Privacy Policy top138 — Personal Data Protection for Malaysian Players

Introduction

Welcome to the top138 Privacy Policy. This document transparently explains how top138 ("we", "Platform") collects, uses, stores, and protects your personal information ("data") when you use our services on top138.onl or through our mobile app.

Your privacy is our absolute priority. We believe you have the right to know exactly what happens with your personal information — no convoluted language, no hidden terms. This policy is written in plain, straightforward language so every Malaysian player can clearly understand their rights and protections.

By registering an account or using the top138 platform, you agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, you may contact us for further clarification before deciding whether to continue using the platform.

This Privacy Policy applies alongside the top138 Terms and Conditions and should be read together with that document for a complete picture of your rights and responsibilities as a member of our platform.

Information We Collect

Top138 collects two main categories of information: information you provide directly to us, and information collected automatically while you use the platform.

Information You Provide Directly:

• Full name, date of birth, and gender upon account registration.
• Email address and mobile number for communication and verification purposes.
• Bank and payment account information for processing deposits and withdrawals.
• Identity documents (MyKad, passport) during the KYC process when required.
• Residential address provided during registration or profile update.
• Any communications you send to our support team.

Information Collected Automatically:

• IP address, device type and operating system you use.
• Your web browser type and version.
• Game session data including login time, session duration and wagering activity.
• Cookie data and similar tracking technologies (see Section 6).
• Technical logs for error detection and system maintenance purposes.

How We Use Your Data

Top138 uses collected data solely for legitimate and reasonable purposes related to the provision of platform services. We do not use your data for any purpose not stated in this policy without obtaining your additional consent.

• Account Management: Creating and maintaining your account, verifying your identity, and processing your requests.
• Financial Processing: Processing deposits, withdrawals, and all financial transactions securely and accurately.
• Platform Security: Detecting and preventing fraud, money laundering, and any suspicious activity.
• Legal Compliance: Meeting legal obligations including KYC requirements, PDPA compliance, and reporting to authorities when required.
• Service Improvements: Analysing usage patterns to improve user experience and platform performance.
• Service Communications: Sending important notifications related to accounts, transactions, and policy updates.
• Responsible Gaming: Monitoring wagering patterns to identify and assist members who may need support.
• Marketing (with your consent): Sending promotional information and special offers only to members who have given their consent.

Data Sharing & Disclosure

Top138 does not sell, rent, or trade your personal data to any third party. However, there are limited situations where we may need to share your data with certain parties:

• Payment Providers: Required financial data is shared with authorised payment providers such as FPX and local banks solely to process your transactions securely.
• Game Providers: Minimal game session information is shared with our game software providers to ensure smooth and fair gameplay.
• Legal Authority: top138 will disclose data to the relevant authorities when required to do so by law, court order, or official investigation.
• Identity Verification Services: KYC information is shared with certified third-party identity verification service providers for verification purposes only.
• Analytics Providers: Anonymised usage data (without personally identifying information) may be shared with analytics tools to improve platform performance.

All third parties receiving your data from top138 are bound by strict confidentiality agreements and must comply with our Privacy Policy and applicable data protection laws. They are only permitted to use your data for the specified purposes.

Data Security Measures

Top138 continuously invests in the latest security infrastructure to ensure your personal data is protected from unauthorised access, loss, misuse, or disclosure.

The technical security measures we implement include:

• Encryption of Data in Transit: All communications between your device and top138 servers are secured with TLS 1.3 protocol and 256-bit SSL encryption.
• Encryption of Data at Rest: Sensitive data such as banking information and identity documents are stored in encrypted format using AES-256 standards.
• Internal Access Controls: Access to user data is restricted to staff with a legitimate work need and is subject to two-factor authentication.
• 24/7 Security Monitoring: Automated monitoring systems run around the clock to detect any intrusion attempts or suspicious activity.
• Regular Security Audits: top138 undergoes independent security audits on a regular basis to identify and address any system vulnerabilities.
• Data Backup: Your data is securely backed up across multiple locations to ensure service continuity in an emergency.

While we take all reasonable precautions, no security system can guarantee absolute 100% protection. You also play an important role in securing your account by using a strong password and never sharing your login credentials with anyone.

Cookies & Tracking Technologies

Top138 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, session security and remembering your preferences. These cookies cannot be disabled.
• Performance Cookies: Helping us understand how members interact with our platform through anonymised analytics data for improvement purposes.
• Functional Cookies: Remembering your preferences such as language and display settings to provide a more personalised experience.
• Security Cookies: Used to detect suspicious login attempts and protect your account from unauthorised access.

You can control or disable cookies through your web browser settings. Please note that disabling certain cookies may affect the functionality of some parts of the top138 platform. Cookie settings can be managed through the settings menu of browsers such as Chrome, Firefox, Safari or Edge.

Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by top138:

• Right of Access: You have the right to request a copy of the personal data we hold about you. We will provide this information within 21 working days.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete data. You may also update your own profile information through your account settings.
• Right to Erasure: You may apply to have your personal data deleted, subject to our record retention obligations under applicable law.
• Right to Restrict Processing: In certain circumstances, you may request that we limit how we use your data.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where data processing is based on your consent, you may withdraw that consent at any time.

To submit any request regarding your data rights, contact our privacy team via email or Live Chat. We will verify your identity first before processing any request to ensure the security of your data.

Data Retention Period

Top138 only retains your personal data for as long as it is needed for the purposes stated in this Privacy Policy or as required by applicable law.

• Active Account Data: Retained for as long as your account remains active and for the period following account closure required by law.
• Financial Transaction Records: Retained for a minimum of 7 years as required under Malaysia's Anti-Money Laundering Act (AMLA).
• KYC Documents: Retained for the period required by the relevant regulatory body, typically 5 years after the termination of the business relationship.
• Security Logs: Retained for 12 months for security investigation and fraud prevention purposes.
• Marketing Data: Retained until you withdraw consent or request deletion.

When the retention period expires or when data is no longer needed, top138 will securely delete or anonymise the data using appropriate methods to prevent unauthorised recovery.

Changes to This Privacy Policy

Top138 reserves the right to amend or update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or platform improvements.

When we make material changes to this Privacy Policy, we will:

• Updating the "Last Updated" date at the top of this page.
• Displaying clear notifications on the top138 platform to inform members of important changes.
• Sending emails to registered members when changes significantly affect how we use their personal data.

Continued use of the top138 platform after any amendments to this Privacy Policy take effect constitutes your acceptance of the updated terms. We encourage you to review this page periodically to stay informed about how we protect your information.

Contact Our Privacy Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, our privacy team is here to help.

• Live Chat: The fastest way — available 24/7 directly within the top138 platform. Just click the chat icon in the bottom corner of your screen.
• Privacy Email: [email protected] — for written inquiries requiring official documentation.
• FAQ: Visit our FAQ page for answers to the most frequently asked privacy questions.

We aim to respond to all privacy inquiries within 5 business days. For formal data rights requests, we will process and respond within 21 business days as required by Malaysia's PDPA.

This Privacy Policy was last updated in January 2026 and supersedes all previous versions of the top138 Privacy Policy.