Privacy Policy MR138 —
Data Protection & Information Security

1. Introduction & Scope of Privacy Policy

MR138 takes our responsibility to protect the privacy and data security of every member seriously. This Privacy Policy clearly explains how the mr138 platform ("we", "MR138") collects, uses, stores, and protects your personal information when you use the mr138.onl website, the mr138 mobile app, or any related services we offer.

This policy applies to all users of the mr138 platform, including casual visitors, registered members, and VIP programme members. It covers all channels through which you interact with us — from account registration and daily wagering activity, to financial transactions and communications with our customer support team.

This document should be read together with Terms and Conditions and Responsible Gaming Policy mr138. These documents together form the framework of the agreement between you and the mr138 platform.

This Privacy Policy has been prepared in accordance with the requirements of Malaysia's Personal Data Protection Act 2010 (PDPA) and internationally recognised data protection standards. Any material changes to this policy will be communicated to you via in-platform notifications or your registered email address.

2. Information We Collect

2.1 Information You Provide Directly

During the registration and platform usage process, you may be asked to provide the following information:

• Identity Information: Full name, date of birth, national ID or passport number
• Contact Information: Email address, phone number, residential address
• Financial Information: Bank account number, debit card details, e-wallet account information
• KYC Verification Documents: Copy of identification card, proof of address, bank statement
• Account Information: Username, password (in encrypted form), security questions

2.2 Information Collected Automatically

When you use the mr138 platform, our systems automatically record certain technical information for security and service improvement purposes:

• Device Data: Device type, operating system, phone or computer model
• Network Data: IP address, browser type, internet service provider (ISP)
• Usage Data: Pages visited, session duration, games played, betting history
• Geolocation Data: Location of the device used to access the platform (with your permission)
• Cookie Data: Preferences and settings stored in your browser

Data Category	Example Information	Primary Purpose
Identity	Name, IC, date of birth	KYC verification, legal compliance
Contact	Email, phone, address	Communication, account verification, notifications
Financial	Bank accounts, e-wallets	Deposit and withdrawal processing
Technical	IP address, browser type	Security, fraud detection
Usage	Game history, wagering	Responsible gaming, platform improvements

3. How We Use Your Information

MR138 uses the personal information collected for legitimate, clearly stated purposes. We do not use your data for any purpose other than those described below without first obtaining your consent:

• Service Provision: To create and manage your account, process deposits and withdrawals, and provide access to all games and platform features.
• Identity Verification: To complete the KYC process to ensure account security and compliance with anti-money laundering (AML) regulations.
• Platform Security: To detect and prevent fraud, account misuse, multiple account usage, and other suspicious activities.
• Service Improvements: To analyze usage patterns and develop new features better suited to the needs of Malaysian members.
• Communication: To send important account notifications, security updates, promotional information (with your consent), and responses to customer support inquiries.
• Responsible Gaming: To monitor gameplay patterns and identify users who may require assistance or support related to responsible gaming.
• Legal Compliance: To comply with legal obligations, court orders, or lawful requests from competent authorities.

4. Data Sharing & Disclosure

4.1 Core Principles

MR138 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. This is a core commitment that is non-negotiable in the way we handle user data.

4.2 Limited Exceptions

Your data may be shared only in the following strictly limited and tightly controlled circumstances:

• Payment Service Providers: Local banks, approved e-wallet providers, and payment gateways that process your financial transactions. They are required to comply with the same stringent data security standards as we do.
• Game Software Providers: Third-party gaming companies that provide slots, Live Casino, and other games are required to receive only the minimum information necessary to perform their services.
• KYC Verification Services: Approved identity verification service providers to assist with the document verification process.
• Competent Authorities: In circumstances where disclosure is required by Malaysian law, court order, or a legitimate law enforcement agency.

5. Data Security & Encryption

MR138 continually invests in sophisticated security infrastructure to ensure your personal data remains protected at all times. The technical and organisational security measures we implement include:

• 256-bit SSL/TLS Encryption: All communications between your browser and the mr138 servers are encrypted using the latest industry-standard encryption technology.
• Encrypted Password Storage: Your password is never stored in its original form. We use secure one-way hashing algorithms to protect your login credentials.
• Two-Factor Authentication (2FA): The mr138 platform supports 2FA to add an extra layer of security to your account.
• 24/7 Monitoring: Our security team monitors the platform around the clock to detect any suspicious activity or unauthorised access attempts.
• Fund Segregation: Member financial data is handled separately from platform operational data using fully isolated systems.
• Regular Penetration Testing: Security audits and penetration testing are conducted regularly by independent security experts to identify and address any potential vulnerabilities.

6. Cookies & Tracking Technologies

The mr138 platform uses cookies and similar tracking technologies to enhance the user experience, ensure platform security, and understand usage patterns. The following are the types of cookies we use:

Cookie Type	Purpose	Duration
Essential Cookies	Enables core platform functions to work, including secure login and session management	Current session
Performance Cookies	Collects information on how users interact with the platform for improvement purposes	30 days
Functional Cookies	Remembers your preferences and settings such as language and display options	90 days
Security Cookies	Detects suspicious activity and protects accounts from unauthorised access	7 days

You can manage your cookie settings through your browser preferences. Please note that disabling certain cookies may affect the functionality of the mr138 platform. Cookies required for security cannot be disabled as they are essential to protecting your account.

7. Your Rights as a User

As a user of the mr138 platform and a data subject under Malaysia's PDPA, you have the following rights regarding your personal data:

To exercise any of the above rights, please contact the mr138 data protection team via our support email. We will process your request within 30 business days of receipt. In complex cases, this period may be extended up to 60 days with prior notice to you.

8. Data Storage & Cross-Border Transfers

Your personal data is processed and stored on servers located in regions that offer data protection standards equivalent to or higher than those in Malaysia. All cross-border data transfers required for platform operations — including those to international service providers — are carried out with adequate contractual safeguards.

Our data retention periods are as follows:

• Active Account Data: For the duration of your active account plus seven (7) years after account closure for legal compliance purposes
• Financial Transaction Records: Seven (7) years from the date of transaction in accordance with Malaysia's financial regulatory requirements
• KYC Documents: For the lifetime of the account plus five (5) years after closure
• Security Logs: Twelve (12) months from the date of recording
• Support Communication Data: Three (3) years from the date of last interaction

Once the designated retention period has expired, your data will be permanently deleted or anonymised so that it can no longer be associated with you.

9. Links to Third-Party Websites

The mr138 platform may contain links or integrations to third-party services such as game providers and payment gateways. Please note that this Privacy Policy applies solely to the mr138 platform.

When you click on links to third-party websites or use their services, you are subject to the privacy policies of those third parties. MR138 is not responsible for the privacy practices of any third-party website or service. We encourage you to read the privacy policy of every third-party service you use.

10. Privacy Policy Amendments & Contact Us

MR138 reserves the right to amend this Privacy Policy from time to time to reflect changes in our privacy practices, technological developments, or new legal requirements. Any material amendments will be communicated to you at least seven (7) days before they take effect through:

• A notice displayed on the mr138 platform home page
• Notification email to the address registered in your account
• A pop-up notice when you log in to the platform

Your continued use of the mr138 platform after any amendments take effect constitutes your acceptance of the updated terms. You may review the current version of the Privacy Policy at any time via the link at the bottom of the mr138 platform page.

If you have any questions, concerns, or wish to exercise your rights under this Privacy Policy, please contact the mr138 Data Protection Officer via our support email. Our team is available to assist you 24 hours a day, seven days a week.