Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how ML138 ("Company", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("Player", "User", "you", "your") who access or use the ML138 online gambling platform at https://ml138.click ("Platform").

ML138 operates as an internationally licensed online gambling platform serving the Malaysian market. We take the privacy of our players seriously. This Policy is designed to be transparent about our data practices and to inform you clearly of your rights with respect to your personal information.

By registering an Account with ML138, accessing the Platform, or otherwise providing us with your personal data, you acknowledge that you have read and understood this Policy and you consent to our collection and processing of your data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to close your Account.

2. Definitions

The following terms are used throughout this Policy with the meanings defined below:

3. Data Controller Information

ML138 is the Data Controller responsible for the personal data processed through the Platform. ML138 operates under an international online gaming licence. As Data Controller, ML138 determines the purposes for which, and the means by which, personal data is processed.

For all data protection enquiries, subject access requests, or complaints regarding the handling of your personal data, please contact us using the details set out in Section 15 of this Policy.

4. Personal Data We Collect

ML138 collects personal data through several channels and for clearly defined purposes. The categories of data we collect include:

4.1 Registration Data

When you create an Account, we collect: full legal name, date of birth, email address, mobile phone number, preferred username, and a password (stored in hashed form — we never store plain-text passwords). This data is collected to establish your account identity and enable secure login.

4.2 Identity Verification (KYC) Data

To comply with our licensing obligations and prevent fraud and money laundering, we collect identity documents including: government-issued photo identification (Malaysian MyKad, passport, or equivalent), proof of residential address (utility bill or bank statement dated within 90 days), and proof of payment method ownership (e.g., screenshot of registered bank account or e-wallet).

4.3 Financial Transaction Data

We collect records of all deposits and withdrawals processed through your Account, including: transaction amounts (in MYR), payment method type (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, BTC, ETH, USDT), transaction reference numbers, and timestamps. We do not store full card numbers or complete bank account numbers — only masked identifiers necessary for transaction matching.

4.4 Gameplay and Activity Data

We collect records of your gambling activity on the Platform, including: games played, wagers placed, bet amounts, wins and losses, session durations, and bonus usage. This data is used for account integrity, bonus eligibility verification, responsible gambling monitoring, and regulatory reporting.

4.5 Technical and Device Data

When you access the Platform, we automatically collect: IP address, device type and operating system, browser type and version, referring URL, pages visited, session duration, and geolocation data (country/region level). This data is collected for security monitoring, fraud detection, and Platform performance optimisation.

4.6 Customer Support Communications

When you contact ML138 via live chat or email, we collect and retain records of those communications, including the content of messages and any attachments you provide. These records are used to resolve your query, improve support quality, and maintain an audit trail for compliance purposes.

5. How We Process Your Data

The table below summarises the primary purposes for which ML138 processes personal data, the categories of data involved, and the applicable lawful basis for each processing activity:

6. Lawful Basis for Processing

ML138 relies on the following lawful bases to process your personal data, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the ML138 Terms and Conditions, including operating your account, processing deposits and withdrawals, and providing gambling services.
• Legal Obligation: Processing required to comply with applicable laws and our licensing obligations, including anti-money laundering (AML) requirements, Know Your Customer (KYC) regulations, and responsible gambling mandates.
• Legitimate Interest: Processing where ML138 has a legitimate operational interest, such as fraud prevention, Platform security, and service quality improvement, provided such interests are not overridden by your data protection rights.
• Consent: Processing where you have freely and explicitly consented, such as the receipt of marketing emails or optional personalisation features. Where consent is the lawful basis, you may withdraw it at any time without affecting the legality of prior processing.

7. Data Sharing & Third Parties

ML138 does not sell, rent, or trade your personal data to any third party. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and under binding data protection agreements where required:

• Payment Processors: Malaysian payment service providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, and Hong Leong Connect — for the sole purpose of processing deposits and withdrawals in MYR. Cryptocurrency transactions may involve blockchain network validators.
• KYC and Identity Verification Providers: Third-party identity verification services used to validate documents submitted during KYC. These providers process document data under strict confidentiality obligations.
• Game Providers: Licensed third-party game software providers whose games are accessible through the Platform may receive pseudonymous gameplay data necessary to operate games and calculate outcomes.
• Fraud Prevention and AML Service Providers: Specialist screening tools that help ML138 identify unusual transaction patterns and comply with anti-money laundering obligations.
• IT Infrastructure and Hosting Providers: Cloud and server infrastructure providers that host the ML138 Platform and databases. These providers do not access player data for any purpose beyond technical operation of the Platform.
• Regulatory and Licensing Authorities: Our licensing authority and, where legally required, relevant governmental or law enforcement agencies. Disclosure to such bodies is made only where ML138 is legally required to do so.
• Professional Advisers: Legal counsel, auditors, and compliance consultants, subject to professional confidentiality obligations, where necessary for legal or regulatory purposes.

