Privacy Policy

1. Who We Are

1.1 In this Privacy Policy, "mr138", "we", "us", and "our" refer to the operator of the mr138 platform accessible at mr138.asia, operating under international gaming authority guidelines and applicable data protection requirements.

1.2 mr138 is the data controller responsible for the personal data of players and visitors collected through the mr138 website and mobile application. For data-related enquiries, please contact us at [email protected].

1.3 This Privacy Policy applies to all personal data collected in connection with your use of mr138, including account registration, gameplay, financial transactions, customer support interactions, and platform browsing. By registering a mr138 account or accessing the platform, you acknowledge this Policy.

2. Data We Collect

2.1 mr138 collects personal data in the following categories:

Identity Data: Full legal name, date of birth, gender, nationality, and copies of government-issued identification documents (e.g., Malaysian MyKad, passport) collected during account registration and Know Your Customer (KYC) verification.

Contact Data: Email address, mobile phone number, and residential address provided during registration or subsequently updated by the account holder.

Financial Data: Payment method identifiers (e.g., Touch n Go eWallet account reference, Boost wallet reference, bank account number fragments for verification), transaction history including deposit and withdrawal amounts, dates, and statuses. mr138 does not store full payment card numbers or complete bank account numbers.

Account Activity Data: Login timestamps, game history, wagering amounts, bet outcomes, bonus claims, promotional participation, and session duration data.

Technical Data: IP address, device identifier, browser type and version, operating system, screen resolution, and referring URL collected automatically when you access the mr138 platform.

Communications Data: Records of your interactions with mr138 customer support, including live chat transcripts, email correspondence, and any feedback or complaints submitted.

Responsible Gaming Data: Self-exclusion preferences, deposit limits, session time settings, and any responsible gaming declarations or assessments conducted in connection with your account.

3. How We Use Your Data

3.1 mr138 uses your personal data for the following purposes:

• Account management: Creating, verifying, maintaining, and securing your mr138 player account;
• Service delivery: Processing deposits and withdrawals in Malaysian Ringgit (MYR) via your chosen payment method (Touch n Go eWallet, Boost, DuitNow, Maybank2u, CIMB Clicks, Public Bank Online, and others);
• Regulatory compliance: Fulfilling Know Your Customer (KYC), Anti-Money Laundering (AML), and age verification obligations required under international gaming authority regulations;
• Fraud prevention: Detecting, investigating, and preventing fraudulent transactions, account abuse, and prohibited conduct as defined in the mr138 Terms & Conditions;
• Responsible gaming: Monitoring account activity for signs of problem gambling behaviour, enforcing self-imposed player limits, and administering self-exclusion requests;
• Customer support: Responding to enquiries, resolving disputes, and maintaining records of support interactions for quality and training purposes;
• Platform improvement: Analysing aggregated, anonymised usage data to improve the mr138 platform, game library, payment flows, and mobile experience;
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may withdraw consent at any time.

4. Legal Basis for Processing

4.1 mr138 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between you and mr138, including account creation, game access, and payment processing;
• Legal obligation: Processing required to comply with applicable KYC, AML, age verification, and regulatory reporting requirements under international gaming authority requirements;
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and improving our services, where such interests are not overridden by your privacy rights;
• Consent: Processing of data for direct marketing purposes, where you have provided explicit opt-in consent. You may withdraw this consent at any time without affecting other processing.

5. Data Sharing

5.1 mr138 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes.

5.2 mr138 shares personal data with the following categories of third parties where strictly necessary:

• Payment processors: Payment service providers facilitating MYR transactions (e.g., Touch n Go eWallet, Boost, DuitNow, FPX-connected Malaysian banks) receive transaction data necessary to process deposits and withdrawals;
• Game providers: Licensed game suppliers (such as providers of live casino, slots, and Sic Bo content) may receive the minimum account reference data required to authenticate your game session;
• KYC and identity verification services: Third-party identity verification providers may process copies of identification documents to fulfil age and identity verification requirements;
• Regulatory authorities: mr138 may be required to disclose personal data to gaming regulators, law enforcement agencies, or financial intelligence units in response to lawful requests or mandatory reporting obligations;
• Technology service providers: Cloud infrastructure, analytics, fraud detection, and customer support software providers that process data on mr138's behalf under data processing agreements.

