Privacy Policy Platform 138 — Your Data, Our Responsibility

Welcome to the Privacy Policy Page 138. We understand that privacy is not merely a formality — it is a fundamental right that must be respected and protected. That is why we have written this policy in clear, plain language, so you know exactly what happens to your information every time you interact with our platform.

The 138 platform is a trusted online gaming destination loved by many Malaysian players. In operating this platform, we need to collect certain personal data from you to ensure our services run securely, smoothly, and responsibly. However, we firmly uphold the principle that your data belongs to you — we only borrow it for clear and limited purposes.

This Privacy Policy explains in detail:

• What personal data we collect from you
• How and why that data is used
• Who your data may be shared with and under what circumstances
• Security measures we take to protect your data
• Your rights regarding your personal data
• How to contact us if you have any concerns

We encourage you to read this document carefully in its entirety. If any section is unclear, the 138 support team is available to assist you via live chat on the platform 24 hours a day, 7 days a week.

We practise the principle of minimal data collection — meaning we only collect data that is strictly necessary to provide the services you use. The following are the categories of data we collect:

We also collect data you provide voluntarily, such as feedback through the support chat, responses to member satisfaction surveys, or any written communication with our team.

Every piece of data we collect has a clear and legitimate purpose. We do not use your data for purposes unrelated to the services you use. The following are the primary purposes of data usage:

• Account Management: To register, verify, and manage your member account, including the login process, password recovery, and profile updates.
• Transaction Processing: To process deposits, withdrawals, and all other financial transactions securely and accurately.
• KYC & AML Compliance: To fulfil our obligations under international Know Your Customer and Anti-Money Laundering standards as required by our licensed payment providers and business partners.
• Platform security: To detect and prevent fraudulent activity, hacking, account abuse, and any other security threats that could harm you or the platform.
• Customer Support: To provide accurate and effective assistance when you contact our support team.
• Service Improvement: To analyse usage patterns in aggregate (not individually) in order to improve game quality, platform speed, and the overall user experience.
• Promotional communications: To send information about the latest offers, bonuses, and promotions — but only if you have given your consent to receive such communications.
• Legal compliance: To comply with any applicable legal or regulatory requirements, or in response to lawful directives from relevant authorities.

138 does not sell, rent or trade your personal data to any third party for marketing purposes. However, in the course of operating the platform, there are limited situations where your data may need to be shared:

• Payment providers: Required transaction information is shared with certified payment processors such as DuitNow, FPX, and e-wallet providers to enable deposits and withdrawals to be processed.
• Game providers: Basic required account information is shared with licensed game providers to enable you to access games on the 138 platform.
• Legal Authorities: We are required to disclose your data to the relevant authorities if directed to do so through a valid legal process — for example, a court order or financial crime investigation.
• Technical service providers: Cloud computing and technical infrastructure providers that help us operate the platform may have limited access to data for technical purposes only, and are bound by strict confidentiality agreements.

All third parties that receive your data are bound by data protection agreements requiring them to use that data solely for specified purposes and to handle it according to security standards equal to or higher than our own.

We continuously invest in security infrastructure to ensure your data remains protected at all times. The protective measures we implement include:

• 256-bit SSL Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 protocol with AES-256 encryption, ensuring no third party can intercept or read your information in transit.
• Two-Factor Authentication (2FA): We offer an additional security layer through 2FA, which requires you to verify your identity via a registered device each time you log in from a new location or device.
• 24/7 Monitoring: Our automated monitoring system operates around the clock to detect any unusual activity or unauthorised access attempts on your account.
• Secure Password Storage: Your password is stored in a hashed format that cannot be decrypted, using the bcrypt algorithm — meaning even our staff cannot view your actual password.
• Regular security audits: Our platform undergoes regular independent security audits by accredited cybersecurity firms to identify and remediate any potential vulnerabilities.
• Internal access controls: Only designated authorised staff have access to member personal data, and every access is recorded in an auditable log available for review.

While we take all reasonable steps to protect your data, no security system can be guaranteed 100% secure. We encourage you to take your own protective measures, such as using a strong password, not sharing your login credentials, and keeping your device up to date.

The 138 platform uses cookies and similar tracking technologies to enhance your browsing experience. Cookies are small text files stored on your device when you visit our website.

The following are the types of cookies we use:

• Essential cookies: Required for core platform functions such as maintaining login sessions, processing transactions and ensuring security. These cookies cannot be disabled as they are critical to platform operations.
• Performance cookies: Collects information about how you use the platform — pages visited, time spent, and any errors encountered — to help us improve our services. All data is collected anonymously.
• Preference cookies: Saves your preferences such as language, display settings, and game preferences so you do not need to reconfigure them each time you log in.
• Analytics cookies: Helps us understand aggregate traffic and usage patterns to make better decisions about platform development.

You can manage or delete cookies through your web browser settings at any time. Please note that disabling certain cookies may affect platform functionality or your user experience.

We respect your rights over the personal data we hold. You have the following rights, which you may exercise at any time by contacting the 138 support team:

• Right of access: You have the right to request a copy of all personal data we hold about you. We will process this request within 30 business days.
• Right to rectification: If any information we hold is inaccurate or outdated, you have the right to request immediate correction.
• Right to erasure: You may request the deletion of your personal data, subject to the legal record-keeping obligations binding on us. Financial transaction data may need to be retained for a minimum period as required by anti-money laundering regulations.
• Right to restriction of processing: Under certain circumstances, you may request that we temporarily halt the processing of your data while you await the outcome of a complaint.
• Right to object: You have the right to object to the use of your data for direct marketing or promotional communications. You may unsubscribe from promotional communications at any time.
• Right to data portability: You may request your data in a machine-readable format for transfer to another platform should you choose to do so.

We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. The following are general data retention period guidelines:

• Active account data: Retained for the duration your account is active and for a reasonable period after account closure to allow for the resolution of any disputes that may arise.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with international AML standards and financial compliance requirements.
• KYC Documents: Retained for 5 years after account closure or the date of the last transaction, whichever is later.
• Technical and security logs: Retained for 90 days for security incident investigation and fraud detection purposes.
• Customer support communications: Retained for 2 years to allow us to provide consistent support and resolve any disputes.

When your data is no longer needed, we will securely delete it using methods that ensure it cannot be recovered.

Platform 138 is strictly for users aged 18 years and above. We do not knowingly collect any personal data from individuals under the age of 18.

Should we discover that personal data has been collected from someone under the age of 18 without our knowledge, we will take immediate steps to delete that data and close the account in question. Every account registered on the 138 platform goes through a strict age verification process.

Parents or guardians who believe their child may have registered an account on our platform are encouraged to contact our support team immediately via live chat for prompt follow-up.

138 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or legitimate operational reasons. When we make significant changes, we will:

• Displaying a clear notice on the platform at least 7 days before changes take effect
• Sending notification emails to all affected active members
• Updating the "Last Updated" date at the top of this page

Continued use of the 138 platform after changes take effect constitutes acceptance of the revised Privacy Policy. If you disagree with any changes, you have the right to close your account before the changes come into effect.

We encourage you to review this page periodically. A version history of our Privacy Policy is available upon request through the support team.