Mitra138 Privacy Policy – Member Data Protection Malaysia

Trust is the foundation of the relationship between mitra138 and every member who uses our platform. When you register, make a deposit via Touch 'n Go eWallet or GrabPay, place a bet on a Malaysia Super League match, or play at our live blackjack tables – you are entrusting us with your personal information. We take that trust seriously.

This Privacy Policy is written in plain language so that all Malaysian members can understand it easily, without confusing legal or technical jargon. Our goal is for you to have a full and clear picture of what happens to your data – not merely to satisfy a legal obligation.

mitra138 complies with Malaysia's Personal Data Protection Act 2010 (PDPA), which governs how organisations collect, store, use, and disclose personal data in Malaysia. Every data processing activity we carry out has a valid legal basis and a clearly defined purpose.

mitra138 only collect data that is genuinely necessary to provide our services safely and effectively. We do not collect excessive data or data with no direct relevance to platform operations. Below are the categories of data we collect and why each is required:

Data you provide directly during registration:

• Full name – for identity verification and account personalisation.
• Malaysian phone number – for account verification via OTP and customer support communications.
• Email address – for sending transaction receipts, account notifications, and other important communications.
• Date of birth – to verify that you meet the minimum age requirement of 18 years as set out in the Terms and Conditions mitra138.
• Password (in encrypted form) – for account security. Passwords are stored in a hashed format that cannot be read.

Data collected automatically while you use the platform:

• IP address – for fraud prevention, multi-account detection, and platform security.
• Device type and web browser – to optimise how the platform displays on your device.
• Gaming session history – including games played, total bets placed, wins, and losses, for account management and responsible gaming purposes.
• Financial transaction records – including total deposit amounts, payment methods used (Touch 'n Go, GrabPay, DuitNow, Boost, ShopeePay, FPX), transaction dates and statuses, for audit records and financial processing.
• Cookie and session data – to keep you logged in and personalize your platform experience.

Data we collect as part of the KYC (identity verification) process:

• A copy of your MyKad or other valid Malaysian identity document – stored in a secure system with restricted access.
• Proof of payment method – a screenshot or statement confirming that the payment method is registered in your name.

Every piece of data we collect has a clear and defined purpose. mitra138 operates on a "limited purpose" principle – meaning your data will not be used for any purpose other than those stated here without your explicit consent.

Primary purposes of data use:

• Account Management – creating, maintaining, and securing your account mitra138 yours, including login verification and account recovery.
• Processing financial transactions – processes deposits via Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX, and handles withdrawals to your linked accounts.
• Provision of gaming services – gives you access to all games on the platform, including Live Casino, jackpot slots, poker, blackjack, and Sports Betting on the Malaysia Super League and international leagues.
• Fraud prevention and security – to detect and prevent unauthorised access, multi-accounting, money laundering, and other fraudulent activities that could harm you or other members.
• Customer Support – enabling the support team to mitra138 help you resolve issues with accurate and relevant account information.
• Legal compliance – to comply with Malaysian legal requirements including the PDPA 2010, anti-money laundering (AML) obligations, and directives from the relevant authorities.
• Service communications – sending important notifications relating to your account, transactions, changes to terms, and security information. These are not marketing communications – you cannot opt out of receiving them.
• Platform improvements – to analyse usage patterns on an aggregated (not individual) basis in order to improve platform performance and user experience mitra138.
• Responsible gambling – to monitor gaming patterns in order to identify members who may need assistance and to ensure that betting limit tools are functioning effectively.

If you gave consent to marketing communications when registering your account, we may also use your email to send information about promotions mitra138, new bonuses, and exclusive offers. You may withdraw this consent at any time through your account settings or by contacting our support team.

This is perhaps the most important section to understand. mitra138 does not sell, rent, or trade members' personal data to any third party for marketing purposes or any purpose unrelated to the provision of our services. This is an absolute, unwavering commitment.

However, there are situations where we need to share certain data with trusted third parties to keep the platform running. These include:

• Payment gateway providers – such as Touch 'n Go eWallet, GrabPay, DuitNow, Boost, ShopeePay, and FPX processors, which require minimal transaction information to process your deposits and withdrawals. They do not receive your gaming history or any other account details.
• Game service providers – companies that supply live casino, slots, and poker game software to the platform mitra138. They receive only a game session ID and none of your personally identifiable information.
• Cybersecurity service providers – companies that help us detect and prevent fraud and cyberattacks. Data sharing is limited to the technical data required for platform protection.
• Malaysian legal authorities – if we receive a lawful directive from Malaysian law enforcement agencies, courts, or financial regulators requiring the disclosure of specific information. We will notify you of any such request unless prohibited from doing so by law.

All third parties we work with are bound by strict data processing agreements that require them to protect your data and use it solely for the specified purposes. They are contractually prohibited from using your data for their own ends.

Data security is not just a feature – it is the backbone of everything mitra138. We continually invest in the latest security infrastructure to ensure your data is protected against all known threats.

