This Privacy Policy (hereinafter referred to as "Policy") describes how Koko138 (hereinafter referred to as "the Company", "we", "us", or "our"), operating the website at https://koko138.cam (the "Platform"), collects, uses, stores, discloses, and protects personal data provided by users (hereinafter "User", "you", or "your") of our online casino and sports betting services.

Koko138 is committed to safeguarding the privacy and personal data of all Users in accordance with applicable data protection principles and regulations. This Policy applies to all personal data collected through the Platform, including data provided during account registration, identity verification (KYC), payment processing, customer support interactions, and general Platform usage.

This Policy should be read in conjunction with Koko138's Terms & Conditions, which are incorporated herein by reference and govern your use of the Platform in its entirety.

The following definitions apply throughout this Privacy Policy:

Koko138 collects the following categories of Personal Data from Users, to the extent necessary for the purposes described in Section 5of this Policy:

3.1 Identity & Registration Data:

• Full legal name, date of birth, and gender
• Username and password (stored in encrypted form)
• Email address and mobile phone number
• Nationality and country of residence
• Malaysian identification number (MyKad), passport number, or driver's licence number (collected during KYC verification)

3.2 Financial & Transaction Data:

• Bank account details or e-wallet identifiers associated with deposit and withdrawal transactions
• Deposit amounts, dates, payment methods, and transaction reference numbers
• Withdrawal history and processing records
• Account balance and wagering history

3.3 Technical & Usage Data:

• IP address, device type, browser type and version, and operating system
• Session timestamps, pages visited, games played, and features accessed
• Geolocation data (country and city level, derived from IP address)
• Referal source and marketing attribution data

3.4 Communications Data:

• Records of live chat conversations, email correspondence, and support ticket submissions
• Marketing preferences and communication consent records
• Feedback and survey responses submitted voluntarily by the User

3.5 Verification Documents:

• Scanned copies or photographs of government-issued identity documents submitted for KYC purposes
• Proof of address documents (utility bills, bank statements, or equivalent issued within the last 3 months)
• Selfie photographs submitted as part of the biometric identity confirmation process

Koko138 collects Personal Data through the following mechanisms:

1. Direct Submission: Data provided by the User during account registration, KYC document upload, deposit initiation, support contact, or any other direct interaction with the Platform or our support team.
2. Automated Collection: Technical and usage data collected automatically when a User accesses the Platform, through server logs, session tracking technologies, and analytics tools.
3. Cookie Technologies: Data collected through first-party and third-party cookies placed on the User's device, as described in Section 9 of this Policy.
4. Third-Party Sources: In certain circumstances, we may receive data about a User from third-party service providers, including payment processors, identity verification partners, and fraud prevention services, where such receipt is necessary to fulfil our compliance obligations or to protect the integrity of the Platform.
5. Referal Programme: Where a User is referred to the Platform by another registered User, we may receive limited data about the referred User from the referrer as part of the referral tracking process.

Koko138 processes Personal Data for the following clearly defined and legitimate purposes:

All processing of Personal Data by Koko138 is carried out one or more of the following legal bases:

• Contractual Necessity: Processing is required to perform the contract between Koko138 and the User — i.e., to operate the User's account, process transactions, and deliver the gaming services requested.
• Legal Obligation: Processing is necessary to comply with applicable legal obligations, including KYC/AML requirements, age verification mandates, and regulatory reporting duties.
• Legitimate Interests: Processing is carried out where Koko138 has a legitimate business interest that is not overridden by the User's rights and interests, including fraud prevention, platform security, and service improvement.
• Consent: For marketing communications and certain cookie-based tracking activities, processing is conducted only where the User has provided clear, freely given, and informed consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Koko138 does not sell, rent, or trade Personal Data to third parties for their own commercial purposes. Personal Data may be shared with the following categories of recipients only to the extent strictly necessary for the purposes described in this Policy:

• Payment Service Providers: Including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency network processors — for the purpose of executing financial transactions.
• Identity Verification Partners: Third-party KYC and AML compliance service providers engaged to verify User identity and screen against regulatory watchlists.
• Cloud Infrastructure and Hosting Providers: Entities providing secure server infrastructure, database hosting, and content delivery services under contractual data processing agreements.
• Analytics Providers: Third-party web analytics services used to process aggregated, anonymised usage data for Platform improvement purposes.
• Legal and Regulatory Authorities: Government agencies, law enforcement bodies, financial intelligence units, and regulatory authorities where disclosure is required by applicable law, court order, or regulatory mandate.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by Koko138 in connection with its legal and regulatory obligations, subject to professional confidentiality obligations.

Koko138 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or for such longer period as may be required by applicable law or regulatory obligation.

8.1 Active Account Data: Personal Data associated with an active User account is retained for the duration of the account's existence and for a period of no less than five (5) years following account closure, to meet anti-money laundering regulatory record-keeping requirements.

8.2 KYC Documentation: Identity verification documents are retained for a minimum of five (5) years following the termination of the account relationship, in compliance with applicable AML record-keeping obligations.

8.3 Transaction Records: Financial transaction records, including deposit and withdrawal history, are retained for a minimum of seven (7) years to comply with financial regulatory and tax reporting requirements.

