w138 Privacy Policy

1. Introduction & Scope

This Privacy Policy ("Policy") is issued by w138 ("w138", "we", "us", "our") and applies to all personal data processed in connection with your use of the w138 platform accessible at https://w138.bio, including all games, services, and features offered thereon.

This Policy should be read alongside the w138 Terms & Conditions, which governs the contractual relationship between you and w138. By registering an account or using the w138 platform in any capacity, you acknowledge that you have read and understood this Policy.

w138 is committed to processing personal data lawfully, fairly, and transparently in accordance with applicable data protection legislation, including the Malaysian Personal Data Protection Act 2010 (PDPA) where applicable, and the data protection requirements of the jurisdiction in which w138 holds its international gaming licence.

2. Data Controller

For the purposes of applicable data protection law, the data controller responsible for your personal data is w138, operating the platform at https://w138.bio.

For all data protection enquiries, correction requests, deletion requests, or complaints, you may contact w138 via:

• Live Chat: Available 24/7 on the w138 platform
• Email: [email protected]

3. Data We Collect

w138 collects personal data in the following categories depending on how you interact with the platform:

3.1 Registration Data

When you create a w138 account, we collect: full legal name, date of birth, residential address, email address, and mobile phone number. This data is required to establish your account and verify your eligibility (21+ age requirement).

3.2 KYC Verification Data

As part of our Know Your Customer (KYC) obligations under our gaming licence, we may collect copies of: government-issued photo identification (MyKad, passport, driving licence), proof of address documents (utility bills, bank statements), and payment method verification documents. This data is processed solely for identity verification and regulatory compliance purposes.

3.3 Financial Data

We collect data relating to your deposits, withdrawals, and transaction history on the w138 platform. Payment instrument details (such as bank account numbers or e-wallet identifiers) are collected and stored in accordance with applicable financial data protection standards. w138 does not store full card numbers or CVV codes.

3.4 Gameplay Data

We record data relating to your gameplay activity including game selections, bet amounts, outcomes, session durations, and responsible gaming tool usage. This data is used for platform operation, regulatory reporting, fraud prevention, and responsible gaming monitoring.

3.5 Technical Data

We automatically collect certain technical data when you access the w138 platform: IP address, browser type and version, operating system, device identifiers, session timestamps, and pages visited. This data is used for platform security, fraud detection, and performance optimisation.

3.6 Communications Data

We retain records of communications between you and the w138 support team, including live chat transcripts and email correspondence. These records are maintained for quality assurance, dispute resolution, and regulatory compliance purposes.

4. How We Use Your Data

w138 uses your personal data for the following purposes:

• Account creation and management — establishing and maintaining your w138 account, verifying your identity, and providing access to platform services;
• Contract performance — processing deposits, withdrawals, and bet settlements in MYR as part of the service agreement;
• Regulatory compliance — fulfilling KYC obligations, AML/CFT reporting requirements, and licensing conditions imposed by our gaming authority;
• Fraud prevention and security — detecting and preventing fraudulent transactions, account takeovers, and money laundering activity;
• Responsible gaming — monitoring gameplay patterns to identify potential problem gambling indicators and applying self-exclusion or limit tools where appropriate;
• Customer support — responding to enquiries, resolving disputes, and providing assistance with account or payment matters;
• Platform improvement — analysing aggregated, anonymised usage data to improve the w138 platform's features and performance;
• Marketing communications — sending promotional offers and updates where you have provided explicit consent, and where permitted under applicable law. You may withdraw marketing consent at any time via your account settings.

5. Legal Basis for Processing

w138 processes your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the w138 service you have registered for, including account management, transaction processing, and gameplay;
• Legal obligation: Processing required to comply with KYC, AML/CFT, and gaming licence regulatory requirements;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where our legitimate interests are not overridden by your data protection rights;
• Consent: Processing for direct marketing communications, where explicit consent has been obtained and can be withdrawn at any time.

6. Sharing Your Data

w138 does not sell, rent, or trade your personal data. We may share your data with third parties only in the following circumstances:

• Payment processors and e-wallet providers (such as Touch n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank) — to process your deposits and withdrawals. These providers process data under their own privacy policies and are subject to applicable financial data protection standards;
• Game software providers — to facilitate gameplay, game software providers may process technical data (session identifiers, bet data) required to run the games. No personal identification data is shared beyond what is technically required;
• Identity verification and KYC service providers — third-party KYC verification platforms engaged by w138 to process identity documents. These providers operate under strict data processing agreements;
• Regulatory and law enforcement authorities — where w138 is legally required to disclose data pursuant to a lawful request, court order, or regulatory requirement under our gaming licence;
• Fraud prevention and AML/CFT services — to verify transactions and screen for money laundering risk as required by our licensing obligations.