Technical security measures we employ:

• 256-bit SSL Encryption for all communications between your device and our servers mitra138. This means all data transmitted – including login credentials, transaction details, and game history – cannot be read by third parties even if intercepted.
• Encryption of data at rest – sensitive data such as passwords are stored in a hashed format that cannot be reversed to its original form. Even our mitra138 cannot read your password.
• Two-factor authentication (2FA) available to all accounts. We encourage all members to enable this feature through their account settings.
• 24/7 security monitoring – our systems are continuously monitored for suspicious activity, unauthorised access attempts, and security anomalies.
• Strict internal access controls – only employees with a legitimate business need may access member data, and all such access is logged and audited on a regular basis.
• Regular security testing – platform mitra138 undergoes regular penetration testing and independent security audits.

While we take every reasonable precaution, no system is 100% immune to attack. In the event of a data breach involving your information, mitra138 is committed to notifying you within 72 hours of becoming aware of a breach, in line with industry best practices.

Platform mitra138 uses cookies and similar tracking technologies to enhance your experience. Cookies are small text files stored on your device when you browse our website.

Types of cookies we use:

• Session cookies (required) – maintains your logged-in state and allows the platform to function properly. Without these cookies, you will not be able to use the platform at all. These cookies are deleted when you close your browser.
• Preference cookies (mandatory) – to save your preferences such as language, display theme and account settings so you don't have to reconfigure them every time you log in.
• Security cookies (mandatory) – to help identify and prevent unauthorised access by detecting suspicious session patterns.
• Analytics cookies (optional) – collects anonymised usage data to help us understand how members use the platform and where we can improve. This data is not linked to your identity.

You can manage your cookie settings through your web browser. Please note that disabling essential cookies will cause the platform to function incorrectly. Disabling analytics cookies will not affect your gaming experience.

Platform mitra138 does not use third-party cookies for advertising or cross-site tracking purposes. We do not track your online activity outside of our platform mitra138.

Under Malaysia's Personal Data Protection Act 2010 and international data protection best practices, you as a member mitra138 holds the following rights regarding your personal data. We fully respect and facilitate the exercise of these rights.

• Right to access your data – you may request a copy of all personal data we hold about you at any time. Requests will be processed within 14 business days.
• Right to rectify data – if you find that the data we hold is inaccurate or out of date, you may request a correction through your account settings or by contacting customer support.
• Right to erasure – under certain circumstances, you may request that we delete your personal data. Such requests are subject to our legal obligations to retain specific records for audit and compliance purposes.
• Right to object to processing – you may object to the use of your data for marketing communications at any time, without needing to provide a reason.
• Right to data portability – you may request your data in a machine-readable format for transfer to another platform.
• Right to withdraw consent – for any data processing based on your consent, you may withdraw that consent at any time without affecting the validity of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact the privacy team at mitra138 via email to support@mitra138.best with the subject line "Privacy Rights Request" along with your account number. All requests will be acknowledged within 48 hours and resolved within 14 business days.

mitra138 only retains your personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, or for as long as required under Malaysian law.

• Active account data – retained for as long as your account remains active on the platform mitra138.
• Financial transaction records – retained for a minimum of 7 years from the transaction date, in accordance with Malaysian financial and tax legislation.
• KYC records (identity verification) – retained for 5 years from the date of verification or account closure, whichever is later, as required under anti-money laundering legislation.
• Game history – retained for 3 years for dispute resolution and responsible gambling purposes.
• Customer support communication logs – retained for 2 years for quality control and dispute resolution purposes.
• Marketing data – deleted within 30 days of the date you withdraw consent for marketing communications.

When the retention period expires or when data is no longer needed, mitra138 will securely delete or anonymise that data so it can no longer be linked to you.

Platform mitra138 is strictly for individuals aged 18 and above. We do not knowingly collect, process, or store personal data of anyone under the age of 18.

If we discover that data has been collected from a minor without our knowledge – whether through false information provided during registration or by any other means – we will take immediate action to delete that data and close the associated account.

If you are a parent or guardian and discover that your minor child has registered an account at mitra138, please contact us immediately at support@mitra138.best. We will take immediate action to close the account, delete all related data, and refund any deposits made where identifiable.

mitra138 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, updates to Malaysian data protection laws, or improvements to our services. All amendments will be published on this page with a refreshed "Updated" date.

How we notify you of material changes:

• A clear in-platform notification will be displayed when you first log in after an amendment is published.
• Email notifications will be sent to your registered email address for changes that materially affect your privacy rights.
• The "Updated" date at the top of this document will be revised.

Continued use of the platform mitra138 after the effective date of any amendment will be considered acceptance of the revised policy. If you do not agree with any changes, please stop using the platform and contact us to close your account and withdraw your balance.

If you have any questions, concerns, or complaints about how mitra138 handles your personal data, or if you wish to exercise any of the privacy rights set out in this Policy, please contact us:

• Email: support@mitra138.best (use the subject line "Privacy & Personal Data")
• Live Chat: Available 24/7 within the platform – the fastest way to get help with urgent enquiries

Team mitra138 will acknowledge all privacy-related enquiries within 48 hours and provide a response or resolution within 14 business days. If your issue requires more time to resolve, we will keep you updated on its progress at regular intervals.

This Privacy Policy is governed by the laws of Malaysia, in particular the Personal Data Protection Act 2010. Any dispute that cannot be resolved internally may be referred to the Department of Personal Data Protection Malaysia or through the agreed dispute resolution channels.