Introduction
WD138 ("wd138", "we", "our", or "us") is committed to protecting the privacy and personal data of all individuals who access our platform atwd138.lat. This Privacy Policy ("Policy") sets out our practices in relation to the collection, use, storage, disclosure, and management of personal data submitted by or collected about registered Players and visitors to the wd138 website and associated services.
This Policy applies to all personal data processing activities carried out by wd138 in connection with the operation of its online casino and sports betting platform, including account registration, KYC identity verification, payment processing, customer support, and promotional communications. It covers all users of the wd138 platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other parts of Malaysia.
Your Agreement: By registering an account, depositing funds, or otherwise using the wd138 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, please discontinue use of the platform.
This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, which together govern the full terms of your relationship with wd138.
Definitions
In this Privacy Policy, the following terms carry the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or can be used to identify a natural person, directly or indirectly — including name, identification number, contact details, financial information, and online identifiers. |
| "Processing" | Any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction. |
| "Data Controller" | WD138 — the entity that determines the purposes and means of processing personal data collected through the platform. |
| "Data Subject" | The identifiable natural person to whom the personal data relates — i.e., the registered Player or website visitor. |
| "KYC Data" | Identity verification documents submitted by Players, including government-issued photo ID (MyKad, passport, driver's licence), proof of address, and selfie photographs. |
| "Cookies" | Small text files placed on your device by thewd138 platform or authorised third parties to facilitate session management, analytics, and preference storage. |
| "Third Party" | Any entity other than wd138 and the Data Subject, including payment processors, KYC verification service providers, game studio partners, and regulatory bodies. |
Data We Collect
WD138 collects the following categories of personal data, depending on your interaction with the platform:
| Category | Examples | Collected When |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, MyKad number, passport number | Account registration and KYC verification |
| Contact Data | Email address, mobile phone number, residential address (city, state, postcode) | Account registration and profile updates |
| Financial Data | Bank account details, e-wallet identifiers (Touch 'n Go, Boost, GrabPay), transaction history, deposit and withdrawal records in MYR | Payment processing and AML compliance |
| KYC Documents | Scanned or photographed MyKad, driver's licence, or passport; proof of address documents; selfie holding ID | Identity verification prior to withdrawal |
| Technical Data | IP address, device type, operating system, browser type, session timestamps, login history | Automatically upon platform access |
| Usage Data | Game history, bet amounts, wagering activity, bonus usage, sports markets accessed (EPL, Liga Super Malaysia, UFC, etc.) | Continuously during active sessions |
| Communications Data | Live chat transcripts, email correspondence, support ticket content | When you contact our support team |
| Marketing Preferences | Communication opt-in / opt-out status, promotional response history | Account settings and marketing interactions |
We do not intentionally collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, biometric data, or health information) unless specifically required for regulatory compliance purposes.
How We Collect Your Data
WD138 collects personal data through the following methods:
- Direct submission by you: When you register an account, complete KYC verification, make deposits or withdrawal requests, contact our support team, or update your profile settings.
- Automated technical collection: When you access our platform, we automatically collect technical and usage data via server logs, browser storage, and cookies placed on your device.
- Payment service providers: When you transact via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or any Malaysian bank (Maybank, CIMB, Public Bank, RHB, Hong Leong), our payment processors share transaction confirmation data with us.
- KYC and identity verification services: We may use authorised third-party identity verification partners who process your KYC documents on our behalf and return verification outcomes to us.
- Fraud prevention and AML screening services: Automated screening tools may cross-reference your details against financial crime watchlists and sanctions databases as required by our compliance programme.
Data Processing & Purpose
WD138 processes your personal data for the following specified, legitimate purposes:
- Account Administration: Creating, maintaining, and managing your wd138 player account, including verifying your identity, age (21+), and eligibility to use the platform.
- Service Delivery: Enabling you to access and use the full range of wd138 gaming and betting services, including live casino, slots, and sports betting markets.
- Payment Processing: Processing deposits and withdrawal requests in MYR via your chosen payment method, and maintaining accurate transaction records.
- KYC and Regulatory Compliance: Verifying your identity and address as required by our international licensing obligations, anti-money laundering (AML) regulations, and know-your-customer (KYC) requirements.
- Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent transactions, account abuse, bonus manipulation, and other prohibited conduct as defined in our Terms & Conditions.
- Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and providing technical assistance through our 24/7 support channels.
- Responsible Gambling: Monitoring account activity to identify potential signs of problem gambling, enabling self-exclusion requests, and administering deposit and loss limits.
- Marketing Communications (with consent): Sending you relevant promotional offers, bonus notifications, and platform updates where you have given your explicit prior consent to receive such communications.
- Platform Improvement: Analysing aggregated usage data (anonymised where feasible) to improve platform performance, game selection, and user experience.
No Speculative Processing: WD138 does not process your personal data for purposes other than those listed above. We do not use your data to build psychological profiles, serve targeted third-party advertisements, or profile you for purposes unrelated to the operation of the wd138 platform.
Legal Basis for Processing
WD138 processes your personal data on the following legal grounds, which we assess on a purpose-by-purpose basis:
- Contractual Necessity: Processing required to perform our obligations under the Player account agreement — including account administration, payment processing, and service delivery.
- Legal Obligation: Processing necessary to comply with applicable law — including KYC verification, AML record-keeping, and regulatory reporting obligations arising from our international operating licence.
- Legitimate Interests: Processing carried out in pursuit of wd138's legitimate business interests, including fraud prevention, platform security, service improvement, and responsible gambling monitoring — where these interests are not overridden by your privacy rights.
- Consent: Where processing is based on your freely given, specific, informed, and unambiguous consent — particularly for marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
Data Sharing & Disclosure
WD138 does not sell your personal data. We share data only in the following limited and controlled circumstances:
- Payment Processors: Data shared with Malaysian payment providers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, RHB, Hong Leong) and cryptocurrency processors (BTC/USDT/ETH) solely to execute your deposit and withdrawal instructions.
- KYC & Identity Verification Partners: KYC document data shared with authorised identity verification service providers who process this data on our behalf under strict data processing agreements.
- Game Studio Technology Partners: Limited technical session data (player ID, bet history, RNG seeds) shared with licensed game studio partners solely to enable gameplay and resolve game result disputes.
- Regulatory and Law Enforcement Authorities: Personal data disclosed where required by applicable law, court order, regulatory direction, or where wd138 has a good-faith belief that disclosure is necessary to prevent fraud, money laundering, or serious criminal activity.
- Business Transfers: In the event of a merger, acquisition, or sale of all or part of wd138's business, your personal data may be transferred as part of that transaction, subject to equivalent data protection commitments.
All third-party data processors engaged by wd138 are contractually required to process personal data only on our instructions, to maintain appropriate technical and organisational security measures, and to return or destroy data upon termination of their engagement.
International Data Transfers
WD138 operates under an international gaming licence and accordingly some of your personal data may be processed in jurisdictions outside of Malaysia. Where such international transfers occur, wd138 ensures that appropriate safeguards are in place to protect your personal data, including:
- Contractual clauses with data processors in third countries that impose equivalent data protection standards to those applicable in the licensing jurisdiction.
- Technical and organisational security measures appropriate to the sensitivity of the data being transferred.
- Limiting the scope of data transferred internationally to the minimum necessary for the processing purpose.
By using the wd138 platform, you acknowledge and consent to such cross-border data transfers where they are necessary for the provision of services, subject to the protections described above.
Cookies & Tracking Technologies
WD138 uses cookies and similar tracking technologies on its platform. Below is a summary of the cookie types deployed:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, authentication, security token validation. Required for the platform to function. Cannot be disabled. | Session / Short-term |
| Functional | Storing your platform preferences (language, display settings, last visited game category). Improves your browsing experience. | Up to 12 months |
| Analytics | Aggregated, anonymised data collection on page usage, session length, and feature engagement to improve platform performance. | Up to 24 months |
| Marketing (Consent Required) | Tracking promotional campaign performance and personalising bonus-related notifications where you have opted in to marketing. | Up to 12 months |
You may control non-essential cookie categories through your browser settings or via the cookie preference panel available on the wd138 platform. Please note that disabling strictly necessary cookies may impair your ability to log in and use the platform.
Data Retention
WD138 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. Our general retention periods are as follows:
- Active Account Data: Retained for the full duration of your registered account with wd138.
- KYC Identity Documents: Retained for a minimum of five (5) years following account closure or the last transaction, in accordance with our AML compliance obligations.
