online138 is committed to protecting the privacy and security of your personal data. This Privacy Policy explains what information we collect from Malaysian players and registered users, how we use it, who we share it with, and the rights available to you under internationally recognised data protection principles.
Six core commitments that govern how online138 handles your personal information — at every stage of your journey as a player.
We collect only the personal data that is strictly necessary to provide our services, verify your identity, and meet our obligations under our international gaming licence. We do not collect data speculatively.
All personal data transmitted to and from the online138 platform is encrypted using industry-standard TLS protocols. Data at rest is protected using AES-256 encryption. Access to personal data is strictly role-limited.
online138 does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes — under any circumstances. Your data is yours.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by our licensing obligations. Retention schedules are documented and enforced.
You have the right to access, correct, and request deletion of your personal data. You may also object to certain processing activities. Requests are handled within 30 days of receipt.
We use cookies for essential platform functionality and optional analytics. Our Cookie Policy (Section 11) explains each category, its purpose, and how you can manage your preferences.
This Privacy Policy ("Policy") is issued by online138 ("we", "us", "our", "the Company") and applies to all personal data collected from individuals ("you", "User", "Player") who access or use the online138 platform, including all associated web pages, mobile-optimised interfaces, customer support channels, and promotional communications, accessible at https://online138.cam ("the Platform").
online138 operates as a trusted online casino and sports betting platform serving players across Malaysia, including Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and other major cities and regions. In providing our services — live casino games, sports betting, instant MYR deposits and withdrawals via Touch 'n Go eWallet, DuitNow, Maybank, CIMB, and other Malaysian payment methods — we necessarily process personal data about our users.
This Policy has been prepared in accordance with internationally recognised data protection principles applicable under our licensing framework, and reflects our genuine commitment to handling your personal information with transparency, integrity, and care. We encourage you to read this Policy carefully before using the Platform.
For the purposes of this Policy, the following definitions shall apply:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person — including name, identification number, email address, IP address, device identifiers, financial transaction records, and gaming activity data. |
| "Processing" | Any operation performed on personal data, whether automated or manual — including collection, storage, use, disclosure, transfer, erasure, or destruction. |
| "Data Controller" | The entity that determines the purposes and means of processing personal data. For users of the Platform, online138 is the Data Controller. |
| "Data Processor" | A third party that processes personal data on behalf of online138 under a written data processing agreement — for example, payment processors (DuitNow, FPX, Touch 'n Go eWallet) and IT infrastructure providers. |
| "KYC Data" | Identity verification documents and information collected as part of the Know Your Customer process — including copies of MyKad, passport, utility bills, and proof of payment method ownership. |
| "Sensitive Data" | A subset of personal data requiring heightened protection — including financial account details, transaction history, and identity documents. online138 treats all KYC Data as Sensitive Data. |
| "Retention Period" | The defined duration for which online138 retains a specific category of personal data before it is securely deleted or anonymised. |
online138 acts as the Data Controller in respect of all personal data collected from users of the Platform. As Data Controller, online138 determines the purposes for which your personal data is collected and the means by which it is processed.
For all data protection enquiries, requests to exercise your rights, or complaints regarding our data handling practices, please contact us using the contact details provided in Section 15 of this Policy. We aim to acknowledge all data-related enquiries within 5 business days and to resolve them fully within 30 calendar days of receipt.
online138 collects personal data from you through several channels and at different stages of your relationship with us. The categories of personal data we collect are as follows:
online138 processes your personal data for the following specific purposes. Each purpose is associated with a lawful basis for processing:
| Purpose | Categories of Data Used | Lawful Basis |
|---|---|---|
| Account registration and maintenance | Registration Data, Device Data | Performance of contract |
| Identity verification (KYC) | KYC Data, Registration Data | Legal obligation; legitimate interests |
| Processing deposits and withdrawals | Financial Data, KYC Data | Performance of contract |
| Anti-money laundering compliance | Financial Data, KYC Data, Gaming Data | Legal obligation |
| Responsible gambling monitoring | Gaming Activity Data, Financial Data | Legitimate interests; legal obligation |
| Customer support delivery | Communications Data, Account Data | Performance of contract |
| Fraud prevention and security | Technical Data, Financial Data, KYC Data | Legitimate interests; legal obligation |
| Platform improvement and analytics | Technical Data, Gaming Activity Data | Legitimate interests |
| Promotional communications (opted-in) | Registration Data, Gaming Activity Data | Consent |
Where processing is based on your consent (for example, for marketing communications), you may withdraw that consent at any time by updating your Account preferences or contacting Customer Support. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to withdrawal.
online138 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual data protection safeguards:
We share financial transaction data with Malaysian payment processors and financial institutions — including DuitNow, FPX network banks (Maybank, CIMB, Public Bank, Hong Leong, RHB), Touch 'n Go eWallet, Boost, and GrabPay — for the purpose of processing deposits and withdrawals. These entities process your payment data as Data Processors under binding service agreements.
We may share your KYC documents and registration details with third-party identity verification service providers engaged to assist with KYC processes. Such providers are bound by strict confidentiality and data protection obligations.
Our Platform operates on third-party cloud infrastructure and software services. These providers may have access to personal data as a technical necessity of their services. All such providers are engaged under data processing agreements that restrict the use of your data to service delivery only.
We may disclose personal data to relevant regulatory bodies, law enforcement agencies, or other competent authorities where required to do so by applicable law, court order, or in connection with the investigation of suspected fraud, money laundering, or other illegal activity. online138 will comply with lawful disclosure requests while taking all reasonable steps to notify affected users where legally permissible to do so.
