Privacy Policy Bonus138 — Our Commitment to the Personal Data of Malaysian Members

1 Who Is Your Data Controller?

Bonus138 is the data controller for all personal information collected through our platform at bonus138.run. This means we determine the purposes and means by which your personal data is processed, and we are fully accountable for that processing in accordance with applicable data protection laws.

Any enquiries, requests or complaints relating to data privacy can be sent to our team by email at support@bonus138.run with "Privacy Enquiry" in the subject line. We are committed to responding within 5 business days.

2 What Personal Data Do We Collect?

Bonus138 only collects data that is strictly necessary to provide you with the platform's services. We do not collect excessive or irrelevant data beyond what is needed for operations. Below are the data categories we collect and the context in which they are collected.

Data you provide to us directly:

• Account information: Username, password (stored as an encrypted hash), email address, and phone number collected at registration.
• Identity verification (KYC) information: Full name, date of birth, MyKad or passport number, and proof of address — required for withdrawals above a certain threshold and to ensure compliance with anti-money laundering policies.
• Payment details: DuitNow recipient account name, FPX account number, phone number linked to Touch 'n Go eWallet, GrabPay, Boost or ShopeePay. Full card numbers or complete account details are not stored directly on bonus138 servers — we use a tokenisation system.
• Support communications: Records of live chat conversations, emails and any documents you have submitted to the bonus138 customer support team.

Data collected automatically while you use the platform:

• Technical data: IP address, browser type and version, operating system, screen resolution and the device used to access bonus138.
• Usage data: Pages visited, time spent on the platform, clicks and interactions within the bonus138 interface.
• Game data: Betting history, game types played (football, Live Casino, blackjack, slots, poker, and so on), wager amounts, outcomes, and win/loss records.
• Transaction data: Complete deposit and withdrawal history including the date, time, method and amount of each transaction.
• Cookies and similar technologies: Session cookies, preference cookies and analytics data that help us understand platform usage patterns.

3 Why Do We Use Your Personal Data?

Every piece of data bonus138 collects has a clear and legitimate purpose. We do not process data in ways you would not reasonably expect. Below are the primary purposes for which your personal data is used at bonus138.

• Service provision: To create and manage your account, process deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay, and provide access to all games and features on the bonus138 platform.
• Identity verification and legal compliance: To comply with applicable Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements, including age verification to ensure no individuals under 18 access bonus138.
• Security and fraud prevention: To detect and prevent fraudulent activity, multiple account usage, bonus abuse, and any suspicious behaviour or violations of bonus138's Terms & Conditions.
• Customer support: To enable the bonus138 support team to assist you with any enquiries, technical issues, or disputes relating to your account or transactions.
• Platform improvements: To understand usage patterns, identify technical issues and make improvements to the bonus138 interface and features based on real usage data.
• Marketing communications: To keep you informed about promotions, bonuses, and new offers on bonus138 — only if you have opted in to receive marketing communications. You may unsubscribe at any time.
• VIP Programme: To calculate and manage your VIP Points, determine your VIP tier, and deliver the corresponding benefits based on your betting activity on bonus138.

4 Legal Basis for Data Processing

Bonus138 processes your personal data on a valid legal basis for each processing purpose. Understanding this basis matters because it determines your rights in relation to that data.

• Contract performance: Processing necessary to deliver the bonus138 platform services to you — including account processing, transactions, and gameplay — is based on the contract between you and bonus138.
• Legitimate interests: Processing for security purposes, fraud prevention, and platform improvement is based on the legitimate interests of bonus138, which do not override your fundamental privacy rights.
• Legal obligations: Processing for KYC, AML and other reporting requirements is based on legal obligations binding on bonus138.
• Your consent: Processing for direct marketing and promotional communications from bonus138 is based on the explicit consent you have provided. You may withdraw this consent at any time without affecting the lawfulness of any processing carried out prior to withdrawal.

5 Who Do We Disclose Your Data To?

Bonus138 does not sell, rent, or trade members' personal data to any third party for their own marketing purposes. This is an absolute commitment we uphold. That said, in the course of operating the platform, we do share data with certain parties as outlined below.

• Payment service provider: Payment gateways that process DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost and ShopeePay transactions receive only the data required to complete the transaction. They are bound by strict data protection agreements.
• Game software providers: Third-party game providers that supply slots, Live Casino, and other games on the bonus138 platform may receive game session data necessary for game operation. They do not receive your personally identifiable information.
• Technical service providers: Companies providing hosting, cybersecurity, analytics, and technical infrastructure services that bonus138 relies on to operate the platform.
• Relevant authorities: Government agencies, law enforcement bodies, and regulators with lawful authority to request specific data from bonus138 — only when required under applicable law.

