The table below summarises the types of data we may hold about you, with examples relevant to the Indonesian market context:

We do not collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond what is necessary to verify your identity document photograph) unless you voluntarily provide it or we are required to collect it by law.

4 How We Collect Data

mop77 collects personal data through the following means:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit or withdrawal request, contact customer support, or respond to a survey or promotion.
• Automatically — through cookies, server logs, and similar tracking technologies when you visit or interact with the mop77 platform. Technical and usage data are collected automatically during every session.
• From payment providers — when you initiate a deposit or withdrawal, our payment processing partners (including Indonesian bank transfer facilitators and e-wallet operators such as OVO, DANA, and GoPay) may transmit transaction confirmation data to mop77 to reconcile your account balance.
• From identity verification providers — where mop77 uses a third-party KYC service to verify the authenticity of identity documents, that provider may return verification status data and risk scores to mop77 as part of the verification process.
• From fraud prevention and security tools — mop77 uses automated systems to detect unusual login behaviour, account takeover attempts, and suspicious betting patterns. These systems generate internal risk scores based on Technical and Usage Data.

5 Purposes of Processing

mop77 processes personal data only for specific, legitimate purposes. The table below maps each processing purpose to its legal basis and the categories of data involved:

mop77 does not use personal data for automated decision-making that produces legal or similarly significant effects on players, except in the limited context of fraud detection where we may temporarily suspend an account pending human review if automated systems flag a high-risk pattern.

6 Data Sharing

mop77 does not sell, rent, or trade your personal data. We share data only in the following circumstances and only to the extent strictly necessary:

• Payment service providers — Indonesian bank transfer facilitators, QRIS processors, and e-wallet platforms (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial data necessary to process your deposit or withdrawal instruction. These providers operate under their own privacy policies and are subject to Indonesian financial-sector data obligations.
• Identity verification providers — Where mop77 uses a specialist third-party KYC platform to verify identity documents, that provider receives your Identity Data solely for the purpose of returning a verification result to mop77. Document images are not retained by the verification provider beyond the period required to complete the check.
• Game studio partners — Live casino and RNG game content delivered by Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft, NetEnt, and Microgaming is served from their respective platforms. These studios receive only a pseudonymous player identifier and game session data; they do not receive your full identity or financial data.
• Cloud infrastructure and hosting providers — mop77's servers and data stores are hosted on internationally recognised cloud infrastructure. Hosting providers act as data processors under a data processing agreement and may not use your data for their own purposes.
• Fraud and security vendors — Specialist third-party tools assist mop77 in detecting account takeover attempts, bonus abuse, and money laundering. These vendors receive Technical and Usage Data in pseudonymised or hashed form.
• Regulatory and law enforcement authorities — mop77 will disclose personal data to competent authorities if required by a valid legal order, court directive, or regulatory obligation. We will notify you of any such disclosure where legally permitted to do so.
• Business transfers — In the event of a merger, acquisition, or sale of mop77's business or assets, personal data held by mop77 may be transferred to the acquiring entity, subject to the acquiring entity assuming the same data protection obligations set out in this policy.

7 Data Retention

mop77 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with applicable legal retention requirements. The following general retention periods apply:

• Account and identity data — retained for the duration of your active account relationship with mop77, plus a minimum of 5 years following account closure. This retention is required to satisfy anti-money-laundering record-keeping obligations and to respond to any post-closure regulatory inquiries.
• Financial and transaction data — retained for a minimum of 5 years from the date of the transaction, consistent with financial record-keeping standards applicable to gaming operators.
• KYC documents — retained for the duration of the account relationship plus 5 years following closure, or longer if required by a specific legal obligation or active investigation.
• Customer support communications — retained for 3 years from the date of the last interaction in the relevant support thread.
• Technical and usage logs — retained for up to 12 months in active form for security and analytics purposes, after which logs are either deleted or anonymised such that they can no longer be linked to an individual.
• Marketing preferences — retained for the duration of your account relationship. If you withdraw marketing consent, your opt-out preference is retained indefinitely to ensure we do not inadvertently re-add you to a marketing list.

Where you request deletion of your personal data under Section 10 and mop77 is not subject to a conflicting legal retention obligation, we will action the deletion request within 30 days and confirm completion in writing.

8 Security Measures

mop77 implements a layered security architecture to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. Key security measures in place include:

• Encryption in transit — all data transmitted between your device and the mop77 platform is encrypted using TLS 1.3. Our SSL certificate status is publicly verifiable and kept current at all times.
• Encryption at rest — personal data stored in mop77's databases is encrypted at rest using AES-256 encryption. Encryption keys are managed through a dedicated key management service with strict access controls.
• Access controls — internal access to personal data is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular security training. Access is governed by role-based permissions and multi-factor authentication on all administrative systems.
• Penetration testing and audits — mop77 conducts regular independent security audits and penetration tests of its platform infrastructure. Critical findings are remediated within defined SLA timeframes.
• Incident response — mop77 maintains a documented data breach response plan. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected players without undue delay and take all reasonable steps to contain and remediate the breach.

While mop77 employs commercially reasonable security measures, no system is completely immune to attack. You also play an important role in keeping your account secure: use a strong, unique password for your mop77 account, enable any available two-factor authentication, and contact our support team immediately if you suspect any unauthorised access to your account.

