Privacy Policy onlien138 – Malaysian Player Personal Data Protection

1 onlien138 Privacy Policy Introduction

onlien138 takes player privacy protection very seriously. This Privacy Policy is established to ensure every player clearly understands how their personal data is handled when using our online entertainment platform.

As a platform operating in the Malaysian market, we fully comply with Malaysia's Personal Data Protection Act 2010 (PDPA). All our data processing activities are carried out in accordance with the seven key PDPA principles: the General Principle, Notice and Choice Principle, Disclosure Principle, Security Principle, Integrity Principle, Access Principle, and the Principle limiting the processing of personal data.

This document supersedes all previous versions of the Privacy Policy and takes effect from the update date shown. onlien138 reserves the right to amend this Policy from time to time, and any material changes will be communicated to players via email or in-app notification.

2 Personal Data We Collect

Onlien138 collects your personal data through several means — directly when you register or use the platform, automatically through tracking technologies, and occasionally from approved third-party sources for identity verification purposes.

Data you provide directly:

• Full name, date of birth, and identification card number (for KYC)
• Email address and mobile phone number
• Bank account or e-wallet information for payment processing
• Records of communications with our customer support team
• Account preferences and settings you configure

Data collected automatically:

• IP address and geographic location information (state/city only, not exact address)
• Device type, operating system, and web browser used
• In-platform gaming activity and transaction history
• Cookie data and session identifiers to ensure a seamless experience
• Access time logs and usage patterns for security purposes

3 How We Use Your Data

The personal data we collect is used solely for legitimate purposes related to the operation of the onlien138 platform. We do not use your data for undisclosed purposes without obtaining your consent first.

• Verifying your identity and complying with KYC requirements and the 18+ age limit
• Processing deposits and withdrawals securely and efficiently
• Managing your account and providing customer support
• Sending account-related communications such as transaction confirmations and security notifications
• Sending promotional information and exclusive offers (with your consent)
• Detecting and preventing fraud, money laundering, and other illegal activities
• Complying with applicable legal and regulatory obligations
• Enhancing user experience based on analysis of anonymized usage patterns

4 Data Sharing with Third Parties

Onlien138 does not sell, rent, or commercially exploit players' personal data to any third party. However, in certain limited situations, data may be shared with the following parties:

• Payment providers: Only the data required to process transactions (name, account number) is shared with authorised payment gateways such as FPX, DuitNow, and e-wallet providers. All such providers are bound by strict data protection agreements.
• Game providers: Anonymous account identifiers are shared with our premium game providers to ensure smooth gaming sessions. Real names and financial information are not shared.
• Authorities: Data may be disclosed to law enforcement authorities or regulatory bodies when lawfully required under Malaysian law.
• Technical service providers: Our server infrastructure and cybersecurity providers have limited access to system data necessary to perform their services, subject to binding confidentiality agreements.

All third parties that receive personal data from onlien138 players are required to handle that data to security and confidentiality standards equal to or exceeding our own.

5 Data Security Measures

We continually invest in security infrastructure to ensure your personal data remains protected at all times. Our technical and organisational security measures include:

• 256-bit SSL/TLS encryption for all data communications between players and our servers
• Intrusion detection system (IDS) and next-generation firewall
• Role-based access control ensuring only authorized personnel can access player data
• Regular security scans and penetration testing by independent experts
• Encrypted data backups stored across geographically separate locations for disaster recovery protection
• Mandatory data security training for all onlien138 staff annually
• Established incident response procedures to address any data breaches promptly

6 Cookie and Tracking Technology Usage

Onlien138 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, betting slip, and session security. These cookies cannot be disabled.
• Performance Cookies: Helps us understand how players use the platform so we can continuously improve it. Data is collected in a form that cannot identify individuals.
• Preference Cookies: Storing your preference settings such as language, theme, and game preferences to provide a more personalized experience.

You can manage cookies through your web browser settings. However, disabling essential cookies may affect the functionality of certain parts of the platform. For more information on managing cookies, refer to your web browser's help documentation.

7 Children's Data Protection

The onlien138 platform is exclusively for adult users aged 18 and above. We do not knowingly collect or store personal data of individuals under 18.

If we discover that personal data belonging to a person under 18 years of age has been collected without proper age verification, we will immediately delete that data and close the associated account. Any balance in that account will be placed on hold pending an investigation carried out in accordance with our standard procedures.

If you are a parent or guardian and believe your child has registered an account on onlien138, please contact our support team immediately so we can take the appropriate action.

8 Cross-Border Data Transfers

In some situations, your personal data may be processed or stored outside Malaysia, particularly when involving international service providers such as cloud infrastructure or global Live Casino game providers.

When such data transfers occur, onlien138 ensures that equivalent protection is provided to your data through:

• Legally binding data processing agreements with all providers outside Malaysia
• Ensuring providers operate in countries with equivalent or stronger data protection laws
• Use of standard data protection clauses in all contracts with international third parties

9 Updates to This Privacy Policy

Onlien138 will review and update this Privacy Policy from time to time to reflect changes in our practices, technologies used, legal requirements, or player feedback.

When material changes are made to this Privacy Policy, we will notify players via:

• Push notifications in the onlien138 mobile app
• Email to the address registered to your account
• A prominent banner or notice on the platform's main page

The latest version of this Privacy Policy is always available on this page with the update date clearly stated. Continued use of the onlien138 platform after a change notice is considered acceptance of the updated Privacy Policy.

10 Contact the onlien138 Privacy Team

If you wish to exercise any of your privacy rights, have questions about how we handle your personal data, or would like to raise a privacy complaint, please contact our Data Protection Officer (DPO) team through the following channels:

• Dedicated privacy email: [email protected]
• Live Chat in the app or website – mark the topic as "Privacy / Personal Data"
• General support: [email protected] (for non-urgent enquiries)

We aim to respond to all privacy rights requests within 3 business days. For more complex requests, we will notify you within 3 business days with an estimated timeframe for full resolution, which will not exceed 30 calendar days in accordance with PDPA 2010.