6 How Do We Protect Your Data?

Bonus138 takes its security infrastructure seriously to ensure your personal data remains protected at all times. These protections span both technical and operational layers working in tandem.

• Data encryption in transit: All communications between your browser or app and bonus138 servers are protected with 256-bit TLS/SSL protocols. This means your data cannot be read by any party attempting to intercept those communications.
• Data encryption at rest: Sensitive data such as identity verification information and financial details are stored in encrypted form on bonus138 servers. Your password is never stored in plain text — we use irreversible cryptographic hashing.
• Access controls: Only bonus138 staff with a legitimate need may access members' personal data, subject to the principle of least privilege. All access is logged and audited.
• Security monitoring: A 24/7 security monitoring system is in place to detect any unauthorised access attempts or suspicious activity involving bonus138 member data.
• Regular security testing: bonus138 conducts regular penetration testing and vulnerability assessments to identify and address potential security weaknesses before they can be exploited.
• Two-factor authentication (2FA): You can enable 2FA on your bonus138 account as an added layer of protection. We strongly encourage all members to activate this feature.

7 How Long Do We Retain Your Data?

Bonus138 does not retain your personal data longer than necessary. Retention periods are determined by the purpose of processing and applicable legal requirements.

• Active account data: Retained for the duration your bonus138 account remains active, and for the legally required period following account closure.
• Financial transaction records: Retained for a minimum of 7 years from the transaction date to comply with applicable financial and tax regulations in Malaysia.
• KYC records and identity verification: Retained for a minimum of 5 years after the business relationship ends, in accordance with applicable AML regulatory requirements.
• Live dealer session recordings: Retained for 90 days for game review and dispute resolution purposes.
• Customer support communication records: Retained for 2 years after the date of the last communication.
• Cookie and analytics data: Retention period depends on the type of cookie — session cookies are deleted when you close your browser, while persistent cookies have a set expiry date.

When data is no longer needed and there is no legal requirement to retain it, bonus138 will delete or anonymise that data in a secure manner.

8 Your Rights Regarding Personal Data

As the owner of your personal data, bonus138 recognises and respects the following rights available to you. To exercise any of these rights, contact us at support@bonus138.run stating the specific right you wish to exercise.

• Right of Access: You have the right to obtain a copy of the personal data we hold about you, including information on how that data is processed at bonus138.
• Right to Rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. You may also update your profile information directly from your bonus138 account settings.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data from bonus138's systems. Please note that this right may be limited by data retention obligations imposed by law.
• Right to Restriction of Processing: You have the right to request that bonus138 restrict the processing of your data in certain situations — for example, while you are verifying the accuracy of your data or during the assessment of a complaint.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time. This does not affect the lawfulness of any processing carried out prior to the withdrawal.

9 Cookie and Tracking Technology Policy

Bonus138 uses cookies and similar technologies to ensure the platform functions correctly, improve the user experience, and understand usage patterns. Below are the types of cookies we use.

You can manage cookies through your browser settings at any time. Please note that blocking essential cookies may affect the functionality of the bonus138 platform. For more information on managing cookies, refer to your browser's documentation.

10 Minors and Young User Protection

The bonus138 platform is strictly for individuals aged 18 and above. We do not knowingly collect personal data from minors. If you believe someone under the age of 18 has registered an account on bonus138, please contact us immediately at support@bonus138.run so we can take appropriate action, including account closure and deletion of the relevant data.

Bonus138 applies age verification procedures at registration and reserves the right to request further identity verification at any time if there is reasonable cause to believe a member may be under the required age.

11 International Data Transfers

In the course of its operations, bonus138 may transfer your personal data to third parties operating outside Malaysia — including technical service providers and cloud infrastructure vendors. When such transfers occur, we ensure adequate protections are in place for your data through the following mechanisms.

• Data processing agreements requiring protection standards equivalent to those applicable in Malaysia.
• Selection of providers holding recognised security certifications such as ISO 27001 or SOC 2.
• Risk assessment prior to engaging any third-party provider that will process bonus138 member data.

All international data transfers by bonus138 are carried out with the best interests and protections of members in mind.

12 Privacy Policy Amendments

Bonus138 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or new platform features. When we make material changes, we will notify you via your registered email and through in-platform notifications at least 14 days before the changes take effect.

The "Updated" date at the top of this document indicates when this Privacy Policy was last revised. Continued use of the bonus138 platform after any changes take effect will be considered acceptance of the amended Privacy Policy. We encourage you to review this page periodically to stay informed of bonus138's latest privacy practices.