Privacy Policy — W138

W138 ("we", "us", "our") is committed to protecting the privacy and personal data of every individual who visits, registers with, or transacts on the W138 platform located at w138.cam (the "Platform"). This Privacy Policy ("Policy") explains, in clear and accessible terms, what personal data W138 collects, the purposes for which it is processed, how it is stored and protected, with whom it may be shared, and what rights you hold with respect to your own information.

This Policy applies to all users of the W138 Platform, including registered Players, unregistered visitors, and any individual whose data is processed in connection with the delivery of W138's online casino, live dealer, sports betting, and payment services. It should be read alongside the W138 Terms and Conditions and Responsible Gambling Policy.

By accessing the W138 Platform, you acknowledge that you have read and understood this Policy. If you do not agree with the way W138 processes personal data, please discontinue use of the Platform and contact our support team to close your account.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

W138 collects only the Personal Data that is necessary for the operation of its Platform and the delivery of its services. The categories of data collected, and the circumstances of collection, are set out below.

3.1 Registration Data

When you create a W138 Account, we collect:

• Full legal name
• Date of birth (to verify 21+ age eligibility)
• Email address
• Mobile phone number
• Preferred username
• Residential address (city, state, postcode)
• Preferred currency (MYR as default for Malaysian players)

3.2 KYC Verification Data

For identity verification prior to first withdrawal, we collect:

• Copy of government-issued photo identification (Malaysian MyKad, passport, or equivalent)
• Proof of address documentation where required
• Selfie photograph for liveness verification
• Payment method ownership documentation (bank statement, e-wallet screenshot) where required

3.3 Transaction Data

For each deposit or withdrawal processed through the W138 Platform, we record:

• Transaction type (deposit or withdrawal)
• Amount in MYR (Malaysian Ringgit) or equivalent currency
• Payment method used (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, BTC, USDT)
• Transaction reference number
• Date and time of transaction
• Transaction status (completed, pending, failed)

3.4 Usage and Technical Data

We automatically collect certain technical data when you access the Platform:

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Pages visited, session duration, and navigation patterns
• Game session data (games played, wager amounts, session duration, outcomes)
• Login timestamps and authentication activity

3.5 Communications Data

When you contact W138 support — via Live Chat, WhatsApp, or email — we retain records of that correspondence, including chat transcripts, for quality assurance and dispute resolution purposes.

W138 processes Personal Data for the following specific and documented purposes:

W138 relies on the following legal bases to process your Personal Data:

• Contractual Necessity: Processing required to perform the contract between W138 and you as a registered Player — including account creation, deposit/withdrawal processing, and game play services.
• Legal Obligation: Processing necessary to comply with applicable legal and regulatory requirements, including AML obligations, KYC requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out to pursue W138's legitimate business interests, including Platform security, fraud prevention, and service quality improvement, where such interests do not override your fundamental rights.
• Consent: Processing based on your explicit consent, particularly for marketing communications. You retain the right to withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.

W138 does not sell, rent, or otherwise commercially transfer your Personal Data to third parties. Data is shared only in the limited circumstances described below, and only to the extent necessary for the relevant purpose.

6.1 Service Providers (Data Processors)

W138 engages trusted third-party service providers to assist in operating the Platform. These include:

• Payment processors: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX network participants, and cryptocurrency payment gateways — for the purpose of processing MYR transactions.
• KYC and identity verification providers: To verify player identity and age as part of the W138 compliance programme.
• Cloud infrastructure and hosting providers: To store and process Platform data securely.
• Customer support platforms: To facilitate Live Chat and WhatsApp support interactions.
• Analytics providers: To analyse anonymised usage data for Platform improvement purposes.

All Data Processors engaged by W138 are bound by data processing agreements that require them to process your data only on W138's documented instructions and to maintain appropriate security standards.

6.2 Regulatory and Legal Disclosure

W138 may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory directive. This includes disclosures required under anti-money laundering legislation and other financial crime regulations.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of W138's business, Personal Data held by W138 may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer prior to their data being subject to a materially different privacy policy.