- Transaction and Financial Records: Retained for a minimum of five (5) years following the relevant transaction date.
- Customer Support Communications: Retained for up to three (3) years following resolution of the relevant enquiry or complaint.
- Marketing Consent Records: Retained for the duration of the consent period, plus a further two (2) years for audit and compliance purposes.
- Technical / Log Data: Retained for up to twelve (12) months unless required for longer for active fraud or security investigation purposes.
Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised using industry-standard data destruction methods.
Your Rights
As a Data Subject, you hold the following rights in relation to your personal data held by wd138. You may exercise any of these rights by contacting our Data Protection team at the details provided in Section 16.
WD138 will respond to all verified data rights requests within thirty (30) calendar days. Where requests are complex or numerous, we may extend this period by a further sixty (60) days, with prior notice to you. We may need to verify your identity before processing certain requests.
Important Limitation: Certain data rights requests — particularly erasure or restriction — may be limited wherewd138 is legally required to retain the relevant data for regulatory, AML, or dispute resolution purposes. We will always explain the specific reason if a request cannot be fulfilled in full.
Data Security
WD138 implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security programme includes:
- TLS/SSL 256-bit encryption for all data transmitted between your device and thewd138 platform.
- Encryption of sensitive personal data and payment credentials at rest in our secure database infrastructure.
- Role-based access controls limiting internal access to personal data to authorised personnel with a demonstrable operational need.
- Two-factor authentication (2FA) requirements for privileged internal system access.
- Regular independent security audits and penetration testing of platform infrastructure.
- Automated intrusion detection and real-time alerting systems monitoring for unauthorised access attempts.
- Secure disposal protocols for physical and digital records containing personal data.
In the event of a personal data breach that poses a risk to your rights and freedoms, wd138 will notify you and the relevant supervisory authority within the timeframes required by applicable data protection law.
You are responsible for maintaining the security of your own account credentials. We recommend using a strong, unique password and enabling any available two-factor authentication features on your wd138 account. Do not share your login details with any third party.
Minors & Age Policy
The wd138 platform is strictly intended for use by adults aged 21 years and above. We do not knowingly collect, process, or store personal data from persons under the age of 21.
All account registrations are subject to mandatory KYC age verification. Where wd138 discovers that personal data has been collected from a person under the age of 21— whether through fraud, misrepresentation, or error — we will:
- Immediately suspend the relevant account;
- Void all gaming transactions associated with the account;
- Return any net deposits (after deduction of any winings attributed to fraudulent underage access) to the payment method used; and
- Securely delete all personal data associated with the minor's account.
If you believe a minor may have accessed thewd138 platform using your account or their own, please contact our support team immediately via live chat or email.
Third-Party Services
The wd138 platform may reference or integrate with third-party services in the course of providing its Services. Please note:
- Links or references to payment service providers — including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, RHB, and Hong Leong — are governed by those providers' own privacy policies. We recommend reviewing the privacy policy of any payment provider you use before transacting.
- Game studio partners who supply content to the wd138 platform operate under separate data processing agreements with us. They act as data processors on our behalf and are not permitted to use player data for their own independent purposes.
- WD138 does not embed third-party social media widgets, tracking pixels from advertising networks, or other data-sharing integrations that transmit your personal data to unrelated third parties.
This Policy does not extend to any third-party websites, platforms, or services that you access independently. WD138 bears no responsibility for the data practices of third parties.
Policy Amendments
WD138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or operational requirements. Where changes are material, we will provide advance notice via in-platform notification or email to your registered address.
The updated Policy will be published atwd138.lat/privacy-policy with a revised effective date. Your continued use of the wd138 platform following publication of the updated Policy constitutes your acceptance of the revised terms. If you disagree with any amendment, you should cease using the platform and contact our support team to discuss account closure.
We encourage you to review this Policy periodically to stay informed of how wd138 protects your personal data.
Contact Us
For any queries, concerns, or requests relating to this Privacy Policy — including the exercise of your data subject rights — please contact the wd138 Data Protection team using the following details. Please do not send sensitive documents or ID copies via unsecured channels.
For complaints regarding our handling of your personal data that we are unable to resolve to your satisfaction through our internal process, you have the right to escalate your complaint to the relevant data protection supervisory authority in the jurisdiction applicable to your circumstances.