Privacy Policy mr138 —
Protection of Our Members' Personal Data

Welcome to the mr138 Privacy Policy. This document is published by mr138.vip and applies to all members who register and use our online gaming platform. By registering as a member or continuing to use mr138 services, you confirm that you have read, understood, and fully accepted this privacy policy.

Mr138 is committed to protecting every user's privacy at the highest level. We fully comply with Malaysia's Personal Data Protection Act 2010 (PDPA), which governs how organisations in Malaysia collect, process, and store individuals' personal data. In addition to the PDPA, we follow internationally recognised best practices in the online gaming industry.

This Privacy Policy applies to all information you provide to us through the mr138.vip website, the mr138 mobile app, and all our official communication channels including email, live chat, and WhatsApp. If you disagree with any part of this policy, we strongly advise you not to continue using the mr138 platform.

Mr138 collects various types of personal data during registration, platform use, and financial transactions. We only collect data that is strictly necessary for the stated purposes, in accordance with the data minimisation principle under Malaysia's PDPA.

All KYC documents you submit — including copies of your identification card, bank statements, and verification selfies — are stored in encrypted systems and accessible only to authorised compliance staff. We do not store credit or debit card details directly; all transactions are processed through certified third-party payment gateways.

Mr138 uses collected personal data solely for legitimate and necessary purposes in delivering the best service to you. We do not use your data for unrelated purposes without your prior consent.

The following are the primary purposes for which your personal data is used:

• Account management: Creates, verifies, and maintains your member account, including the KYC process and age verification.
• Transaction processing: Processes deposits, withdrawals, and all financial transactions between you and the mr138 platform securely and accurately.
• Service delivery: Grants access to all games, promotions, VIP programmes, and platform features you are eligible to use.
• Security & fraud prevention: Detects and blocks suspicious activity, fraud attempts, money laundering, and violations of the terms of use.
• Legal compliance: Fulfils obligations under the PDPA, anti-money laundering (AML) regulations, and requirements of relevant regulatory bodies.
• Service communications: Sends important notifications regarding your account, security, policy changes, and system updates that require your attention.
• Marketing & Promotions: With your consent, sending promotional information, the latest bonuses, and relevant VIP offers via email or app notifications.
• Platform improvements: Analyses aggregated usage patterns to improve the gaming experience, interface design, and technical performance of the platform.
• Customer support: Helps resolve enquiries, complaints, and technical issues you report to the mr138 support team.

Under Malaysia's PDPA and sound data protection practices, mr138 processes your personal data based on one or more of the following valid legal bases:

• Contract performance: Processing required to fulfil the service agreement between you and mr138, including account management and transaction processing.
• Your consent: For direct marketing and promotional communications, we act only on the explicit consent you provided during registration or through your account settings.
• Legitimate interest: Platform security purposes, fraud prevention, and service improvement analytics that do not affect your fundamental privacy rights.
• Legal obligation: Data required to comply with PDPA, AML, KYC, and other directives from relevant Malaysian authorities.

Mr138 does not sell, rent, or trade your personal data to any third party for commercial purposes. However, in certain limited circumstances, we may need to share your data with the following parties:

• Payment service providers: Payment gateways, banks, and e-wallet providers used to process your deposits and withdrawals. Such sharing is limited strictly to the data required to complete the transaction.
• Game providers: Gaming software companies (game providers) that supply game content on the mr138 platform. Only the game session data required for technical functionality is shared.
• KYC & Identity Verification Services: Third-party KYC technology providers that assist us in verifying member identity and age in accordance with compliance requirements.
• Technical infrastructure: Cloud computing, cybersecurity, and system monitoring providers that help us maintain secure and stable platform operations.
• Legal authorities: Government agencies, law enforcement bodies, or courts issuing official orders that require disclosure of specific data under applicable Malaysian law.

All third-party service providers working with mr138 are required to sign data processing agreements ensuring they handle your data in accordance with security and privacy standards equal to or higher than Malaysia's PDPA requirements.

The security of your personal data is the top technical priority at mr138. We continuously invest in the latest security infrastructure to ensure your information remains protected from unauthorised access, data breaches, and cyber threats.