8.4 Support Communications: Records of customer support interactions are retained for up to three (3) years from the date of the last interaction.

8.5 Marketing Data: Marketing consent records and associated communication data are retained for the duration of the consent or until the User withdraws consent, plus a further period necessary to demonstrate compliance.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with Koko138's internal data lifecycle management procedures.

The Koko138 Platform uses cookies and similar tracking technologies to enhance the User experience, maintain session state, analyse Platform usage, and deliver relevant content. The following categories of cookies may be used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication tokens and security cookies. They cannot be disabled without impairing core Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how Users interact with the Platform, including pages visited, time spent, and error encounters. This data is used to improve Platform performance and user experience.
• Functional Cookies: Used to remember User preferences, such as language settings, display preferences, and previously entered information, to provide a more personalised experience across sessions.
• Marketing & Targeting Cookies: Used to deliver relevant promotional content and track the effectiveness of marketing campaigns. These cookies are only placed with the User's explicit consent.

Koko138 implements comprehensive technical and organisational security measures designed to protect Personal Data against unauthorised access, accidental loss, destruction, alteration, or unlawful disclosure. These measures include, without limitation:

• Transport Layer Security (TLS/SSL): All data transmitted between the User's device and Koko138's servers is encrypted using256-bit SSL/TLS encryption. Users should verify the presence of the HTTPS protocol and padlock icon in their browser address bar when accessing the Platform.
• Encryption at Rest: Sensitive Personal Data, including account credentials and payment information, is stored in encrypted form using industry-standard encryption algorithms.
• Access Controls: Access to Personal Data within Koko138's internal systems is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Secure KYC Document Handling: Identity verification documents are processed through a dedicated, encrypted secure upload portal. Documents are never processed via unencrypted email or open messaging channels.
• Fraud Detection Systems: Automated monitoring systems are in place to detect anomalous account activity, suspicious login attempts, and potential data security threats in real time.
• Regular Security Assessments: Koko138 conducts periodic security reviews and vulnerability assessments to identify and address potential weaknesses in its data protection infrastructure.

Notwithstanding the above, no method of electronic transmission or storage is entirely free from risk. Koko138 cannot guarantee absolute security of Personal Data but commits to taking all commercially reasonable steps to protect it. Users are encouraged to maintain the confidentiality of their account credentials and to notify Koko138 immediately of any suspected unauthorised access to their account.

Subject to applicable law and certain conditions, Users have the following rights with respect to their Personal Data held by Koko138. Requests to exercise any of these rights should be directed to Koko138's customer support team, with verification of identity required prior to processing.

Koko138 will respond to verified rights requests within a reasonable period, typically within 30 calendar days of receipt. In complex cases, this period may be extended, in which case the User will be notified accordingly.

Age verification is a mandatory component of the KYC process, and Koko138 employs technical and procedural controls to prevent access by persons who do not meet the minimum age requirement. Any account found to have been registered by a minor will be closed immediately, all associated funds will be forfeited, and the matter may be reported to relevant authorities where required by law.

If you become aware that a minor has registered an account on the Koko138 Platform, please notify us immediately via our customer support channels so that the account can be suspended and investigated without delay.

In the course of operating the Koko138 Platform, Personal Data may be transferred to and processed by service providers and infrastructure partners located outside of Malaysia, including in jurisdictions where data protection laws may differ from those applicable in Malaysia.

Where such international transfers occur, Koko138 ensures that appropriate safeguards are in place to protect the Personal Data transferred. These safeguards may include, as applicable:

• Contractual data processing agreements that impose data protection obligations equivalent to those applicable under this Policy
• Transfers to jurisdictions recognised as providing an adequate level of data protection
• Transfers to recipients who have implemented binding corporate rules or equivalent internal data protection frameworks

Koko138 will not transfer Personal Data to jurisdictions or recipients that are unable to provide appropriate data protection safeguards without the explicit informed consent of the User, where such consent is required under applicable law.

Koko138 reserves the right to update or revise this Privacy Policy at any time, at its sole discretion, to reflect changes in applicable law, regulatory guidance, business practices, or Platform features. The "Last Updated" date at the top of this page will be revised whenever material changes are made.

Where amendments are material in nature, Koko138 will endeavour to provide reasonable prior notice to registered Users by publishing a notice on the Platform and, where practicable, by email notification to the registered email address on file.

It is the User's responsibility to review this Policy periodically. Continued use of the Platform following the publication of any amended Policy constitutes acceptance of the revised terms. If a User does not agree to the amended Policy, they must cease using the Platform and may request account closure in accordance with the Terms & Conditions.

For any enquiries, requests, or complaints relating to this Privacy Policy or Koko138's handling of your Personal Data, please contact us through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available24/7 on the Platform — average response time 3–5 minutes
• Support Languages: English, Bahasa Melayu, Chinese

When submitting a data rights request or privacy complaint, please provide your registered username, a description of the data or issue in question, and any relevant reference numbers to assist our team in processing your request efficiently. We aim to acknowledge all privacy enquiries within 3 business days and to resolve them within 30 calendar days.

For responsible gambling support, please refer to our Responsible Gambling page or contact Talian Kasih at 15999.