k138 Privacy Policy

1. About This Privacy Policy

1.1 This Privacy Policy ("Policy") describes how k138 ("the Company", "k138", "we", "us", "our") collects, processes, uses, stores, and discloses the personal data of individuals who register as Members of the k138 platform, visit k138.one, or interact with any k138 service.

1.2 k138 is the data controller in respect of personal data collected through the k138 platform and is responsible for ensuring that such data is handled in compliance with applicable data protection principles and the data protection obligations imposed by our international gaming licence.

1.3 This Policy is incorporated by reference into the k138 Terms & Conditions. By registering a k138 account or using any k138 service, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

1.4 This Policy applies to: personal data collected through the k138.one website and any mobile-optimised version thereof; data submitted during account registration and KYC verification; data generated through your use of k138 gaming, betting, and financial services; and data collected through cookies and similar tracking technologies used on the k138 platform.

2. Personal Data We Collect

2.1 k138 collects only the personal data that is necessary to provide its services, comply with regulatory obligations, and maintain the security and integrity of the platform. The categories of personal data we collect include:

Registration and Identity Data

• Full legal name as it appears on your government-issued identity document;
• Date of birth (used to verify the 21+ age requirement);
• Email address and/or Malaysian mobile number;
• Username and hashed account password;
• Residential address.

KYC Verification Data

• Copy of Malaysian MyKad or valid passport;
• Proof of residential address (utility bill, bank statement, or equivalent);
• Source of funds documentation where requested as part of enhanced due diligence;
• Facial verification or selfie image where required for identity matching.

Financial Transaction Data

• Deposit and withdrawal transaction records including amounts, dates, and payment method identifiers;
• E-wallet account identifiers (e.g. Touch n Go or Boost account reference numbers);
• Bank account details (account holder name, bank name, last four digits) where FPX transfers are used;
• Cryptocurrency wallet addresses where USDT transactions are conducted.

Gaming and Platform Activity Data

• Bet history, game session records, and outcomes across all k138 products;
• Login timestamps, session durations, and device/browser fingerprints;
• IP addresses and geolocation data derived from IP addresses;
• Communication logs (live chat transcripts, support email correspondence).

Technical and Device Data

• Device type, operating system, and browser version;
• Cookie identifiers and similar tracking data (see Section 7);
• Referring URL and navigation paths within the k138 platform.

3. How We Collect Your Data

3.1 k138 collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or update your account settings;
• Automatically — when you interact with the k138 platform, through server logs, cookies, and session tracking technologies that record your activity;
• From third-party service providers — including payment processors (e.g. Touch n Go eWallet, Boost, FPX banking networks), identity verification services, fraud detection partners, and game providers who transmit bet and session data to k138;
• From publicly available sources — including sanctions lists, politically exposed persons (PEP) databases, and adverse media sources, as part of our AML due diligence obligations.

4. How We Use Your Personal Data

4.1 k138 processes your personal data for the following purposes:

5. Legal Basis for Processing

5.1 k138 processes personal data on the following legal bases:

• Contractual necessity — processing required to perform the k138 Member agreement with you, including account creation, payment processing, and service delivery;
• Legal obligation — processing required to comply with our gaming licence conditions, AML regulations, KYC requirements, and any applicable court orders or regulatory directives;
• Legitimate interests — processing for fraud prevention, platform security, and aggregated analytics, where our legitimate interests are not overridden by your data protection rights;
• Consent — processing for optional marketing communications and non-essential cookies, where you have provided explicit opt-in consent. You may withdraw consent at any time by contacting k138 support or adjusting your account marketing preferences.

6. Data Sharing and Disclosure

6.1 k138 does not sell, rent, or otherwise trade your personal data to third parties for their own marketing purposes. We share your data only in the following limited circumstances:

6.1 Service Providers

k138 engages third-party service providers to support platform operations. These include payment processors (Touch n Go, Boost, FPX banking network operators), identity verification services, IT infrastructure providers, fraud detection services, and game providers. All service providers are engaged under data processing agreements that require them to handle your data only as instructed by k138 and to maintain appropriate security standards.

6.2 Regulatory and Legal Authorities

k138 may disclose personal data to its gaming licence authority, national regulatory bodies, law enforcement agencies, or courts where required by applicable law, court order, or regulatory directive. k138 will endeavour to notify affected Members of such disclosures where permitted to do so by law.

6.3 Fraud Prevention and AML Networks

k138 participates in industry-standard fraud prevention and anti-money laundering information-sharing arrangements. Where a Member's account activity triggers AML reporting obligations, relevant data may be reported to the appropriate financial intelligence authority without prior notice to the Member, as required by law.

6.4 Business Transfers

In the event of a merger, acquisition, or transfer of all or part of k138's business, Member data may be transferred to the acquiring entity. Members will be notified of any such transfer and the implications for their data where feasible in advance of completion.