Key security measures we have implemented:

• 256-bit SSL encryption: All data transmitted between your device and mr138 servers is encrypted using TLS 1.3 with 256-bit keys. This means every piece of information travelling over the internet is protected against interception.
• Data-at-rest encryption: Personal data stored in our databases is also encrypted using AES-256 encryption. Even if someone gains access to the database, the data cannot be read without the encryption key.
• Two-factor authentication (2FA): 2FA is available for all member accounts and is mandatory for internal administrative access to prevent unauthorised entry.
• 24/7 Threat Monitoring: Our cybersecurity team continuously monitors all platform activity using an automated intrusion detection system (IDS) capable of identifying threats in real time.
• Regular penetration testing: mr138 conducts regular security assessments (penetration testing) by independent security experts to identify and address any vulnerabilities before they can be exploited.
• Role-based access control: Only specifically authorised staff may access member personal data, and every such access is recorded in a tamper-proof audit log.
• Incident response plan: In the event of any data breach, mr138 has a clear incident response protocol that includes the obligation to notify affected members within 72 hours.

Mr138 does not retain your personal data longer than necessary to fulfil the original purpose of collection or to meet applicable legal requirements. The following are our data retention guidelines:

• Active account data: Retained for the duration your account is active plus a 5-year period following account closure, in accordance with Malaysian accounting and AML legal requirements.
• Financial transaction records: Retained for a minimum of 7 years in accordance with the Malaysian Companies Act and AML regulations.
• KYC documents: Retained for a minimum of 5 years after the business relationship ends or the date of the last transaction, in accordance with the Inland Revenue Board of Malaysia guidelines.
• Customer support communication logs: Retained for 3 years for reference and potential dispute resolution purposes.
• Marketing data: Retained until you withdraw consent or request deregistration, plus a 90-day buffer period for processing.
• Technical logs (IP, session): Retained for 12 months for security and incident investigation purposes.

Once the retention period has expired, data is securely deleted using de-identification or cryptographic erasure methods that ensure the data cannot be recovered.

The mr138 platform uses cookies and similar tracking technologies to enhance user experience, analyse traffic, and ensure session security. The following types of cookies are used:

• Essential cookies (required): Required for core platform functions such as login, session authentication, and account security. These cookies cannot be disabled as the platform cannot function properly without them.
• Preference cookies: Saves your preferences such as language, time zone, and display settings to deliver a more personalised experience in future sessions.
• Analytics cookies: Collects information on how visitors use our platform in an aggregated and anonymised manner for service improvement purposes.
• Security cookies: Helps detect unusual activity and protect your account from unauthorised access and phishing attacks.

You can manage your cookie settings through your web browser at any time. Please note that disabling essential cookies may affect your ability to log in and use all features of the mr138 platform.

Under Malaysia's PDPA, you as the data subject have certain rights regarding your personal data held by mr138. We fully respect and facilitate the exercise of these rights.

To exercise any of the above rights, please contact the mr138 Privacy Officer by email at [email protected] with the subject line "Data Rights Request". We will verify your identity before processing any request to ensure the security of your data.

In certain operational circumstances, your personal data may be processed or stored on servers located outside Malaysia, primarily by cloud infrastructure providers and international gaming service providers that we engage.

Every cross-border data transfer carried out by mr138 is subject to the following safeguards:

• We ensure that data recipients in other countries provide a level of data protection equivalent to or exceeding Malaysia's PDPA standard.
• Legally binding standard data transfer agreements are used for all transfers to international service providers.
• Transfers only take place to countries recognised as having adequate data protection frameworks.
• You will be notified of any material new data transfers via a privacy policy update notice.

Mr138 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, new legal requirements, or service improvements. The latest version is always available at mr138.vip/privacy-policy.

For material changes — those that significantly affect how we use your data or your rights — we will:

• Sending an email notification to your registered address at least 14 days before changes take effect.
• Displaying a clear notice on the mr138 platform homepage for 30 days.
• Updating the "Last Updated" date at the top of this document.

Your continued use of the mr138 platform after the effective date of any changes constitutes your acceptance of the updated privacy terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how mr138 handles your personal data, please contact our Privacy Officer using the following details:

If you are not satisfied with our response, you have the right to lodge a complaint with Department of Personal Data Protection (JPDP) Malaysia as the national data supervisory authority.