5.3 All third-party data processors engaged by mr138 are required to implement appropriate technical and organisational security measures and are prohibited from using your data for their own purposes beyond the services they provide to mr138.

6. Cookies & Tracking Technologies

6.1 The mr138 platform uses cookies and similar tracking technologies (including local storage and session storage) to enable core platform functionality, remember your login session, and analyse how the platform is used.

6.2 The following categories of cookies are used by mr138:

• Strictly necessary cookies: Required for the platform to function. These include session authentication cookies, language preferences, and security tokens. These cannot be disabled;
• Functional cookies: Used to remember your preferences, such as your preferred payment method and game display settings;
• Analytics cookies: Used to collect anonymised data about how players interact with the mr138 platform, such as which pages are visited most frequently and which game categories are most popular. This data is used in aggregate only;
• Marketing cookies: Set only with your consent and used to deliver relevant promotional content. You may disable marketing cookies through your browser settings at any time.

6.3 You may manage or disable non-essential cookies through your browser's cookie settings. Please note that disabling certain cookies may affect the functionality of the mr138 platform.

7. Data Retention

7.1 mr138 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: retained for a minimum of five (5) years following account closure, in compliance with AML and regulatory record-keeping requirements;
• Financial transaction records: retained for a minimum of five (5) years from the date of the transaction;
• Customer support communications: retained for three (3) years from the date of the interaction;
• Marketing preferences and consent records: retained for as long as you hold an active mr138 account, or until consent is withdrawn.

7.2 Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with mr138's data management procedures.

8. Data Security

8.1 mr138 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL / TLS 1.3 encryption for all data transmitted between your device and mr138 servers;
• Encryption of sensitive data fields at rest within mr138 databases;
• Role-based access controls limiting internal access to personal data to authorised personnel only;
• Two-factor authentication (2FA) options for player accounts;
• Automated fraud detection and anomalous login monitoring;
• Regular security assessments and penetration testing of the mr138 platform.

8.2 In the event of a personal data breach that poses a risk to player rights, mr138 will notify affected individuals and relevant regulatory authorities within the timeframes required by applicable law.

9. Your Rights

9.1 As a player on the mr138 platform, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data mr138 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data held in your mr138 account;
• Right to erasure: You may request deletion of your personal data, subject to mr138's legal retention obligations (see Section 7);
• Right to restriction: You may request that mr138 restrict processing of your data in certain circumstances;
• Right to data portability: You may request your personal data in a structured, machine-readable format;
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing;
• Right to object: You may object to processing based on mr138's legitimate interests in certain circumstances.

9.2 To exercise any of these rights, contact mr138 at [email protected]. mr138 will respond to verified requests within thirty (30) days. Identity verification will be required before mr138 processes data access or deletion requests.

10. Children's Privacy

10.1 The mr138 platform is strictly for individuals aged 21 years and above. mr138 does not knowingly collect personal data from individuals under the age of 21. Where mr138 becomes aware that personal data of an underage individual has been collected, such data will be deleted promptly and the associated account closed.

10.2 If you believe that an underage individual has registered a mr138 account, please contact us immediately at [email protected].

11. Third-Party Services

11.1 The mr138 platform integrates with third-party payment providers (including Touch n Go eWallet, Boost, GrabPay, DuitNow, and Malaysian online banking platforms) and game content providers. When you interact with these services, you may also be subject to their respective privacy policies.

11.2 mr138 is not responsible for the privacy practices of third-party services accessed through or in connection with the mr138 platform. We encourage you to review the privacy policies of any third-party services you use in connection with mr138.

12. Policy Changes

12.1 mr138 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The effective date at the top of this page will be updated upon any material revision.

12.2 Where changes are material, mr138 will notify registered players via their registered email address or through a notice displayed upon login. Continued use of the mr138 platform following notification constitutes acceptance of the updated Privacy Policy.

13. Contact Us

13.1 For any questions, concerns, or requests relating to this Privacy Policy or mr138's data practices, please contact our support team:

• 24/7 Live Chat available on the mr138 platform
• Email: [email protected]
• Response time: under 1 hour for all privacy-related enquiries

13.2 mr138 is committed to resolving all data-related enquiries promptly and transparently. If you are not satisfied with the outcome of a privacy complaint, you may escalate to the applicable regulatory authority in your jurisdiction.