mpocash Privacy Policy
Your privacy is important to us. This Privacy Policy explains what personal data mpocash collects, how we use it, who we share it with, and what rights you have over your own information. Please read this document before using our platform.
How We Protect Your Data
These six principles summarise how mpocash approaches data privacy. Full details are in the policy sections below.
Encrypted Storage
All personal data is stored on encrypted servers using AES-256 encryption. Data in transit is protected by TLS 1.3 — the same standard used by major Malaysian banking institutions.
Minimum Data Collection
We collect only the personal data that is strictly necessary to operate your account, process your transactions, and comply with applicable legal requirements. We do not collect data speculatively.
No Third-Party Marketing Sales
mpocash does not sell, rent, or trade your personal data to third parties for their marketing purposes. Your information is used solely to operate and improve our services for you.
Access Controls
Access to personal data within mpocash is restricted on a strict need-to-know basis. Staff with access undergo data protection training and are bound by confidentiality obligations.
Your Rights, Respected
You have the right to access, correct, and request deletion of your personal data at any time. We respond to all verified data requests within 30 days of receipt.
Breach Notification
In the unlikely event of a data breach that puts your personal data at risk, mpocash will notify affected users promptly and in accordance with applicable data protection obligations.
1 Introduction
This Privacy Policy (the "Policy") describes how mpocash (referred to herein as "mpocash", "we", "us", or "our") collects, processes, stores, and protects the personal data of users (referred to as "you", "User", or "Data Subject") who access and use the mpocash platform available at https://mpocash.lat (the "Platform").
mpocash operates as an online sports betting and casino gaming service. In the course of providing our services to players in Malaysia and other eligible jurisdictions, we necessarily process certain categories of personal data. This Policy is designed to provide you with clear, transparent information about those data processing activities in accordance with internationally recognised data protection principles.
This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference. By registering an account or using any mpocash service, you acknowledge that you have read and understood this Policy.
If you have any questions about how we handle your personal data, or wish to exercise any of your data rights, please contact our Data Protection team at [email protected] with the subject line "Privacy Request".
2 Definitions
For the purposes of this Privacy Policy, the following definitions apply:
- "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and online identifiers.
- "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
- "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this case, mpocash.
- "Data Processor" means a third party that processes Personal Data on behalf of mpocash under a written data processing agreement.
- "KYC Data" means identity verification documents and associated information collected for Know Your Customer compliance purposes.
- "Cookies" means small data files stored on your device that help us recognise your browser, retain session data, and analyse Platform usage.
- "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the Processing of your Personal Data for a specific purpose.
- "Sensitive Personal Data" means special categories of data requiring enhanced protection, including data revealing racial or ethnic origin, health data, or biometric data used for identification purposes.
3 Data Controller
mpocash is the Data Controller with respect to all Personal Data collected through the Platform. As Data Controller, mpocash determines the purposes for which Personal Data is collected and the means by which it is processed.
mpocash operates under an international gaming licence and processes data in accordance with internationally recognised data protection standards. While mpocash primarily serves Malaysian users, the Platform is operated under an offshore licensing framework. Malaysian users are advised that Malaysian data protection legislation (particularly the Personal Data Protection Act 2010, PDPA) may apply to certain aspects of our data processing activities where the data relates to Malaysian residents.
mpocash respects the principles of the Malaysian Personal Data Protection Act 2010 (PDPA) as they relate to Malaysian residents. We process your data lawfully, fairly, and transparently.
4 Data We Collect
mpocash collects the following categories of Personal Data from users:
| Category | Examples | Purpose |
|---|---|---|
| Identity Data | Full name, date of birth, MyKad / passport number, selfie photograph | Account registration, KYC verification, age verification |
| Contact Data | Email address, mobile phone number, residential address (city / postcode) | Account communications, support, security alerts |
| Financial Data | Payment method details (e-wallet ID, bank account last 4 digits), transaction history, deposit / withdrawal records | Payment processing, fraud prevention, anti-money-laundering compliance |
| Technical Data | IP address, device type, operating system, browser type, session tokens | Security monitoring, fraud detection, Platform performance optimisation |
| Usage Data | Pages visited, games played, bets placed, session duration, click patterns | Personalisation, responsible gambling monitoring, product improvement |
| Communications Data | Support chat transcripts, emails, feedback submissions | Support resolution, quality assurance, dispute investigation |
| Responsible Gambling Data | Self-exclusion records, deposit limit settings, cool-off periods | Responsible gambling obligations, regulatory compliance |
mpocash does not collect full payment card numbers. For e-wallet payments via Touch 'n Go eWallet, Boost, or GrabPay, we receive only a transaction reference and confirmation. Sensitive payment authentication occurs on the respective payment provider's secure infrastructure.
5 How We Collect Your Data
mpocash collects Personal Data through the following mechanisms:
5.1 Direct Collection
Data you provide directly when: registering an account; completing KYC verification; making a deposit or withdrawal; submitting a support request; claiming a bonus or promotion; or communicating with our team.
