K138 Privacy Policy – Malaysia Member Personal Data Protection

This Privacy Policy explains how k138 ("Platform", "We", "k138") collects, uses, discloses and protects your personal information when you access or use the k138 website at https://k138.top, our mobile app, and all related services we provide.

By registering as a member or continuing to use the k138 platform, you acknowledge that you have read, understood and agreed to the terms set out in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the platform and contact us to close your account.

This policy applies to all k138 platform users regardless of access method — whether via web browser, Android app, iOS app or desktop version. We encourage you to read this document in full and contact our support team if you have any questions.

K138 collects various types of information to ensure the services we provide function smoothly, securely, and meet the needs of every member. This information is collected directly from you as well as automatically during your use of the platform.

Information you provide directly:

• Full name, date of birth, and national identification number (MyKad) or passport for identity verification (KYC)
• Email address, mobile number and residential address provided during account registration
• Bank account details, credit/debit card numbers, or digital wallet information for financial transaction purposes
• Supporting documents such as bank statements, utility bills or other identification documents requested during verification
• Messages and communication records you send to our customer support team
• Feedback, reviews, and survey responses you voluntarily provide

Information collected automatically:

• IP address, device type, operating system and web browser version used
• Gaming activity records including date, time, game type, and wagering amounts
• Country and region-level location data based on IP address
• Cookies and session identifiers to maintain your login state and display preferences
• Platform performance data and technical error logs for system improvement purposes

Every piece of information we collect has a clear and legitimate purpose. k138 only uses your personal data for the following purposes and will not use it beyond the stated scope without your prior consent.

For marketing and promotional purposes, we will only send you communications based on the consent you provided during registration. You may withdraw this consent at any time through your account settings or by contacting our customer support.

K138 takes seriously its responsibility not to disclose your personal information without legitimate grounds. However, there are certain situations where sharing information with specific parties is necessary to ensure the platform operates lawfully and securely.

Your information may be shared with the following parties:

• Payment service providers — banking institutions, digital wallet providers, and payment processors used to process your deposit and withdrawal transactions
• Identity verification service providers — third-party providers responsible for verifying the authenticity of your identity documents during the KYC process
• Game providers — game software companies that provide slots, Live Casino, and fish shooting games on the k138 platform, which may require basic session data for technical purposes
• Statutory authorities — law enforcement agencies, regulatory bodies, or courts when required by applicable Malaysian law
• Audit and security partners — independent audit firms and cybersecurity experts engaged to verify our system's compliance and resilience

Protecting your personal data is k138's top priority. Our platform employs multiple layers of technical and administrative security to ensure your information is always shielded from unauthorized access, data breaches, or misuse.

The security measures we have implemented include:

• 256-bit SSL/TLS encryption for all communications between your browser and k138 servers
• Passwords are stored using a one-way bcrypt hashing algorithm — your original password is never stored in plain text
• Two-factor authentication (2FA) is available for all member accounts as an additional layer of security
• Intrusion detection systems (IDS) and intrusion prevention systems (IPS) that monitor platform traffic 24 hours a day
• Internal role-based access control (RBAC) ensuring k138 staff can only access data relevant to their responsibilities
• Regular security audits by independent third-party cybersecurity firms
• Automatic daily data backups with additional encryption for backup files

While k138 takes every reasonable measure to protect your data, no internet security system can guarantee 100% absolute protection. We therefore encourage you to play your part in keeping your account secure by using a strong password and not sharing your login credentials.

K138 retains your personal information for as long as it is needed to fulfil the original purpose of collection or as required by applicable Malaysian law. Once the retention period ends, data will be securely deleted or anonymised.

• Active account data — retained for as long as your account is active and for a period of 7 years after account closure for legal compliance purposes
• Financial transaction records — retained for a minimum of 7 years in line with Malaysia's tax and AML legal requirements
• Support communication records — retained for 3 years for reference and dispute resolution purposes
• System logs and technical data — retained for 90 days before being automatically deleted
• Marketing data — retained until you withdraw consent or request deletion

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you as a k138 member have clear rights regarding your personal information. k138 is committed to respecting and facilitating the exercise of these rights.

• Right of Access — You have the right to request a copy of the personal information we hold about you. This request will be processed within 14 business days.
• Right to Rectification — If the information we hold is inaccurate or out of date, you have the right to request its prompt correction.
• Right to Erasure — You may request the deletion of your personal data, subject to applicable legal retention obligations.
• Right to Restrict Processing — You may request that we restrict the use of your data in certain situations, for example while a dispute about its accuracy is ongoing.
• Right to Withdraw Consent — For processing based on your consent (such as marketing communications), you may withdraw that consent at any time.
• Right to File a Complaint — If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of the above rights, please contact the k138 customer support team via live chat on the platform. Our team is available 24/7 and will guide you through the relevant process.

K138 uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance, and maintain the security of your session. Cookies are small text files stored on your device by your web browser.

Types of cookies we use:

• Essential Cookies — Required for core platform functions such as login session verification, cart management, and security settings. These cookies cannot be disabled.
• Performance Cookies — Collects anonymous information about how visitors use our platform to help us improve the user experience.
• Functional Cookies — Saves your preferences such as language selection, display settings, and content personalisation for future sessions.
• Security Cookies — Helps identify suspicious activity and protects your account from unauthorised access attempts.

You can manage cookie settings through your web browser. However, disabling certain cookies may affect platform functionality. For the best experience on k138, we recommend allowing essential and functional cookies.

K138 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, technological developments, or new legal requirements. Any significant amendments will be communicated to members via:

• A prominent notice on the k138 platform homepage at least 14 days before the changes take effect
• Notification email sent to your registered email address
• In-app notifications on the k138 mobile app (if you have enabled notifications)

Your continued use of the k138 platform after the effective date of any amendments constitutes your acceptance of the updated terms. We encourage you to review this Privacy Policy page periodically to stay informed about how we protect your information.