In the event that online138 undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer by a notice posted on the Platform prior to completion.
As online138 operates globally and utilises international technology infrastructure, your personal data may be transferred to and processed in jurisdictions outside of Malaysia. This may include transfers to countries where data protection laws differ from those applicable in Malaysia.
Where such transfers occur, online138 implements appropriate safeguards to ensure that your personal data receives an adequate level of protection, including:
You may request further information regarding the safeguards applicable to any specific transfer of your personal data by contacting us using the details in Section 15.
online138 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by our international gaming licensing obligations. The following retention periods apply to the main categories of data we hold:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account & Registration Data | Duration of Account + 5 years post-closure | Licensing obligation; dispute resolution |
| KYC & Identity Documents | Duration of Account + 5 years post-closure | Anti-money laundering compliance |
| Financial Transaction Records | Duration of Account + 7 years post-closure | AML obligations; audit trail requirements |
| Gaming Activity Data | Duration of Account + 3 years post-closure | Responsible gambling monitoring; dispute resolution |
| Customer Support Communications | 2 years from date of communication | Complaint resolution; quality assurance |
| Technical & Device Data (logs) | 12 months on a rolling basis | Security monitoring; fraud detection |
| Marketing Preferences | Until consent is withdrawn | Consent-based processing |
Upon expiry of the applicable Retention Period, personal data is securely and irreversibly deleted or anonymised using industry-standard methods. Anonymised data (which can no longer be attributed to any individual) may be retained indefinitely for statistical and analytical purposes.
Consistent with internationally recognised data protection principles and our licensing framework, online138 recognises and respects the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 15.
You may request a copy of the personal data we hold about you, along with information about how it is being processed. We will provide this within 30 days of a valid request.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or updated without undue delay.
In certain circumstances, you may request the deletion of your personal data — for example, where it is no longer necessary for the purpose for which it was collected and no legal retention obligation applies.
You may request that we temporarily suspend the processing of your personal data in specific circumstances — for example, while the accuracy of your data is being verified following a rectification request.
Where processing is based on contract or consent and carried out by automated means, you may request that we provide your personal data in a structured, machine-readable format.
You have the right to object to processing based on legitimate interests — including profiling — and to withdraw consent for marketing communications at any time, with immediate effect.
online138 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:
Notwithstanding the above measures, no electronic transmission or storage method is 100% secure. You are responsible for maintaining the confidentiality of your Account credentials. online138 will never request your password through any channel, including live chat, email, or telephone.
online138 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that enable certain Platform functionality and help us understand how users interact with our services.
We categorise our cookies as follows:
| Category | Purpose | Consent Required |
|---|---|---|
| Required for the Platform to function — including login session management, security tokens, and load balancing. Cannot be disabled without impacting Platform usability. | No — technically necessary | |
| Remember your preferences — such as language selection (English / Bahasa Melayu / Chinese) and preferred deposit method — to improve your experience on return visits. | Yes | |
| Collect aggregated, anonymised data on Platform usage — including page views, session duration, and feature engagement — to inform platform improvement decisions. | Yes | |
| Used where you have opted in to receive promotional communications. May track interactions with marketing emails or on-site promotions to measure campaign effectiveness. | Yes — opt-in only |
You can manage your cookie preferences through your browser settings. Please note that disabling non-essential cookies will not affect your ability to register, deposit, play, or withdraw — but may affect the availability of certain preference-based features.
The online138 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from any person under 21 years of age. Age verification is performed as part of the KYC process for all registered accounts.
If we become aware that personal data has been collected from a person under the age of 21 — whether through Account registration or otherwise — we will take immediate steps to delete that data and close the associated Account. Parents or guardians who believe that a minor has provided personal information to online138 should contact us immediately using the details in Section 15.
The Platform may contain integrations with, or references to, third-party payment services — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, and FPX — for the purpose of processing deposits and withdrawals. When you interact with these third-party services, their own privacy policies and terms of service will govern the processing of your data by those entities.
online138 is not responsible for the privacy practices or content of third-party services. We recommend that you review the privacy policies of any third-party service you interact with in connection with your use of the Platform.
Game content on the Platform may be provided by third-party game studios. Where game providers collect technical data through their software delivery infrastructure, this is governed by their own data processing terms, which are incorporated into our agreements with those providers. Such processing is limited to technical delivery data and does not include your Account registration or financial details.
online138 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. The revised Policy will be posted on this page with an updated "Last Reviewed" date at the top of the document.
For material changes that significantly affect your rights — such as a change in the categories of data we collect, a new purpose for processing, or a new category of third-party recipients — we will provide advance notice via a prominent banner on the Platform or by email to your registered address, with a minimum notice period of 14 days before the changes take effect.
Your continued use of the Platform following the effective date of a revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you must cease using the Platform and contact Customer Support to close your Account.
For all privacy-related enquiries — including requests to exercise your data rights, questions about this Policy, concerns about our data handling practices, or to report a suspected data breach — please contact the online138 Data Protection team through the following channels:
When submitting a data rights request, please provide your registered Account username, the email address associated with your Account, and a clear description of the request or concern. We may require you to verify your identity before acting on any data access, correction, or deletion request.
Our Customer Support team is available 24/7 in English, Bahasa Melayu, and Chinese. You can also visit our FAQ for quick answers to common privacy and account questions.
For players aged 21 and above only. online138 supports responsible gambling.