W 138 Privacy Policy – Personal Data Protection for Malaysian Players

W 138 ("we", "platform", or "company") is committed to protecting the privacy and security of your personal information. This Privacy Policy has been drafted in accordance with the requirements of Personal Data Protection Act 2010 (PDPA) Malaysia and covers all information you provide to us while using the W 138 platform — whether through a web browser, mobile application, or any of our other communication channels.

When you register, log in, make a deposit using Touch 'n Go eWallet, GrabPay, DuitNow, or FPX, play slots, bet on Malaysia Super League football or badminton, or simply browse the W 138 platform — you are entrusting us with your personal information. We do not take that responsibility lightly.

This policy clearly sets out: what information we collect, why we need it, how it is used, who can access it, and how you can control your own data. By continuing to use the W 138 platform, you agree to the practices described in this document.

W 138 collects your personal information in several ways — directly when you provide it to us, and automatically as you use our platform. The following are the categories of information we collect:

We only collect information that is strictly necessary for the stated purposes. W 138 does not collect sensitive information such as your health records, political views, or religious beliefs.

Every piece of information we collect is used for a specific, legitimate purpose. Below is a detailed explanation of how W 138 uses your data:

• Account management: Your identity information is used to create, verify, and maintain your W 138 account. This includes the login process, password resets, and two-factor authentication.
• Financial transaction processing: Your financial data is required to process deposits via Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, CIMB Clicks, or FPX — and to verify withdrawals to your Malaysian bank account.
• KYC (Know Your Customer) Verification: We are legally required to verify the identity of members in order to comply with anti-money laundering (AML) requirements and other applicable legal obligations in Malaysia.
• Platform security: Technical data and login information are used to detect suspicious activity, prevent fraud, and ensure the integrity of the W 138 platform.
• Personalise your experience: Your gaming history helps us recommend slots, Live Casino games, or football and badminton Sports Betting odds that may interest you.
• Service communications: We use your email address and phone number to send important account notices, transaction confirmations, and security information.
• Platform improvements: Aggregated usage data (with no individual identification) is analysed to improve the user experience, platform performance, and the development of new features.

W 138 takes the security of your data seriously. We implement a range of technical and organisational measures to protect your personal information from unauthorised access, loss, misuse, or disclosure:

• 256-bit SSL Encryption: All data transmitted between your browser and W 138 servers is encrypted using 256-bit Secure Socket Layer (SSL) encryption — the same standard used by Malaysian banking institutions.
• Secure servers: Your data is stored on servers protected by strict physical and digital access controls. Only authorised W 138 staff may access members' personal data.
• Password encryption: Your account password is never stored in plain text. We use a one-way cryptographic hashing function that cannot be reversed.
• 24/7 security monitoring: Our systems are continuously monitored to detect any unusual activity or unauthorised access attempts.
• Data retention period: W 138 retains your personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law — whichever is longer. Data from accounts inactive for 7 years will be archived or deleted.

While we take every reasonable precaution, no security system is perfect. We encourage you to play your part in protecting your account by using a strong password and never sharing your login credentials with anyone.

W 138 does not sell, rent, or trade your personal information to any third party for marketing purposes. However, there are limited circumstances in which we may need to share your data with certain parties:

• Payment service providers: When you make a deposit or withdrawal via Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, Maybank2u, CIMB Clicks, or FPX, the necessary transaction information is shared with the respective provider to process the payment. These providers are bound by strict confidentiality agreements.
• Game software providers: Third-party game providers operating on the W 138 platform (such as Pragmatic Play, Evolution Gaming) may receive the minimum technical data required to run their games. They do not receive your full identity information.
• Malaysian legal authorities: W 138 will disclose your personal information to the police, courts, or Malaysian government agencies when required to do so by law, court order, or in the course of a legitimate criminal investigation.
• Technical service providers: We work with trusted third-party service providers for server hosting, platform analytics, and technical support. They access only the data necessary for their tasks and are bound by strict data protection agreements.

The W 138 platform uses cookies and similar tracking technologies to enhance your experience, maintain session security, and understand how Malaysian players use our platform.

You can manage cookies through your browser settings at any time. However, disabling essential cookies may affect the functionality of the W 138 platform, including your ability to log in or complete transactions.

As a W 138 player based in Malaysia, you have the following rights regarding the personal information we hold about you, in accordance with the Personal Data Protection Act 2010:

To exercise any of these rights, please contact the W 138 data protection team by email at support@w138.run. We will respond to your request within 30 working days in accordance with Malaysian PDPA requirements.

The W 138 platform is strictly for individuals aged 21 and above. We do not knowingly collect or process personal information from anyone under the age of 21.

All W 138 account registrations require date-of-birth verification and, as part of the KYC process, validation of a valid identity document. Should we discover that we have inadvertently collected personal data from anyone under the age of 21, we will take immediate steps to delete that data and close the account in question.

The W 138 platform may contain links or integrations with third-party services such as game providers, payment processors, or social media platforms. The W 138 Privacy Policy applies solely to our own platform.

When you leave the W 138 platform and access third-party websites or services, you are subject to their own privacy policies. W 138 is not responsible for the privacy practices or content of any such third-party websites or services. We encourage you to read the privacy policy of any third-party service you use alongside the W 138 platform.

W 138 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new Malaysian legal requirements, or technological developments. When we make material changes, we will:

• Updating the "Effective Date" at the top of this document
• Displaying a clear notice on the W 138 platform regarding the changes
• Sending email notices to registered members when changes are material

Your continued use of the W 138 platform after any amendments are published constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how W 138 handles your personal data, please contact us through the following channels:

• Data Protection Email: support@w138.run
• Live Chat: Available 24/7 via the chat icon on the W 138 platform
• Response time: Privacy enquiries will be addressed within 5 working days; formal data rights requests will be resolved within 30 working days

If you are not satisfied with our response, you have the right to lodge a complaint with Department of Personal Data Protection Malaysia or the relevant regulatory body under the Personal Data Protection Act 2010.