W138 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, subject to the following retention guidelines:

• Active Account Data: Retained for the duration of your active W138 Account relationship and for period of five (5) years following Account closure, in compliance with applicable financial record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification, or longer if required by applicable regulatory requirements.
• Transaction Records: Retained for a minimum of seven (7) years from the transaction date in accordance with standard financial compliance obligations.
• Support Communications: Chat and email correspondence retained for three (3) years for dispute resolution and quality assurance purposes.
• Marketing Data: Retained until you withdraw consent to marketing communications or request deletion, whichever is earlier.
• Technical / Log Data: Retained for twelve (12) months, unless required for longer for active security investigation purposes.

Upon expiry of the relevant retention period, Personal Data is securely deleted or irreversibly anonymised. Requests for earlier deletion are handled in accordance with Section 10 (Your Rights) of this Policy.

W138 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyse usage, and maintain session security. The cookies deployed on the W138 Platform fall into the following categories:

You may manage your cookie preferences through your browser settings. Disabling essential cookies may prevent you from logging in or using key Platform features. Analytics and functional cookies may be declined without affecting your ability to play or transact on W138.

W138 implements a layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Encryption in transit: All data transmitted between your device and the W138 Platform is encrypted using TLS 1.2 or higher.
• Encryption at rest: Stored Personal Data, including KYC documents and financial records, is encrypted using AES-256 encryption.
• Access controls: Strict role-based access controls limit employee access to Personal Data to those with a documented operational need. All access is logged and audited.
• Two-factor authentication: W138 provides 2FA for all player accounts and mandates 2FA for all internal staff access to data systems.
• Penetration testing: W138 engages independent security assessors to conduct periodic penetration testing of the Platform and data infrastructure.
• Incident response: W138 maintains a documented data breach response plan. In the event of a confirmed breach affecting player data, affected players will be notified within a reasonable timeframe in accordance with applicable notification obligations.

While W138 takes all reasonable precautions to secure your data, no internet transmission is entirely risk-free. Players are responsible for maintaining the security of their own device and Account credentials.

As a W138 player, you hold the following rights in relation to your Personal Data. These rights may be exercised at any time by contacting the W138 Data Protection contact detailed in Section 14 of this Policy.

The W138 Platform is strictly intended for individuals aged 21 years and above. W138 does not knowingly collect, process, or retain Personal Data from any individual under the age of 21.

Age verification is a mandatory component of the W138 registration and KYC process. Any Account found to be held by a person under the age of 21 will be immediately suspended, and all associated Personal Data will be deleted after a brief investigation period of no more than thirty (30) days, except where retention is required for fraud or legal compliance purposes.

If you believe a minor has registered on the W138 Platform, please contact our support team immediately at [email protected].

W138 operates on a global server infrastructure, and Personal Data may be transferred to and processed in jurisdictions outside of Malaysia. Where such transfers occur, W138 ensures that appropriate safeguards are in place, including:

• Data processing agreements with all third-party recipients that incorporate internationally recognised data protection standards.
• Transfer mechanisms consistent with applicable cross-border data transfer requirements.
• Technical security controls (encryption, access controls) that apply equally to data regardless of where it is processed.

By registering an Account and using the W138 Platform, you acknowledge and consent to the transfer of your Personal Data to servers and service providers located outside Malaysia, subject to the safeguards described in this section.

W138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or operational requirements. When material changes are made, W138 will provide advance notice via:

• A notification to your registered W138 email address at least seven (7) days prior to the effective date of the change; and
• A prominent notice on the W138 Platform homepage and Privacy Policy page.

Your continued use of the W138 Platform following the effective date of an amended Privacy Policy constitutes your acceptance of the revised terms. The "Last Reviewed" date at the top of this page will be updated each time the Policy is revised.

If you do not agree with the revised Privacy Policy, you must discontinue use of the Platform and request Account closure before the effective date of the change.

For any privacy-related enquiries, data subject access requests, or concerns about how W138 handles your Personal Data, please contact the W138 support and data protection team through the following channels:

• Live Chat: Available24/7 on the W138 Platform. Response within 3–5 minutes. Available in English, Bahasa Melayu, and Mandarin.
• WhatsApp Support: Available 24/7 for all player enquiries including privacy requests.
• Email: [email protected] — Please include "Privacy Request" in the subject line and provide your registered email address and Account username for identification. Responses within 4business hours.

All data subject requests are handled confidentially and in compliance with the timelines described in Section 10 of this Policy. Identity verification will be required before any access, correction, or deletion request is fulfilled.