Box138 Privacy Policy – Personal Data Protection for Malaysian Users

Welcome to the box138 Privacy Policy. This document explains in detail how box138, an online betting platform operating in Malaysia, collects, processes, stores, and protects your personal data. box138 is committed to safeguarding every user's privacy to the highest security standards.

This box138 privacy policy applies to all users who access or use the box138 platform via box138.my, the mobile app, or any other box138 service channel. By using the box138 platform, you agree to the collection and use of your information as described in this privacy policy.

Box138 takes data protection seriously. We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and are committed to maintaining high privacy standards across all aspects of our operations. If you have any questions about this privacy policy, please contact us at support@box138.my.

Box138 collects various types of personal data from users to provide efficient and secure services. Below are the categories of data we collect and the purposes for which they are collected:

Box138 only collects data that is strictly necessary for the stated purposes. We do not collect excessive or irrelevant data beyond what our platform requires. All data is collected directly from you during registration, platform use, or through interactions with our support team.

Personal data collected by box138 is used solely for the following purposes. We will not use your data for any other purpose without first obtaining your consent:

• Service Provision: Processing account registration, deposits, withdrawals, and all betting activity on the box138 platform.
• Identity Verification (KYC): Ensuring all users meet the minimum age requirement of 18 and verifying their identity before withdrawals are permitted.
• Fraud Prevention & Security: Monitoring account activity to detect any unauthorised access, money laundering, or bonus abuse.
• Customer Support: Handling enquiries, complaints, and assistance requests submitted to the box138 support team.
• Operational Communications: Sending important account notifications such as deposit confirmations, withdrawal approvals, and security alerts.
• Marketing (With Consent): Sending information about box138 promotions, new bonuses, and exclusive offers – only if you have agreed to receive marketing communications.
• Legal Compliance: To meet reporting and compliance obligations as required under applicable Malaysian law.
• Platform Improvement: Analysing usage patterns in aggregate and anonymised form to improve the user experience on the box138 platform.

Box138 ensures that all personal data processing has a valid legal basis – whether grounded in your consent, contractual necessity, legal obligation, or our legitimate interests as a platform operator.

Box138 does not sell, rent, or share your personal data with third parties for their own marketing purposes. However, there are limited circumstances in which we may need to share your data:

• Service Provider: Third parties that assist us in operating the box138 platform, such as payment gateway providers (Touch 'n Go, DuitNow, FPX), cloud server providers, and identity verification companies. All such providers are bound by strict confidentiality agreements.
• Legal Compliance: box138 may be required to disclose certain data to Malaysian authorities such as the Royal Malaysia Police, Bank Negara Malaysia, or courts pursuant to a lawful order.
• Financial Crime Prevention: In cases involving suspected money laundering or terrorism financing, box138 may be required to report to the Financial Intelligence Unit (UFIU) of Malaysia.
• Business Transfer: In the event of a merger, acquisition, or transfer of box138's assets, user data may be transferred to the new entity. We will notify you of any such changes.

Box138 stores your personal data on secure servers with comprehensive technical and organisational security measures in place:

• Encryption: All stored personal data is protected with AES-256 encryption and all communications use the TLS 1.3 protocol.
• Access Controls: A role-based access control (RBAC) system ensures that only authorised staff can access specific user data.
• 24/7 Monitoring: Our security monitoring system operates around the clock to detect and respond to any threats or suspicious activity.
• Regular Backups: Data is regularly backed up to secure locations to ensure service continuity and recovery in the event of a system failure.

Data retention periods depend on the type of data and applicable legal requirements. Generally, active account data is retained for the duration of your membership plus 7 years after account closure to meet Malaysian legal compliance requirements. Data that is no longer needed will be securely deleted or anonymised.

The box138 platform uses cookies and similar tracking technologies to enhance your experience and keep your account secure. Below are the types of cookies we use:

• Essential Cookies: Required for core box138 platform functions such as login verification, session management, and security. These cookies cannot be disabled.
• Performance Cookies: Collects information on how you use the box138 platform — such as the most frequently visited pages and page load times — to help us improve platform performance.
• Functional Cookies: Saving your preferences such as language, text size, and display settings to provide a more personalised experience on the box138 platform.
• Analytics Cookies: Used to understand overall usage patterns for platform improvement purposes. Data collected is in aggregate form and does not identify you as an individual.

You can manage cookie settings through your web browser. However, disabling essential cookies may affect the functionality and security of the box138 platform. For more information on managing cookies, refer to your web browser's privacy settings.

Under Malaysia's PDPA and box138's privacy policy, you have the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of the personal data we hold about you. Requests will be processed within 21 business days.
• Right to Rectification: If your personal data is inaccurate or out of date, you have the right to request a correction. You may also update certain information directly through your box138 account settings.
• Right to Erasure: You may request the deletion of your personal data, subject to record-keeping requirements mandated under Malaysian law.
• Right to Withdraw Consent: You may withdraw consent for certain data processing activities — such as marketing communications — at any time, without affecting the validity of any processing carried out prior to withdrawal.
• Right to Object: You have the right to object to the processing of your personal data for certain purposes, including direct marketing.
• Right to Data Portability: In certain circumstances, you may request your data in a machine-readable format for transfer to another service provider.

To exercise any of the above rights, please contact the box138 privacy team at support@box138.my by stating the type of request and the identity verification information required. box138 will not charge a fee for reasonable data rights requests.

The box138 platform is strictly for individuals aged 18 and above. box138 does not knowingly collect personal data from anyone under the age of 18.

Should box138 discover that personal data belonging to an underage individual has been collected without our knowledge, we will take the following steps immediately:

• Permanently deleting all relevant personal data from our systems.
• Permanently closing and terminating any associated accounts.
• Reporting the incident to the relevant authorities where required.

Parents or guardians who believe their child has registered on the box138 platform are urged to contact us at support@box138.my immediately so that appropriate action can be taken.

The box138 platform may from time to time contain links to third-party websites or services. This privacy policy applies solely to the box138 platform and does not cover any third-party websites or services.

Box138 is not responsible for the privacy practices of any third-party websites or services. We encourage you to read the privacy policy of every website you visit. The presence of links to third-party websites on the box138 platform does not imply our endorsement or approval of their content or privacy practices.

Box138 reserves the right to update or amend this privacy policy from time to time to reflect changes in our practices, new legal requirements, or technological developments. Any material amendments will be communicated to you via:

• A clear notification on the box138 platform homepage the next time you log in.
• An email will be sent to the address registered on your account at least 14 days before any amendments take effect.
• Updating the "Last Updated" date at the top of this privacy policy page.

Your continued use of the box138 platform after any privacy policy amendment takes effect will be considered acceptance of the revised policy. If you do not agree with the changes, you should stop using the platform and may request to close your account.

If you have any questions, concerns, or complaints regarding box138's privacy policy or how we handle your personal data, please reach out to us through the following channels:

• Privacy Email: support@box138.my – For specific enquiries regarding privacy and data rights requests.
• Live Chat: Available 24/7 on the box138 platform for immediate support.
• Response Time: box138 is committed to responding to all privacy-related enquiries within 3 business days.