Privacy Policy Merdeka138 — Personal Data Protection for Malaysian Members

Introduction

Merdeka138 takes our responsibility to member privacy seriously. Over more than 15 years of operation serving over 500,000 members across Malaysia, we have built trust in one way — by being transparent about how we handle your data and ensuring it is always protected to the highest standard available.

This Privacy Policy is drafted in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and internationally recognised data protection principles. It applies to all personal information collected through the Merdeka138 platform, including during registration, use of services, deposits and withdrawals, and interactions with our customer support team.

When we refer to "personal data", we mean any information that can identify you directly or indirectly — including your name, phone number, email address, financial information and platform usage data. We recognise that this is sensitive information, and we take full responsibility for keeping it secure.

Personal Data We Collect

Merdeka138 collects personal data from a variety of sources in the course of providing our services. Below is a detailed explanation of the types of data we collect and how they are gathered:

We only collect information that is necessary to provide our services. Data minimisation is central to how we operate — if a piece of data is not needed to serve you better or to fulfil our legal obligations, we do not collect it.

How We Use Your Personal Data

Merdeka138 uses members' personal data solely for the following purposes. We will not use your data for any other purpose without obtaining your consent beforehand:

1. Account Management: To create and manage your account, including identity verification, age verification (18 and above), and validation of your Malaysian phone number.
2. Service Provision: Processing your deposits via Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay and FPX; processing withdrawals to your Malaysian bank account; and enabling you to enjoy slots, live casino, Sports Betting and e-sports on the Merdeka138 platform.
3. Security & Fraud Prevention: To identify and prevent fraud, money laundering, multi-account abuse, and other illegal activities that may compromise platform integrity or the safety of other members.
4. Legal Compliance: To fulfil obligations under applicable Malaysian laws, including anti-money laundering (AML) legislation and Know Your Customer (KYC) requirements.
5. Customer Support: Responding to enquiries, resolving complaints and providing technical assistance to members via Live Chat and email.
6. Relevant Marketing: Sending information about promotions, bonuses, and new offers to members who have consented to receive marketing communications. You may withdraw this consent at any time.
7. Platform Improvements: Analysing platform usage patterns in aggregate (not at an individual level) to improve the user experience, identify the most popular games, and develop new features.

Data Sharing with Third Parties

Merdeka138 does not sell members' personal data. However, in the course of normal platform operations, we may share necessary data with the following categories of third parties, strictly for the purposes stated:

• Game Providers: Pragmatic Play, PG Soft, Evolution Gaming, Microgaming and other providers receive only the minimum technical data required to run the games — typically just a game session ID and wagering information, not your personal identity data.
• Payment Gateway: Payment service providers such as Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay and FPX receive the transaction data necessary to process your deposits and withdrawals. These are licensed entities subject to their own data protection requirements.
• Statutory Authorities: Merdeka138 may be required to disclose certain data to law enforcement bodies or Malaysian statutory authorities when compelled to do so by law or a valid court order.
• Technical Service Providers: Companies that assist with server hosting, data processing and other technical services may access data in a processing capacity — they are bound by strict confidentiality agreements and are not permitted to use your data for their own purposes.

All third parties with whom Merdeka138 shares data are bound by data protection agreements requiring them to handle your data to a standard no less stringent than our own.

Data Security Measures

Merdeka138 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or accidental disclosure. These include:

1. Encryption in Transit: All data transmitted between your browser and Merdeka138's servers is protected by TLS/SSL encryption at 256-bit strength — ensuring your data cannot be intercepted or read by unauthorised parties in transit.
2. Storage Encryption: Sensitive data stored in our databases, including identity information and financial records, is encrypted using industry-recognised encryption algorithms.
3. Access Controls: Access to members' personal data is restricted to staff with a legitimate business need only. All access is logged and regularly audited. Staff who leave the company have their access revoked immediately.
4. Continuous Monitoring: Merdeka138's systems are continuously monitored for suspicious activity and unauthorised access attempts. Automated alert systems are in place to identify potential threats.
5. Security Testing: The Merdeka138 platform undergoes regular penetration testing and security audits by independent third parties to identify and address any vulnerabilities.
6. Staff Training: All Merdeka138 staff who handle personal data undergo regular data protection training and are bound by legally enforceable confidentiality agreements.

