k138 is committed to protecting the personal data of every player on our platform. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have over your own data.
All data transmitted between your device and k138 is protected using TLS/SSL encryption. Your account credentials, personal details, and transaction data are secured end-to-end at all times.
Player data is stored in access-controlled, encrypted databases with strict internal access policies. Only authorised personnel with a legitimate operational need are permitted to access your personal information.
k138 does not sell, rent, or trade your personal data to third-party marketing companies. Data shared with service partners is strictly limited to what is necessary for the provision of our platform services.
You have the right to access, correct, and request deletion of your personal data held by k138. Requests are processed within a reasonable timeframe and handled with full confidentiality.
We use cookies solely to improve your experience on k138 — session management, preference saving, and analytics. We do not use cookies to build advertising profiles or track you across unrelated websites.
Some data processing is required by our international licensing obligations, including anti-money laundering (AML) checks and Know Your Customer (KYC) verification. This protects all players on the platform.
This Privacy Policy ("Policy") describes how k138 ("k138", "we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("Player", "User", "you") who access or use the k138 online gaming platform available at https://k138.cam and all associated services.
k138 takes its data protection responsibilities seriously. We are committed to handling your personal information with integrity, transparency, and appropriate security measures. This Policy has been drafted to be clear and accessible — not buried in impenetrable legal language — because we believe you have the right to understand exactly how your data is handled.
This Policy applies to all personal data collected through the k138 website, mobile platform, customer support interactions, and any registration or verification processes. It should be read alongside our Terms & Conditions and Responsible Gambling Policy.
Note for Malaysian players: While Malaysia's Personal Data Protection Act 2010 (PDPA) establishes a domestic framework for data protection, k138 operates under international licensing and processes data in accordance with its licensing jurisdiction's applicable data protection standards. We nonetheless apply robust data protection principles consistent with widely recognised international best practice.
For the purposes of this Policy, the following terms carry the meanings set out below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or could reasonably identify a living individual, directly or in combination with other data. |
| "Processing" | Any operation performed on personal data — including collection, storage, use, disclosure, transfer, or deletion. |
| "Data Controller" | k138, as the entity that determines the purposes and means of processing player personal data. |
| "Data Processor" | Third-party service providers who process personal data on k138's behalf under contractual obligations. |
| "KYC Data" | Identity and address verification documents collected as part of the Know Your Customer process. |
| "Sensitive Data" | Categories of personal data warranting heightened protection — including financial data, identity documents, and transaction records. |
| "Cookie" | A small text file stored on your device by the k138 website to maintain session state, preferences, and anonymous usage analytics. |
k138 collects the following categories of personal data from players, depending on the stage of their interaction with the platform:
k138 collects personal data through the following channels:
k138 processes your personal data on the following legal grounds:
| Legal Basis | Application |
|---|---|
| Contractual Necessity | Processing required to open and manage your account, process deposits and withdrawals, and deliver gaming services as described in the Terms & Conditions you agreed to. |
| Legal Obligation | KYC verification, AML monitoring, age verification (21+), and record-keeping obligations imposed by k138's international gaming licence. |
| Legitimate Interests | Fraud prevention, platform security, responsible gambling monitoring, and internal analytics to improve service quality — balanced against player rights and interests. |
| Consent | Sending optional marketing communications, promotional emails, or push notifications. Consent is sought separately and may be withdrawn at any time by contacting support. |
k138 uses personal data collected from players for the following purposes:
Responsible gambling monitoring: k138 processes gaming activity data as part of its responsible gambling obligations. Unusual patterns — such as rapidly escalating stake sizes, prolonged uninterupted sessions, or repeated deposit attempts after withdrawal — may trigger an outreach from our responsible gambling team. This processing is conducted in your interest and is required by our licensing obligations.
k138 does not sell your personal data. We share data only in the limited circumstances described below, and only to the extent necessary for each specific purpose:
Transaction data (including your name, account reference, and transaction amount) is shared with payment processors to facilitate deposits and withdrawals. This includes DuitNow and FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency processing partners. These providers are contractually bound to process data solely for payment purposes.
KYC documentation and identity data may be shared with third-party identity verification agencies and AML screening services engaged to fulfil k138's compliance obligations. These providers operate under strict data processing agreements and are prohibited from using your data for any purpose beyond the service they provide to k138.
For the purpose of game delivery and dispute resolution, limited session and account data may be shared with the third-party game studios whose content is available on k138. This data sharing is governed by contractual data processing agreements with each studio.
k138 may disclose personal data to regulatory bodies, law enforcement agencies, or courts where required by applicable law, a valid legal order, or our international licensing authority. We will inform affected players of such disclosures where legally permitted to do so.
