W138 Privacy Policy – Personal Data Protection for Malaysian Players

1Introduction & Scope of This Privacy Policy

This Privacy Policy is published by w138 ("we", "platform", "w138") and applies to all users who access or use the w138.click online betting platform, including all related services such as Sports Betting, Live Casino, table games, e-sports, slots, and virtual sports.

W138 recognises that your trust is our most valuable asset. Without it, no meaningful relationship can be built between a platform and its members. We are therefore fully committed to being transparent about how we handle your personal data as a registered Malaysian player.

This policy outlines:

• Types of personal data collected by w138
• How and why your data is collected and used
• Who your data may be shared with under certain circumstances
• Security measures taken to protect your data
• Your rights regarding your personal data at w138

2Personal Data We Collect

W138 only collects data necessary for the legitimate purposes stated in this policy. The following are the categories of data we may collect:

W138 does not collect sensitive data such as medical records, biometric information, or credit card details directly. All payments are processed by third-party payment processors, who are responsible for the security of their own card data.

3How We Collect Data

W138 collects your personal data through several means, including:

• Account Registration: When you register a new account at w138, you provide basic information such as your name, phone number and email address directly.
• Platform Usage: When you log in and use w138's services — including placing bets on Malaysia Super League or EPL football, playing live casino, or using table game features — these activities are automatically recorded.
• Financial Transactions: Each time you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, Maybank2u, or CIMB Clicks, the relevant transaction details are recorded for accounting and fraud prevention purposes.
• Tracking Technologies: Cookies, web pixels, and similar technologies are used to collect usage data and improve the user experience on the w138 platform.
• Support Interactions: All communications between you and the w138 customer support team via live chat, email or other channels may be retained for training, quality assurance and dispute resolution purposes.
• Third-Party Sources: For identity verification purposes, w138 may verify your information through approved third-party identity verification providers.

4How We Use Your Personal Data

Personal data collected by w138 is used for the following legitimate and stated purposes:

• Account Management: To create, verify and maintain your w138 account, including a secure login process.
• Transaction Processing: To process your deposits and withdrawals quickly and accurately using supported local Malaysian payment methods.
• Security & Fraud Prevention: To detect, investigate, and prevent fraud, money laundering, illegal activity, and security threats that could compromise the integrity of the w138 platform.
• Legal Compliance: To fulfil applicable legal and regulatory obligations, including identity verification (KYC) requirements and anti-money laundering (AML) reporting.
• Service Improvement: To analyse player usage patterns and preferences in order to improve the platform, introduce relevant new games, and enhance the overall experience at w138.
• Service Communications: To send you important notifications relating to your account, transactions, policy updates, or exclusive w138 promotions relevant to you.
• Customer Support: To handle your enquiries, complaints and support requests efficiently and effectively through w138's Malay-speaking support team.
• Responsible Gambling: To monitor betting patterns and provide appropriate support or intervention where signs of concerning gambling behaviour are identified.

5Data Sharing with Third Parties

W138 does not sell or disclose your personal data to third parties for their own marketing purposes. However, in the following limited circumstances, data may be shared:

• Payment Processors: Required transaction information is shared with approved payment processors (such as FPX, Touch 'n Go, and GrabPay providers) to facilitate deposits and withdrawals. These processors are subject to their own privacy policies and security standards.
• Game Software Providers: Limited game data may be shared with w138's partner casino software and Sports Betting providers to ensure proper platform functionality.
• Legal Requirements: W138 may disclose data to authorities, law enforcement agencies or courts where required by law or a valid court order.
• Fraud Prevention: In cases where serious fraud is suspected, w138 may share relevant information with recognised fraud prevention agencies.
• Business Transfer: In the event of a merger, acquisition or business asset transfer, member data may be transferred as part of those assets, subject to notification to members.

6Data Security Measures

W138 invests seriously in security infrastructure to protect your personal data. The security measures we employ include:

• 256-bit SSL Encryption: All communications between your device and w138's servers are encrypted using the latest TLS/SSL protocols to prevent data interception.
• Secure Servers: Your data is stored in data centres protected by strict physical access controls, intrusion detection systems, and 24/7 monitoring.
• Internal Access Controls: Access to member data at w138 is restricted to staff who require it to perform their duties. The principle of least privilege is strictly enforced.
• Two-Factor Authentication: W138 supports and strongly encourages the use of two-factor authentication (2FA) on all member accounts for an added layer of protection.
• Regular Security Audits: The w138 platform undergoes regular penetration testing and security audits conducted by independent security experts.
• Incident Response Procedures: W138 has established cybersecurity incident response procedures in place, including a member notification mechanism in the event of a data breach.

While w138 takes all reasonable precautions, no security system in the digital world is perfect. We encourage members to play their part by keeping their w138 account password secure and reporting any suspicious activity to us promptly.

7Use of Cookies at W138

The w138 platform uses cookies and similar tracking technologies to enhance your experience. The types of cookies we use are as follows:

• Essential Cookies: Required for core platform functionality — including maintaining your login status, game session details and security. These cookies cannot be disabled without affecting the functionality of the w138 platform.
• Performance Cookies: Helps w138 understand how members use the platform — including frequently visited pages, time spent in each section, and technical errors encountered. This information is used in aggregated form for improvements.
• Preference Cookies: To save your preferences — such as interface language, display settings and notification preferences — so you do not need to reconfigure them each time you log in to w138.
• Analytics Cookies: W138 uses analytics tools to understand overall usage trends for product development and user experience optimisation purposes.

You can manage your cookie settings through your web browser. However, disabling certain cookies may affect the functionality and your experience on the w138 platform. For non-essential cookies, you may decline or withdraw consent at any time via our platform's cookie settings.

8Data Retention & Deletion

W138 retains your personal data only for as long as necessary for the purposes stated in this policy or as required by law. Our general data retention principles are as follows:

• Active Account Data: While your account remains active and you are using w138's services, account data will be retained to ensure continuity of service.
• Financial Transaction Data: Financial transaction records are retained for a minimum of 7 years after a transaction occurs, in line with Malaysia's accounting and anti-money laundering legal requirements.
• Data After Account Closure: After your w138 account is closed, certain personal data may be retained for up to 5 years for legal compliance, dispute resolution, and fraud prevention purposes.
• Communication Logs: Customer support logs and communications are retained for 2 years for service quality purposes and future reference as needed.
• Technical Data: Technical log data, such as server access logs, is retained for 90 days before being automatically deleted.

Once data is no longer needed and the minimum retention period has elapsed, w138 will securely delete or destroy the data using approved data deletion procedures.

9Your Rights as a W138 Member

As a w138 member whose data is being processed, you have the following rights regarding your personal data:

To exercise any of the rights above, please contact the w138 privacy team via email or the designated support channel. We will process your request within 14 business days and may request identity verification before processing certain requests.

10Contact Us About Privacy

If you have any questions, concerns or complaints regarding how w138 handles your personal data, we encourage you to contact us directly in the first instance:

• Privacy Email: support@w138.click — please mark the email subject as "Privacy Enquiry"
• Live Chat: Contact the w138 support team via the live chat button on the platform, available 24/7
• Response Time: We aim to respond to all privacy enquiries within 3 business days and resolve issues within 14 business days

If you are not satisfied with w138's response, you have the right to lodge a complaint with the relevant regulatory body or data protection agency in your jurisdiction.

Effective Date: This Privacy Policy takes effect from January 2026 and supersedes all previous versions. Any material changes will be communicated to registered w138 members via email at least 14 days before the changes take effect.