5.2 Automated Collection
Data collected automatically through your use of the Platform, including: session cookies and similar tracking technologies; server logs recording IP addresses and access patterns; device fingerprinting for fraud prevention purposes; and analytics tools measuring Platform usage.
5.3 Third-Party Sources
In some circumstances we may receive data about you from third parties, including: payment processors (transaction confirmation data); identity verification service providers (KYC screening results); fraud prevention databases (negative list screening); and responsible gambling self-exclusion registers (where applicable and accessible).
6 How We Use Your Data
mpocash uses Personal Data for the following purposes:
- Account Management: Creating, maintaining, and securing your account; verifying your identity and eligibility; sending account-related communications including security alerts and transaction confirmations.
- Service Delivery: Processing deposits and withdrawals via Malaysian payment methods (Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, etc.); settling bets and casino game outcomes; providing live chat and email support.
- Legal & Regulatory Compliance: Conducting KYC verification; fulfilling anti-money-laundering (AML) obligations; maintaining records required by our operating licence; complying with lawful requests from competent authorities.
- Fraud Prevention & Security: Detecting and preventing fraudulent activity, account takeover, money laundering, collusion, and bonus abuse; conducting risk assessments on unusual account activity.
- Responsible Gambling: Monitoring gameplay patterns for indicators of problem gambling; enforcing self-exclusion and deposit limit instructions; fulfilling our duty-of-care obligations to players.
- Platform Improvement: Analysing aggregated usage data to improve game selection, page performance, and user experience; conducting A/B testing on interface changes.
- Communications: Sending service-related notifications; responding to your support enquiries; notifying you of material changes to our Terms or this Policy.
mpocash does not use your Personal Data for automated profiling that produces legal or similarly significant effects on you without human oversight, except as expressly required for fraud detection or responsible gambling interventions.
7 Legal Basis for Processing
mpocash processes your Personal Data on one or more of the following lawful bases:
- Contractual Necessity: Processing required to perform the contract we have with you (i.e., the Terms & Conditions) — including account management, payment processing, and service delivery.
- Legal Obligation: Processing required to comply with our legal and regulatory obligations, including KYC, AML screening, and record-keeping requirements mandated by our operating licence.
- Legitimate Interests: Processing conducted for the legitimate interests of mpocash or third parties, including fraud prevention, Platform security, responsible gambling monitoring, and service improvement, where such interests are not overridden by your rights and interests.
- Consent: Where we process data for purposes not covered by the above bases (such as certain marketing communications or optional analytics features), we will seek your explicit consent and provide an easy mechanism to withdraw it at any time.
8 Data Sharing & Disclosure
mpocash does not sell your Personal Data. We may share your data with the following categories of recipients strictly on a need-to-know basis and subject to appropriate contractual safeguards:
8.1 Service Providers (Data Processors)
Third-party vendors who provide services on our behalf, including: payment processors (handling transactions via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and bank transfer channels); identity verification providers; cloud hosting and infrastructure providers; customer support platform vendors; and fraud detection services. All processors are bound by data processing agreements.
8.2 Regulatory & Law Enforcement Authorities
We may disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts where we are legally required to do so, or where disclosure is necessary to protect the safety or legal rights of mpocash, its users, or the public.
8.3 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of mpocash's assets, Personal Data may be transferred to the acquirer as part of that transaction. You will be notified of any such transfer and any material change to this Policy that may result.
8.4 Responsible Gambling Bodies
Where required by our operating licence or where we deem it necessary to protect a player's welfare, we may share relevant account data with recognised responsible gambling organisations or self-exclusion scheme operators.
All third parties with whom we share Personal Data are required to handle it in compliance with applicable data protection law and in accordance with this Policy. We conduct due diligence on processors before engagement.
9 Data Retention
mpocash retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:
- Active Account Data: Retained for the duration of your account relationship with mpocash.
- Financial & Transaction Records: Retained for a minimum of 5 years following the last transaction, in accordance with standard AML record-keeping requirements.
- KYC Verification Documents: Retained for a minimum of 5 years following account closure or last verified transaction.
- Support Communications: Retained for up to 3 years following resolution of the relevant interaction, or longer if subject to ongoing dispute or legal proceedings.
- Technical & Log Data: Typically retained for 12 months for security and fraud analysis purposes, after which it is anonymised or deleted.
- Self-Exclusion Records: Retained indefinitely or for the period specified by our licensing obligations, to prevent re-registration by excluded players.
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with you as an individual.
10 International Data Transfers
As an internationally licensed platform, mpocash may store and process your Personal Data on servers located outside Malaysia. When transferring data internationally, we implement appropriate safeguards to protect your data, including:
- Standard contractual clauses with data processors located in third countries;
- Selection of processors operating in jurisdictions with equivalent or superior data protection standards;
- Technical safeguards including end-to-end encryption for data in transit across borders.