In the event of a merger, acquisition, restructuring, or sale of k138's assets, player personal data may be transferred to the acquiring entity. Players will be notified of any such transfer and of any material change to this Privacy Policy resulting from the transaction.
k138 does not share your personal data with advertising networks, data brokers, or social media platforms for targeting or profiling purposes.
k138 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account registration data | Duration of account, plus 5 years after account closure |
| KYC verification documents | Minimum 5 years from date of submission, as required by AML obligations |
| Transaction records | Minimum 5 years from transaction date |
| Gaming activity logs | 3 years from last activity date |
| Support correspondence | 2 years from last interaction |
| Marketing consent records | Until consent is withdrawn, plus 1 year thereafter |
| Technical / server logs | 90 days on a rolling basis unless required for ongoing investigation |
After the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification. Retention periods may be extended where data is subject to a legal hold, ongoing investigation, or active dispute.
k138 implements a multi-layered security framework to protect player personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:
In the event of a data breach that poses a risk to player rights and interests, k138 will notify affected players within a reasonable timeframe through the email address registered to their account, and will take immediate steps to contain and remediate the breach.
k138 uses cookies and similar technologies on its website and mobile platform. Cookies are small data files stored locally on your device by your browser. They enable us to recognise your session, remember your preferences, and understand how players navigate the platform.
| Cookie Type | Purpose |
|---|---|
| Essential cookies | Required for core platform functionality — login session management, security tokens, and account state. Cannot be disabled without breaking core features. |
| Preference cookies | Store your language, currency display (MYR/RM), and interface settings so you do not need to reconfigure them each visit. |
| Analytics cookies | Collect anonymised data about how players navigate the platform — pages visited, session duration, game category preferences — to improve service quality. |
| Security cookies | Support fraud detection and bot prevention systems by tracking request patterns and flaging anomalous behaviour within the session. |
Most web browsers allow you to manage cookie settings through the browser's settings menu. You may choose to block or delete cookies at any time. Note that disabling essential cookies will impair your ability to log in and use core platform features. Disabling analytics cookies will not affect your gaming experience but will limit our ability to identify and resolve platform issues.
You have the following rights with respect to your personal data held by k138. To exercise any of these rights, contact us via live chat or by emailing [email protected]. We will acknowledge requests within two (2) business days and aim to fulfil them within thirty (30) days.
Request a copy of all personal data k138 holds about you, including the categories of data, processing purposes, and recipients.
Request correction of any inaccurate or incomplete personal data. For example, if your address or phone number has changed, we will update our records.
Request deletion of your personal data where it is no longer needed for its original purpose. Note that we are required to retain certain data for AML and licensing compliance, even after account closure.
Request that we limit how we use your data — for example, while a dispute or correction request is being resolved — without requiring full deletion of the data.
Request your data in a structured, machine-readable format (e.g., JSON or CSV) for transfer to another service provider where technically feasible.
Withdraw consent for marketing communications at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.
k138 strictly prohibits access by persons under the age of 21. We do not knowingly collect personal data from individuals below this age threshold. Age verification is a mandatory step in the account registration and KYC process.
If k138 discovers or has reasonable grounds to believe that personal data has been collected from a person under the age of 21, that account will be suspended immediately, all associated data will be reviewed, and any real-money balances held will be managed in accordance with applicable compliance procedures. If you believe a minor has registered on the platform, please contact us immediately via live chat or at [email protected].
Parents and guardians in Malaysia concerned about underage access to gambling platforms are encouraged to use device-level parental controls and to speak openly with young people about the risks and legal restrictions associated with gambling. For additional guidance, the Ministry of Health Malaysia and relevant social welfare organisations provide resources on protecting young people from gambling harm.
As an internationally licensed platform, k138 may transfer personal data across international borders — for example, to game studios, payment processors, or cloud infrastructure providers located outside Malaysia. Such transfers are conducted under appropriate safeguards, including contractual data processing agreements, to ensure that your personal data receives a consistent standard of protection regardless of where it is processed.
k138 does not transfer personal data to jurisdictions that lack adequate data protection frameworks without first putting in place contractual protections consistent with recognised international standards.
k138 reserves the right to update this Privacy Policy periodically to reflect changes in our data processing practices, applicable legal requirements, or operational changes to the platform. Where changes are material — meaning they significantly affect how your personal data is used or your rights regarding that data — we will notify registered players by email at least seven (7) days before the changes take effect.
Minor or clarificatory amendments may be made without advance notice. The effective date of the current version of this Policy is always displayed at the top of this page. We encourage you to review this Policy periodically.
Your continued use of the k138 platform following the effective date of any updated Policy constitutes your acknowledgement of the revised terms.
For any questions, concerns, or requests relating to this Privacy Policy or the personal data k138 holds about you, please reach out through the following channels:
Available 24/7 including Malaysian public holidays. For data access, correction, or deletion requests, please state the nature of your request clearly when connecting.
Privacy and data requests: [email protected]
(plain text — not a clickable link)
Include "Privacy Request" in the subject line.
Your privacy matters to us. Explore k138's live casino, sports betting, and slots knowing your personal data is handled with care, transparency, and robust security. For players aged 21 and above only.
For players aged 21 and above only. This Policy was last updated 1 January 2026.