Privacy Policy

buy138 ("we", "us", "our") operates the online gaming and sports betting platform accessible at https://buy138.casa. As part of providing our services to players across Malaysia — including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — we necessarily collect and process certain categories of personal data.

This Privacy Policy ("Policy") sets out, in clear and accessible terms, what personal data we collect, why we collect it, how we use it, with whom we may share it, and the rights you hold in respect of your personal data held by buy138. This Policy applies to all individuals who access or use the buy138 platform, whether as registered account holders or as anonymous visitors to our website.

This Policy should be read together with our Terms & Conditions, which govern your overall use of the buy138 platform, and our Responsible Gambling Policy.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person — that is, an individual who can be identified, directly or indirectly, by reference to that information.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Controller" means buy138, the entity that determines the purposes and means of the processing of your personal data.
• "Data Subject" means any identified or identifiable natural person whose personal data is processed by buy138 — in practice, this means you, the registered user or website visitor.
• "Platform" means the buy138 website at https://buy138.casa, its mobile-optimised interfaces, and all associated gaming and betting services offered therein.
• "KYC" (Know Your Customer) means the identity and age verification process through which buy138 confirms the identity of registered players prior to processing withdrawal requests.
• "Third-Party Service Providers" means payment processors (including Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect), game content providers, fraud detection services, and other vendors engaged by buy138 under contractual data processing agreements.

buy138 collects personal data across the following categories, depending on your interaction with the platform:

buy138 processes your personal data for the following specific purposes:

• Account Management: Creating and maintaining your buy138 account, authenticating your identity on login, and managing account settings and preferences.
• KYC & Age Verification: Verifying that all registered players are aged 21 or above, and confirming ownership of payment methods linked to the account prior to processing withdrawals.
• Payment Processing: Facilitating deposits and withdrawals through Malaysian payment channels including DuitNow, Touch 'n Go eWallet, Boost, GrabPay, FPX, and direct bank transfers via Maybank2u, CIMB Clicks, Public Bank Online, and Hong Leong Connect.
• Gaming Services: Delivering casino games, sports betting markets, live dealer tables, and other platform products to registered players.
• Fraud Prevention & Security: Detecting and investigating suspicious account activity, preventing unauthorised access, and identifying potential money laundering or bonus abuse patterns.
• Responsible Gambling Compliance: Monitoring account behaviour to identify problem gambling indicators and applying responsible gambling interventions where necessary, including enforcing self-exclusions and deposit limits.
• Customer Support: Responding to player enquiries, resolving disputes, and maintaining support correspondence records.
• Marketing Communications: Where you have consented, sending promotional offers, bonus notifications, and platform updates via email or in-platform messaging. You may withdraw this consent at any time through your account settings.
• Legal & Regulatory Compliance: Meeting obligations under applicable anti-money laundering regulations, responding to lawful requests from regulatory authorities, and maintaining records as required by law.

buy138 processes your personal data on one or more of the following legal bases, depending on the nature of the processing activity:

• Contractual Necessity: Processing required to perform our contract with you — including account creation, payment processing, and delivery of gaming services.
• Legitimate Interests: Processing necessary for buy138's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — provided those interests are not overridden by your privacy rights.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including KYC verification, anti-money laundering record-keeping, and responses to lawful regulatory requests.
• Consent: Processing based on your freely given, specific, and informed consent — primarily in relation to marketing communications. You retain the right to withdraw consent at any time without affecting the lawfulness of prior processing.

buy138 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Your personal data may be disclosed to third parties only in the following circumstances:

• Payment Processors: Your transaction data is shared with the relevant payment service provider (such as your chosen e-wallet operator or bank) to process deposits and withdrawals. These providers process your data as independent controllers subject to their own privacy policies.
• Game Content Providers: Certain gaming activity data (such as your account identifier and wager amounts) may be shared with third-party game studios whose titles are hosted on the buy138 platform, solely for the purpose of delivering those games.
• Identity Verification Services: During KYC processing, your identity documentation may be shared with contracted identity verification service providers who process this data on buy138's behalf under strict data processing agreements.
• Fraud Detection & Security Partners: Technical and device data may be shared with fraud detection services to identify suspicious activity and protect the integrity of the platform.
• Legal & Regulatory Authorities: buy138 may disclose your personal data to law enforcement agencies, regulatory bodies, or courts of competent jurisdiction where required by applicable law or in response to a valid legal order.
• Corporate Transactions: In the event of a merger, acquisition, or restructuring of buy138, your personal data may be transferred to the acquiring entity subject to equivalent data protection commitments.