By using mpocash services, you acknowledge and agree that your Personal Data may be transferred to, stored in, and processed in jurisdictions outside Malaysia as described in this section.
11 Cookies & Tracking Technologies
mpocash uses cookies and similar tracking technologies (including pixel tags and local storage) on the Platform for the following purposes:
11.1 Strictly Necessary Cookies
These cookies are essential for the Platform to function. They include session authentication tokens that keep you logged in, CSRF protection tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
11.2 Functional Cookies
These cookies remember your preferences such as language settings, display preferences, and last-used payment method to improve your experience. They are set for the duration of your session or up to 12 months.
11.3 Analytics Cookies
We use analytics tools to collect aggregated, anonymised data about how users navigate the Platform. This data helps us identify popular features, detect technical issues, and improve overall Platform performance. This data is not used to identify individual users.
11.4 Security Cookies
Certain cookies are used exclusively for fraud detection and account security, including identifying unusual login patterns or suspicious device changes.
You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality. For detailed cookie management guidance, consult your browser's help documentation.
12 Your Data Rights
Subject to applicable data protection law and certain legal exceptions, you have the following rights with respect to your Personal Data held by mpocash:
Right of Access
Request a copy of the Personal Data we hold about you and information about how we process it.
Right to Rectification
Request correction of inaccurate or incomplete Personal Data held in your account.
Right to Erasure
Request deletion of your Personal Data, subject to legal retention obligations and ongoing contractual necessity.
Right to Restriction
Request that we restrict Processing of your data in certain circumstances, such as while disputing accuracy.
Right to Portability
Request your Personal Data in a structured, machine-readable format for transfer to another service provider.
Right to Object
Object to Processing based on legitimate interests, including direct marketing uses where applicable.
To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". We will respond within 30 days of receipt of a verified request. We may ask you to verify your identity before processing any data rights request to protect against unauthorised access.
Certain data rights may be limited where we are required to retain data for legal, regulatory, or fraud-prevention purposes. We will explain any applicable limitations when responding to your request.
13 Security Measures
mpocash implements a multi-layered security programme designed to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. Our technical and organisational security measures include:
- Encryption: AES-256 encryption for data at rest; TLS 1.3 for data in transit between your device and our servers.
- Access Control: Role-based access controls limiting staff access to Personal Data on a strict need-to-know basis; multi-factor authentication for all administrative access.
- Network Security: Web application firewalls (WAF), intrusion detection systems, and regular penetration testing conducted by independent security specialists.
- Incident Response: A documented data breach response procedure with defined escalation paths, user notification protocols, and post-incident review processes.
- Staff Training: Mandatory data protection training for all staff with access to Personal Data, updated annually.
- Vendor Security: Security due diligence on all third-party processors, including review of their security certifications and contractual commitments.
Notwithstanding these measures, no internet transmission or electronic storage system is completely secure. You are also responsible for maintaining the security of your account credentials. If you suspect your account has been compromised, please contact us immediately.
14 Minors & Age Restriction
mpocash services are strictly available to persons aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21.
Age verification is conducted as part of the account registration and KYC process. Where we discover or have reasonable grounds to suspect that a registered user is under 21 years of age, the account will be immediately suspended, all associated Personal Data will be securely deleted (except records required for age-restriction compliance purposes), and any deposited funds will be returned to the originating payment method.
If you are a parent or guardian and believe that a minor in your care has registered an account with mpocash, please contact us immediately at [email protected] so that we may take prompt action.
15 Amendments to This Policy
mpocash reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing activities, applicable law, or regulatory requirements. Where changes are material, we will notify registered users by email or through a prominent notice on the Platform prior to the changes taking effect.
Your continued use of the Platform following the effective date of any amended Policy constitutes your acknowledgement of the updated terms. We encourage you to review this Policy periodically. The "Last updated" date at the top of this page indicates when the most recent revision was made. The current version of this Policy is always available at https://mpocash.lat/privacy-policy.
16 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing activities, please contact mpocash through any of the following channels:
- Data Privacy Email: [email protected] (subject: "Privacy Request")
- Live Chat: Available 24 hours a day, 7 days a week via the chat widget on the Platform — for urgent data security concerns
- Terms & Legal Queries: mpocash.lat/terms-conditions
- Responsible Gambling: mpocash.lat/responsible-gambling
We aim to respond to all verified privacy requests within 30 calendar days. For complex requests, we may extend this period by a further 60 days where necessary, in which case we will inform you of the extension and the reason for the delay.
Our support team is based on Malaysian Standard Time (MYT, UTC+8) hours for general correspondence, with 24/7 availability via live chat for urgent account security or suspected data breach notifications.
Thank you for trusting mpocash with your personal data. We take that trust seriously and are committed to handling your information with the care, transparency, and security it deserves.
We're Here to Help with
Any Privacy Concerns
Our support team is available around the clock. If you have questions about how we handle your data, or want to exercise your data rights, reach out any time.
For players aged 21 and above only. Gambling involves risk. Play responsibly.