Privacy Policy

This Privacy Policy ("Policy") is published by bonus138, the operator of the online casino and sports betting platform accessible at https://bonus138.cam ("Platform", "we", "us", "our"). It governs the collection, processing, storage, use, and protection of personal data belonging to individuals who register on, visit, or interact with the Platform ("Player", "User", "you").

bonus138 is committed to processing personal data responsibly and in accordance with recognised international data protection standards, including the principles of purpose limitation, data minimisation, accuracy, and storage limitation. This Policy applies to all personal data collected through the Platform, including registration data, transaction records, KYC documents, session data, and communications with our support team.

By creating an account on bonus138 or using any of its services, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please discontinue use of the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" Any information relating to an identified or identifiable natural person, including name, identity number, email address, IP address, payment details, and account activity records.
• "Processing" Any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" bonus138, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" A third party that processes personal data on behalf of bonus138 under a data processing agreement, such as payment processors, KYC verification providers, or cloud hosting services.
• "KYC" Know Your Customer — the identity and age verification process required under our licensing obligations before processing withdrawals or enabling full account functionality.
• "Cookies" Small text files placed on your device by the Platform that store session information, preferences, and usage analytics to improve platform performance and user experience.
• "MYR / RM" Malaysian Ringgit — the primary transaction currency of the Platform.

bonus138 collects personal data through several channels. The categories of data we collect, and the contexts in which we collect them, are set out below:

3.1 Registration Data

When you create an account, we collect your full name, date of birth, email address, phone number, country of residence, and a chosen username and password. This information is necessary to establish and manage your account.

3.2 KYC & Identity Verification Data

To comply with our international licensing obligations and prevent fraud, we collect identity verification documents including government-issued photo identification (such as a Malaysian MyKad or passport), proof of address, and where required, evidence of source of funds. These documents are processed securely and retained only for as long as required under our regulatory obligations.

3.3 Financial & Transaction Data

We collect records of all deposits and withdrawals processed through the Platform, including transaction amounts in MYR, timestamps, payment methods used (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX via Maybank, CIMB, Public Bank, or Hong Leong Bank, or USDT TRC20), and relevant payment identifiers. We do not store full payment card numbers or full e-wallet credentials on our servers.

3.4 Usage & Session Data

We collect technical data generated during your use of the Platform, including IP address, device type and operating system, browser type and version, pages visited, features used, session duration, game history, and betting records. This data is used to operate the Platform, detect fraud, and improve service quality.

3.5 Communications Data

When you contact our support team via live chat or email, we retain records of those communications, including the content of messages, timestamps, and the resolution outcome, for quality assurance and dispute resolution purposes.

3.6 Voluntary Information

Any information you voluntarily provide beyond the above — such as responses to surveys, feedback submissions, or information you share during responsible gambling self-assessments — is collected and used solely for the stated purpose of that interaction.

bonus138 processes personal data on the following legal grounds:

We use the personal data we collect for the following purposes:

• Account operation: To create, maintain, and administer your player account on the Platform.
• Payment processing: To facilitate deposits and withdrawals in MYR through your chosen Malaysian payment method and to maintain accurate transaction records.
• Identity verification: To verify your age (minimum 21 years) and identity as part of our KYC process, in fulfilment of our licensing and anti-money laundering obligations.
• Fraud and security: To detect, investigate, and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other security threats to the Platform and its players.
• Customer support: To respond to your enquiries, resolve disputes, and provide assistance through our live chat and email support channels.
• Responsible gambling: To monitor gaming activity for signs of problem gambling and to administer self-exclusion, deposit limit, and cooling-off requests where made by players.
• Communications: To send you transactional notifications (account activity, withdrawal confirmations, KYC updates) and, where you have consented, promotional communications about bonuses and offers.
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the usability and performance of the Platform for all Malaysian and international users.
• Legal compliance: To meet obligations imposed on the Platform by our international gaming licence and applicable law, including responding to lawful requests from regulatory or law enforcement authorities.

bonus138 does not sell, rent, or trade your personal data to third parties for commercial marketing purposes under any circumstances.

We may share your personal data with the following categories of recipient, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Payment processors: Third-party payment service providers that process your MYR transactions, including providers supporting Touch 'n Go eWallet, DuitNow, FPX, and USDT TRC20 settlements. These providers receive only the minimum data necessary to complete the transaction.
• KYC / identity verification providers: Specialist third-party services engaged to assist with identity document verification and age checks. These providers operate under strict data processing agreements with bonus138.
• Fraud prevention and AML services: We may share data with fraud detection and anti-money laundering screening services to protect the integrity of the Platform and comply with our licensing requirements.
• Cloud infrastructure providers: Hosting and data storage services used to operate the Platform. All cloud providers are contractually required to maintain appropriate security standards.
• Regulatory and law enforcement authorities: Where required by law, court order, or our international gaming licence, we may disclose personal data to relevant regulatory bodies or law enforcement agencies.
• Professional advisers: Legal counsel, auditors, or other professional advisers engaged by bonus138 in the course of its legitimate business operations, subject to professional confidentiality obligations.

bonus138 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention guidelines apply:

• Active account data: Retained for the duration of your account being active on the Platform.
• Transaction and financial records: Retained for a minimum of five (5) years following the date of the transaction, in accordance with standard AML record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years following account closure, or longer if required by our licensing obligations.
• Support communications: Retained for up to two (2) years from the date of the interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained until you withdraw your consent, plus a reasonable period for record-keeping verification.

Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our internal data management procedures.

bonus138 employs a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption of sensitive data at rest, including identity documents and payment identifiers.
• Strict access controls ensuring that only authorised personnel can access personal data, on a role-based, need-to-know basis.
• Two-factor authentication options for player accounts.
• Regular security audits and penetration testing of Platform infrastructure.
• Secure data centres with physical and logical access controls operated by our infrastructure providers.

Notwithstanding the above, no method of electronic transmission or storage is completely secure. While we apply commercially reasonable safeguards, bonus138 cannot guarantee absolute security of data transmitted over the internet. Players are encouraged to use strong, unique passwords and to enable two-factor authentication on their accounts.

bonus138 uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use are as follows:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including maintaining your login session, remembering your language and currency preferences, and enabling secure transactions. These cookies cannot be disabled without impairing Platform functionality.
• Performance and Analytics Cookies: Used to collect aggregated, anonymised data about how Players use the Platform — such as which pages are most visited and where technical errors occur. This data helps us improve the Platform experience for all users, including Malaysian players.
• Functional Cookies: Used to remember your preferences and personalise your experience, such as your preferred game categories, notification settings, and responsible gambling tool configurations.
• Marketing Cookies: Used where you have consented to receive personalised promotional content. You may opt out of marketing cookies at any time through your account settings.

You may manage or disable cookies through your browser settings. However, disabling strictly necessary cookies may prevent you from using certain features of the Platform, including logging in and processing transactions.

bonus138 operates under international gaming licensing and uses service providers located in various jurisdictions. As a result, your personal data may be transferred to and stored in countries outside Malaysia, including jurisdictions that may not have data protection laws equivalent to those you may be accustomed to.

Where personal data is transferred internationally, bonus138 ensures that appropriate safeguards are in place, including contractual data processing agreements with receiving parties that impose data protection obligations consistent with the standards described in this Policy.

By using the Platform, Malaysian users consent to the international transfer of their personal data as described in this section, subject to the protections outlined herein.

Subject to applicable law and our regulatory obligations, you have the following rights with respect to your personal data held by bonus138:

• Right of Access: You may request a copy of the personal data we hold about you. We will respond within a reasonable timeframe and provide your data in a clear format.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you may request that we correct it. You may also update certain account details directly through your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal or regulatory retention obligations (such as AML record-keeping requirements).
• Right to Restrict Processing: In certain circumstances, you may request that we limit the processing of your personal data while a dispute is resolved.
• Right to Object: You may object to processing of your personal data where it is based on legitimate interests, including direct marketing communications.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Data Portability: Where technically feasible and legally permissible, you may request that we provide your personal data in a structured, commonly used format for transfer to another service provider.

To exercise any of these rights, please contact our support team via live chat or email at [email protected]. We may need to verify your identity before actioning any request. We will respond within a reasonable period and provide reasons if we are unable to fulfil a request.

The bonus138 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in our KYC process, and accounts found to belong to underage individuals will be immediately suspended and any balance held pending return of verified deposits.

If you believe that a person under the age of 21 has registered an account on the Platform, please contact our support team immediately. We take underage gambling extremely seriously and will act promptly upon receiving such reports.

bonus138 is an English-language platform designed for and accessible to Malaysian users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia. The following specific notice applies to Malaysian players:

Malaysian Data Protection: Malaysia's Personal Data Protection Act 2010 (PDPA) governs the processing of personal data by entities operating in Malaysia. While bonus138 operates under international licensing and its data controller entity is located outside Malaysia, we are committed to maintaining data processing standards that are substantively consistent with the principles of the PDPA, including notice, choice, disclosure, security, retention, data integrity, and access.

Malaysian Payment Data: Information associated with your use of Malaysian payment methods — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow QR / Transfer, and FPX transactions through Maybank, CIMB, Public Bank, or Hong Leong Bank — is handled in accordance with the respective payment provider's own data protection policies, in addition to this Policy. We receive only the minimum transactional data necessary to credit or debit your account.

Online Gambling & Malaysian Law: Online gambling is not regulated by any Malaysian government authority. The collection and processing of your personal data on the bonus138 Platform is carried out under our international gaming licence framework, not under Malaysian regulatory oversight. Malaysian users access the Platform at their own discretion and bear personal responsibility for compliance with applicable local laws.

bonus138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or our operational requirements. The "Last Updated" date at the top of this page indicates when the most recent revision came into effect.

Where changes are material, we will endeavour to notify you by displaying a prominent notice on the Platform or by sending a notification to the email address registered on your account. Continued use of the Platform following publication of an amended Policy constitutes your acceptance of the updated terms.

We encourage you to review this Policy periodically to remain informed about how we protect your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by bonus138, please contact us through the following channels:

• Live Chat: Available 24/7 directly through the bonus138 Platform. This is the fastest channel for urgent data-related enquiries.
• Email: [email protected] — Please note this address is displayed as plain text only and is not a clickable link. Responses within 2–4 hours during operational hours, Malaysian timezone.

When contacting us about a data subject request, please provide sufficient information to allow us to verify your identity and locate your account. We will acknowledge your request promptly and provide a substantive response within a reasonable timeframe.

For account-related matters including self-exclusion, deposit limits, or responsible gambling concerns, please also refer to our Responsible Gambling page.