7. International Data Transfers

As w138 operates under international gaming licensing, some of your personal data may be processed or stored in jurisdictions outside Malaysia. Where such transfers occur, w138 ensures that appropriate safeguards are in place — including contractual protections equivalent to those required under applicable data protection law — to ensure that your data receives an equivalent level of protection regardless of where it is processed.

You may request further information about the safeguards governing international data transfers by contacting the w138 support team.

8. Data Retention

w138 retains personal data for the following periods unless a longer retention period is required by law:

• Account and KYC data: Retained for the duration of your w138 account plus a minimum of 5 years following account closure, as required by our gaming licence and anti-money laundering obligations;
• Transaction and financial data: Retained for a minimum of 7 years following the date of each transaction, as required by applicable financial record-keeping regulations;
• Gameplay and session data: Retained for a minimum of 5 years from the date of each session;
• Support communications: Retained for 3 years from the date of the communication unless a longer period is required for ongoing dispute resolution;
• Technical and log data: Typically retained for 12 months, after which it is anonymised or deleted.

Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised.

9. Cookies & Tracking Technologies

w138 uses cookies and similar tracking technologies on the platform for the following purposes:

• Essential cookies: Required for the platform to function, including session management (keeping you logged in), security tokens, and load balancing. These cookies cannot be disabled without impairing platform functionality;
• Functional cookies: Used to remember your preferences such as language settings and display options;
• Analytics cookies: Used to collect aggregated, anonymised data about platform usage to improve performance and user experience. w138 uses privacy-respecting analytics that do not transmit identifiable data to third-party advertising networks;
• Fraud prevention cookies: Used to detect and prevent fraudulent activity and account takeover attempts.

w138 does not use third-party advertising cookies or participate in cross-site behavioural advertising networks. You may manage cookie preferences through your browser settings; however, disabling essential cookies will affect your ability to use the w138 platform.

10. Your Rights

Subject to applicable data protection law, you have the following rights with respect to your personal data held by w138:

• Right of access: You may request a copy of the personal data w138 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where w138 no longer has a legal or legitimate basis to retain it. Note that regulatory retention obligations may limit the scope of this right;
• Right to restriction: You may request that we restrict processing of your data in certain circumstances, such as while a dispute is being investigated;
• Right to data portability: You may request a machine-readable copy of the personal data you have provided to w138 for transfer to another service provider;
• Right to object: You may object to processing based on legitimate interests and to direct marketing processing at any time;
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact w138 support via live chat or at [email protected]. w138 will respond to verified requests within 30 days. Where a request is complex or numerous, we may extend this period by a further 60 days with notice.

11. Children's Privacy

The w138 platform is strictly intended for adults aged 21 and over. w138 does not knowingly collect personal data from individuals under 21 years of age. If you believe that a minor has provided personal data to w138, please contact us immediately at [email protected]. Upon confirmation, w138 will take prompt steps to delete the data and close any associated account.

12. Security Measures

w138 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption for all data in transit between your browser and w138 servers;
• Encryption at rest for all stored personal and financial data;
• Role-based access controls limiting staff access to personal data to those with a legitimate operational need;
• Regular penetration testing and vulnerability assessments of the w138 platform infrastructure;
• Multi-factor authentication required for all internal administrative access;
• Intrusion detection systems and 24/7 security monitoring.

Despite these measures, no internet transmission is entirely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, w138 will notify you and the relevant supervisory authority in accordance with applicable legal requirements.

13. Changes to This Policy

w138 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or regulatory requirements. Material changes will be communicated to registered players via the email address associated with their account, with at least 14 days' notice before the revised Policy takes effect.

The date of the most recent revision is displayed at the top of this document. Continued use of the w138 platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must cease using the platform and request account closure.

14. Contact & Complaints

For any questions, requests, or complaints relating to this Privacy Policy or w138's data processing practices, please contact:

• Live Chat: Available 24/7 on the w138 platform (average response: under 5 minutes)
• Email: [email protected]

Support is available in English, aligned to Malaysia Time (MYT, UTC+8).

If you are not satisfied with w138's response to your data protection query or complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction where you reside or where the alleged infringement occurred.