7. Cookies and Tracking Technologies

7.1 The k138 platform uses the following categories of cookies and similar tracking technologies:

• Strictly necessary cookies — required for the platform to function, including session authentication, security tokens, and shopping cart equivalents in the Cashier. These cannot be disabled without breaking core functionality.
• Functional cookies — remember your preferences such as language settings, game favourites, and display options. These can be disabled via browser settings without affecting core service access.
• Analytics cookies — aggregate, anonymised data about how visitors navigate the k138 platform, used to improve page performance and user experience. Disabled via browser settings or cookie consent controls.
• Security cookies — used by k138's fraud detection systems to identify anomalous login behaviour, including device fingerprinting tokens.

7.2 k138 does not use third-party advertising cookies or sell cookie-derived data to ad networks. You may manage cookie preferences through your browser's privacy settings at any time.

8. Data Retention

8.1 k138 retains personal data for the periods set out below, after which data is securely deleted or anonymised unless a longer retention period is required by our gaming licence, applicable law, or active legal proceedings:

• Account registration data — retained for the duration of the active account and for a minimum of 5 years following account closure, as required by AML obligations under our gaming licence;
• KYC identity documents — retained for a minimum of 5 years from the date of submission or account closure, whichever is later;
• Financial transaction records — retained for a minimum of 5 years from the date of the relevant transaction;
• Game and betting history — retained for a minimum of 3 years from the date of each session or wager;
• Support communication records — retained for 2 years from the date of the last communication in the relevant thread;
• Marketing consent records — retained until consent is withdrawn, plus 12 months thereafter for audit purposes.

8.2 Where you request deletion of your data before the expiry of the applicable retention period, k138 will comply to the extent possible — but data subject to mandatory retention obligations cannot be deleted until the retention period expires.

9. Data Security

9.1 k138 implements the following technical and organisational security measures to protect Member data:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and the k138 platform;
• Encrypted storage of all personal data at rest on k138's infrastructure;
• Salted hashing of Member passwords — plain text passwords are never stored;
• Role-based access controls limiting employee access to personal data to those with a documented business need;
• Regular security assessments and penetration testing of k138 platform infrastructure;
• Incident response procedures requiring prompt notification to the gaming licence authority and affected Members in the event of a data breach that poses a risk to Member rights.

9.2 While k138 takes reasonable and appropriate steps to protect Member data, no internet-based system is completely immune from security risks. Members are responsible for maintaining the security of their k138 login credentials and for notifying k138 support immediately if they suspect unauthorised account access.

10. International Data Transfers

10.1 k138 operates under an international gaming licence and may engage service providers — including game studios, payment processors, and cloud infrastructure providers — that process data in jurisdictions outside Malaysia. Where such transfers occur, k138 ensures that appropriate safeguards are in place, including contractual data processing agreements that impose equivalent data protection standards on the receiving party.

10.2 By registering a k138 account, you acknowledge that your personal data may be processed in jurisdictions outside Malaysia as part of k138's normal operational activities, subject to the safeguards described in this section.

11. Your Data Rights

11.1 Subject to applicable law and the data retention obligations imposed by k138's gaming licence, you have the following rights in relation to your personal data held by k138:

• Right of access — you may request a copy of the personal data k138 holds about you;
• Right to rectification — you may request correction of inaccurate or incomplete personal data;
• Right to erasure — you may request deletion of your personal data where k138 no longer has a lawful basis to retain it;
• Right to restriction — you may request that k138 restrict processing of your data in certain circumstances (e.g. while a rectification request is assessed);
• Right to data portability — you may request a machine-readable copy of the personal data you provided to k138, where technically feasible;
• Right to object — you may object to processing based on k138's legitimate interests, including profiling for fraud detection purposes;
• Right to withdraw consent — where processing is based on consent (e.g. marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

11.2 To exercise any of the above rights, contact k138 support via live chat or email at [email protected]. k138 will acknowledge requests within 5 business days and respond substantively within 30 calendar days. k138 may request identity verification before fulfilling any data rights request.

12. Children and Minors

12.1 If you have reason to believe that a person under the age of 21 has registered a k138 account, please contact k138 support immediately at [email protected].

13. Changes to This Privacy Policy

13.1 k138 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or gaming licence requirements. Updated versions will be published on this page with a revised effective date at the top of the document.

13.2 Where changes to this Policy are material — for example, where a new category of data processing is introduced or your rights are substantively affected — k138 will provide advance notice via the registered email address on your account or via a prominent notice on the k138 platform.

13.3 Continued use of k138 services after the publication of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not accept the revised Policy, you must cease using k138 services and may request account closure.

14. Contact and Data Enquiries

14.1 For any questions, concerns, or requests relating to this Privacy Policy or k138's data practices, please contact us through the following channels:

• Live Chat: Available 24/7 from within your k138 account — English and Bahasa Malaysia supported
• Email: [email protected]

14.2 For formal data rights requests (access, deletion, rectification), please contact k138 via email with the subject line "Data Rights Request" and include your registered account email address and a description of your request. Identity verification will be required before any request is actioned.

14.3 This Privacy Policy was last updated in June 2026. The version published on this page is the current operative version and supersedes all prior versions.