9 Cookies & Tracking Technologies

mop77 uses cookies and similar tracking technologies to operate and improve the platform. The categories of cookies in use are as follows:

• Strictly necessary cookies — these cookies are essential for the platform to function. They enable session management (keeping you logged in between pages), security token validation, and load balancing. These cookies cannot be disabled without affecting core platform functionality.
• Functional cookies — these cookies remember your preferences (such as language settings, display preferences, and recently viewed game categories) to provide a personalised experience across sessions.
• Analytics cookies — mop77 uses first-party analytics to understand how members navigate the platform — which pages are most visited, which games are most popular, and where players encounter difficulties. This data is collected in aggregate and is used to improve platform design and performance.
• Security and fraud prevention cookies — these cookies help mop77 identify and flag suspicious login attempts, detect bot activity, and protect accounts from takeover. They store device fingerprint identifiers and session integrity tokens.

mop77 does not use third-party advertising or tracking cookies that follow you across websites outside the mop77 platform. You may manage your browser's cookie settings directly; however, disabling strictly necessary cookies may prevent you from logging in or using core platform features.

10 Your Rights

As a mop77 member, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our privacy team using the details in Section 14. We will respond to all valid requests within 30 days of receipt.

• Right of access — you may request a copy of all personal data mop77 holds about you, together with information about the purposes for which it is processed, who it is shared with, and how long it is retained.
• Right to rectification — if any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. For certain data (such as your registered name or date of birth), correction may require submission of supporting documentation.
• Right to erasure ("right to be forgotten") — you may request that mop77 delete your personal data. We will action this request where it is not overridden by a conflicting legal retention obligation. Please note that anti-money-laundering rules require us to retain certain financial records for a minimum of 5 years regardless of an erasure request.
• Right to restriction of processing — you may request that mop77 restrict processing of your data in certain circumstances, for example while you contest the accuracy of data we hold or while you await the outcome of an objection to processing.
• Right to data portability — you may request a structured, machine-readable copy of personal data you have provided to mop77, to the extent technically feasible and where the legal basis for processing is contract or consent.
• Right to object — you may object to mop77 processing your personal data on the basis of legitimate interest, including profiling for responsible gaming purposes or for direct marketing. Where you object to direct marketing, we will cease that processing immediately.
• Right to withdraw consent — where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

mop77 will not discriminate against you in any way for exercising your data rights. Exercising these rights will not affect your ability to play on the platform or to receive standard account services.

11 Minors

The mop77 platform is strictly for adults aged 21 and over. mop77 does not knowingly collect or process personal data from individuals under 21 years of age. Age verification is a mandatory step in the KYC process, and accounts where the holder is found to be under 21 are closed immediately, with any balance forfeited in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that a minor in your care has registered for a mop77 account, please contact our support team at support@mop77.app immediately. We will investigate and close the account promptly, deleting any personal data associated with the minor to the extent permitted by our legal obligations.

mop77 encourages parents and guardians to use parental control software to prevent minors from accessing online gambling platforms. For guidance, please visit our Responsible Gaming page.

12 International Data Transfers

mop77 operates globally and your personal data may be transferred to, stored in, or processed in countries other than Indonesia. Where such transfers occur, mop77 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection law. Safeguards used include:

• Data processing agreements with all third-party processors that incorporate binding data protection obligations consistent with internationally recognised privacy standards.
• Transfers to cloud infrastructure providers operating in jurisdictions with adequacy decisions or recognised certification frameworks.
• Encryption of data in transit across all cross-border data flows, ensuring that data intercepted during transfer cannot be read by unauthorised parties.

By using the mop77 platform and accepting this Privacy Policy, you acknowledge that your personal data may be transferred outside of Indonesia as described above. If you have concerns about international data transfers, please contact our privacy team.

13 Changes to This Policy

mop77 may update this Privacy Policy from time to time to reflect changes in our data processing practices, new regulatory requirements, or platform improvements. When we make material changes — those that affect how we use your data or the rights available to you — we will provide at least 7 days' advance notice via a prominent notice on the mop77 platform and/or by email to your registered address.

Minor updates, such as typographical corrections or clarifications that do not alter the substance of the policy, may be made without advance notice. The "Last updated" date at the top of this page always reflects the date of the most recent revision.

We encourage you to review this Privacy Policy periodically. Your continued use of the mop77 platform following the effective date of any update constitutes your acknowledgement of the revised policy. If you do not agree with changes to this policy, you should stop using the platform and contact support to close your account.

14 Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by mop77, please reach out to our privacy and support team through the following channels:

• Email: support@mop77.app — please note this address is displayed as plain text only and is not a clickable link. Type it manually into your email client. Include "Privacy Request" in the subject line for faster routing to our privacy team.
• Live Chat: Available 24 hours a day, 7 days a week via the chat interface on the mop77 platform. Indonesian-speaking agents are available during WIB peak hours (08:00–24:00 WIB).

mop77 aims to acknowledge all privacy-related requests within 48 hours and to provide a substantive response or resolution within 30 days. Where a request is particularly complex or involves a large volume of data, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

If you are not satisfied with mop77's response to a privacy request or complaint, you have the right to escalate the matter to the relevant data protection authority in the jurisdiction applicable to you.