buy138 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with buy138, and for a minimum of five (5) years following account closure — in accordance with anti-money laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of the relevant transaction, in compliance with applicable financial record-keeping obligations.
• Gaming and betting activity data: Retained for the duration of your account and for five (5) years following account closure, for dispute resolution and responsible gambling monitoring purposes.
• Customer support communications: Retained for three (3) years from the date of the last communication in a given support thread.
• Technical and device data: Retained for up to twelve (12) months from collection for security and analytics purposes.
• Marketing consent records: Retained for as long as you remain subscribed to marketing communications, plus a further three (3) years to evidence the original consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

buy138 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the buy138 platform is encrypted in transit using industry-standard TLS protocols.
• Encrypted Data Storage: Sensitive personal data stored on buy138 systems is encrypted at rest using robust encryption standards.
• Access Controls: Access to personal data within buy138's internal systems is restricted to personnel with a documented need-to-know, enforced through role-based access controls and multi-factor authentication requirements.
• Two-Factor Authentication (2FA): Available to all registered players as an optional but strongly recommended account security measure.
• Fraud Monitoring: Automated and manual monitoring systems operate continuously to detect anomalous account activity, unusual login patterns, and potential data security incidents.
• Security Audits: buy138's platform and security infrastructure are subject to periodic internal and third-party security reviews and penetration testing.

The buy138 platform uses cookies and similar tracking technologies to provide a functional, secure, and personalised user experience. Cookies are small text files stored on your device when you visit a website. buy138 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the buy138 platform — including maintaining your logged-in session, remembering your language and currency preferences, and enabling secure payment processing. These cookies cannot be disabled without impairing your ability to use the platform.
• Analytics Cookies: Used to collect aggregated, anonymised data about how visitors use the buy138 platform — including which pages are visited most frequently, where users arrive from, and how long sessions last. This data helps buy138 improve platform usability.
• Fraud Prevention Cookies: Technical identifiers used in conjunction with our fraud detection systems to identify unusual access patterns and protect account security.
• Preference Cookies: Used to remember your platform settings and customisations between sessions, such as saved deposit method preferences.
• Marketing Cookies: Used where you have consented to receive personalised offers and promotions. These cookies allow buy138 to tailor bonus offers and communications to your account activity and preferences.

You may adjust your cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies may limit your ability to access certain platform features. A full cookie inventory is available on request from our support team.

As a platform operating in the digital gaming space, buy138 may engage Third-Party Service Providers — including game content studios, identity verification services, and fraud detection providers — whose infrastructure is located outside Malaysia. In such cases, your personal data may be transferred to and processed in jurisdictions other than Malaysia.

Where such international transfers occur, buy138 takes appropriate steps to ensure that your personal data receives a level of protection equivalent to that which it receives under this Policy, including through the use of contractual safeguards with the receiving party.

By using the buy138 platform and accepting this Privacy Policy, you consent to the transfer of your personal data to service providers located in other jurisdictions for the limited purposes described in this Policy, subject to the protections described above.

As a Data Subject whose personal data is processed by buy138, you hold the following rights in respect of your personal data. You may exercise any of these rights by contacting buy138's support team using the details in Section 14.

buy138 is strictly intended for persons aged 21 years and above. We do not knowingly collect, process, or retain personal data belonging to individuals under the age of 21. Our registration process includes age verification steps, and all accounts are subject to KYC verification prior to withdrawal processing.

If buy138 discovers or has reason to believe that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant account, delete the associated personal data to the extent permissible under applicable law, and retain only the minimum information required to prevent the individual from re-registering.

buy138 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or platform services. Where amendments are material — meaning they substantively alter your rights or our obligations — buy138 will notify registered players via the email address associated with their account at least fourteen (14) days prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page indicates when the current version of this Policy was published. We encourage you to review this Policy periodically. Your continued use of the buy138 platform following the publication of any revised Policy constitutes your acceptance of the updated terms.

If you wish to exercise any of your data subject rights, have a question about this Privacy Policy, or wish to raise a concern about how buy138 handles your personal data, please contact our Data Protection team using the details below. We respond to all privacy-related enquiries in English and aim to resolve all matters within 30 calendar days.

Email: [email protected]
Live Chat: Available 24/7 directly through the buy138 platform
Subject Line: Please include "Privacy Request" or "Data Subject Rights" in your subject line to ensure prompt routing

When submitting a rights request, please include your registered email address and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing your request to prevent unauthorised disclosure of personal data.