Cookies and Tracking Technologies

Merdeka138 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. Below is an explanation of the types of cookies we use:

1. Essential Cookies (Required): These cookies are essential for the platform to function correctly. They store your login status, language preferences and current session settings. Without them, the platform cannot operate. These cookies cannot be disabled.
2. Performance Cookies (Analytics): These cookies help us understand how members interact with the platform — which pages are visited most frequently, how long gaming sessions last and where members encounter difficulties. This information is used in aggregate to improve the platform. No personally identifiable information is collected.
3. Functional Cookies: These cookies store your preferences — such as favourite games, display settings, and account options — so you don't have to reconfigure them each time you log in.
4. Security Cookies: These cookies help us identify and prevent fraudulent activity, including tracking unauthorised login attempts and detecting patterns that indicate account abuse.

You can manage or disable cookies through your browser settings. Please note, however, that disabling certain cookies may affect the functionality or user experience of the Merdeka138 platform. For the best experience, we recommend keeping cookies enabled while using the platform.

Data Storage & Retention Periods

Merdeka138 retains members' personal data for as long as necessary to fulfil the purpose for which it was collected and to comply with relevant legal obligations. Our general principles are:

1. Active Account Data: Personal data belonging to members with active accounts is retained for as long as the account remains active, and for any additional period required by law thereafter.
2. Financial Records: Transaction records, deposits and withdrawals are retained for a minimum of 7 years in accordance with Malaysia's anti-money laundering and tax requirements.
3. Gaming Records: Game history is retained for a minimum of 5 years for audit and compliance purposes.
4. Customer Support Records: Customer support communications are retained for 3 years from the date of the last interaction.
5. Closed Account Data: Upon account closure, Merdeka138 will delete or de-link personal data that is no longer needed to fulfil legal obligations, typically within 90 days of the closure date, unless applicable law requires a longer retention period.

Members who have closed their accounts and wish to request deletion of their personal data may submit a request by emailing support@merdeka138.best. Requests will be processed within 30 business days, and we will notify you of the actions taken, including any data that cannot be deleted due to legal obligations.

Member Rights Regarding Personal Data

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and this Privacy Policy, you as a Merdeka138 member have the following rights regarding your personal data:

To exercise any of the rights above, please contact our data protection team at support@merdeka138.best with the subject line "Personal Data Rights Request". Please include your full name and registered phone number for identity verification. We will respond within 21 business days of receiving your request.

Protection of Children's Data

Merdeka138 takes the protection of minors very seriously. Our platform is strictly for users aged 18 and above, and we do not knowingly collect or process personal data of individuals under the age of 18.

If we discover that personal data of someone under the age of 18 has been collected without our knowledge — whether through the submission of false information during registration or by any other means — we will take the following immediate action:

1. The account in question will be suspended immediately pending the outcome of the investigation.
2. All personal data associated with the account will be deleted from our systems once the investigation is concluded.
3. Any related financial transactions will be investigated, and verified real-money funds will be returned in accordance with the appropriate procedures.

If you believe that someone under the age of 18 has registered an account on Merdeka138, please contact us immediately at support@merdeka138.best.

Changes to This Privacy Policy

Merdeka138 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements or platform operations. Our commitment to you when changes occur is as follows:

• Members will be notified of material changes to this Privacy Policy via in-platform notifications and/or email to their registered address, at least 14 days before the changes take effect.
• The date of the last update will always be displayed at the top of this document so you know when the current version was published.
• For changes that require fresh consent — such as using your data for a new purpose not covered by the current policy — we will obtain your explicit consent before those changes take effect.
• The version history of this document is available for members who wish to review changes made over time.

Your continued use of the Merdeka138 platform after any amendment to this Privacy Policy takes effect will be considered acceptance of those changes. If you do not agree with any changes, you have the right to close your account and request deletion of your personal data before the changes come into effect.

Contact Us About Privacy

If you have any questions, concerns or complaints about how Merdeka138 handles your personal data, we encourage you to reach out to us directly. We are committed to resolving any issues promptly and transparently.

For all privacy and data protection enquiries, you can reach our team through the following channels:

1. Email: support@merdeka138.best — use the subject line "Privacy Policy Enquiry" to ensure your message is routed to the right team. We aim to respond within 2–4 hours on business days.
2. Live Chat: Available 24 hours a day, 7 days a week within the platform. Suitable for general privacy enquiries. For more formal data rights requests, email is the recommended channel as it creates a complete written record.

Any data protection complaints that cannot be resolved directly with Merdeka138 may be submitted to the Department of Personal Data Protection, Ministry of Communications and Digital Malaysia, through the official channels designated by the Ministry.