8. Cookies & Tracking Technologies

ML138 uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session, and improve user experience. Cookies are small text files stored on your device when you visit the Platform.

8.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management cookies that keep you logged in during your visit. These cannot be disabled without affecting Platform functionality.
• Security Cookies: Used to detect and prevent fraudulent activity, such as detecting multiple simultaneous logins or unusual access patterns.
• Preference Cookies: Store your Platform settings and preferences (e.g., language, game lobby view) so they persist across sessions.
• Analytics Cookies: Used to understand how players interact with the Platform — which pages are visited most, where players encounter difficulties, and how the Platform performs technically. Analytics data is processed in aggregated, anonymised form.

8.2 Cookie Management

You may control cookie settings through your browser preferences. However, disabling strictly necessary or security cookies may impair your ability to log in or use key Platform features. You may also clear stored cookies from your browser at any time. Note that clearing cookies will log you out of your active session.

ML138 does not use third-party advertising networks or retargeting cookies on this Platform.

9. Data Retention

ML138 retains personal data only for as long as necessary to fulfil the purpose for which it was collected or to comply with applicable legal, regulatory, and contractual obligations. The following general retention principles apply:

• Active Account Data: Retained for the duration of your Account and for a minimum of five (5) years following account closure, in accordance with standard financial record-keeping and AML obligations applicable under our licensing framework.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification, or longer if required by our licensing authority or applicable law.
• Transaction Records: All deposit and withdrawal records retained for a minimum of five (5) years.
• Customer Support Communications: Retained for a maximum of three (3) years from the date of the interaction, unless a longer retention period is required for ongoing dispute resolution or legal proceedings.
• Technical and Device Logs: Retained for a maximum of twelve (12) months for general security monitoring; longer if retained as evidence in connection with a fraud investigation or legal proceeding.
• Marketing Preferences: Retained until you withdraw consent or close your Account.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures.

10. Security Measures

ML138 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• SSL/TLS Encryption: All data transmitted between your device and ML138 servers is encrypted in transit using industry-standard TLS protocols.
• Encrypted Storage: Sensitive data — including identity documents, financial records, and password hashes — is stored in encrypted form at rest.
• Access Controls: Internal access to player data is restricted on a strict need-to-know basis. Staff access is governed by role-based permissions and is logged for audit purposes.
• Two-Factor Authentication (2FA): Available for player accounts to provide an additional layer of login security.
• Intrusion Detection: ML138's infrastructure is monitored for unusual access patterns, brute-force attempts, and other indicators of compromise.
• Regular Security Reviews: ML138 conducts periodic internal security reviews and maintains operational procedures to identify and address emerging security risks.

Despite these measures, no online system can guarantee absolute security. In the event of a data breach that presents a material risk to your rights, ML138 will notify affected players and relevant authorities as required by our licensing obligations.

11. Your Data Rights

As a player whose personal data is processed by ML138, you have the following rights. To exercise any of these rights, please contact us using the details in Section 15. We will respond to verified requests within 30 calendar days.

12. Minors — 21+ Policy

The ML138 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. If you are under 21, you must not access the Platform or provide any personal data to ML138.

If ML138 discovers or has reasonable grounds to suspect that personal data has been collected from a person under the age of 21, we will immediately suspend the associated Account, delete the data, and return any deposited funds to the payment source from which they originated.

Age verification is enforced through our KYC process. Any player who is unable to verify their age as 21 or above will not be granted full Account access or permitted to place wagers.

13. International Data Transfers

ML138 operates internationally and may process or store your personal data on servers or through service providers located outside of Malaysia. Where personal data is transferred to jurisdictions outside Malaysia, ML138 takes reasonable steps to ensure that such transfers are conducted lawfully and that appropriate safeguards are in place to protect your data to a standard consistent with this Policy.

Safeguards applied to international transfers may include: standard contractual clauses with receiving entities, data processing agreements incorporating equivalent data protection obligations, and transfer only to jurisdictions assessed as providing an adequate level of data protection.

14. Updates to This Privacy Policy

ML138 reserves the right to update, amend, or modify this Privacy Policy at any time. Where changes are material — affecting your rights or how we process your data in a significant way — ML138 will provide advance notice via the email address registered to your Account, or through a prominent notice on the Platform, before the revised Policy takes effect.

The effective date displayed at the top of this Policy indicates when it was last updated. We encourage you to review this Policy periodically to stay informed about our data practices. Your continued use of the Platform following a notified policy update constitutes acceptance of the revised Policy.

15. Contact Us — Data Enquiries

For all privacy-related enquiries, subject access requests, data correction requests, objections to processing, or complaints regarding how ML138 handles your personal data, please contact us through the following channels: