IBC138 Privacy Policy – Malaysia Personal Data Protection

01 Personal Information We Collect

IBC138 collects your personal information to enable us to provide a secure, efficient, and personalised service. The type of information collected depends on how you interact with our platform. Below are the main categories of information we collect:

We may also collect information you voluntarily provide through surveys, customer feedback, or promotional contests. All such information is collected on the basis of your consent or applicable legal requirements.

02 How We Use Your Personal Data

IBC138 uses collected personal data solely for legitimate purposes directly related to the provision of our platform services. We do not use your data for any purpose not stated in this Privacy Policy without first obtaining your additional consent.

• Account Management — Create, verify, and manage your member account on the IBC138 platform.
• Transaction Processing — Handles deposits via FPX (Maybank2u, CIMB Clicks, RHB Now), Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and DuitNow, as well as your withdrawal of winnings, all securely.
• Customer Support — Providing accurate and effective responses to your enquiries, complaints, and requests for assistance.
• Platform Security — Detecting and preventing fraud, money laundering, unauthorised access, and other suspicious activity.
• Legal Compliance — Fulfil legal obligations under Malaysia's PDPA 2010 and applicable regulatory requirements.
• Marketing & Promotions — Sending information about bonuses, promotions, and platform updates (subject to your consent to receive such communications).
• Service Improvement — Analysing usage patterns to improve platform quality, the gaming experience, and new features.
• Responsible Gaming — Monitoring betting activity to identify patterns that may indicate problem gambling and providing appropriate support.

Your data will not be used to make automated decisions that significantly affect your rights without human oversight. Where automated processing is required, you will be informed and given the right to request a review by our staff.

03 Information Sharing & Disclosure

IBC138 does not sell, rent, or commercialise your personal information to any third party for their own marketing purposes. However, in the following limited circumstances, we may need to share your information:

• Trusted Service Providers — Payment providers (FPX gateway, Touch 'n Go, GrabPay, and others), gaming software providers, cloud service providers, and analytics companies that assist in operating our platform. All such parties are bound by strict confidentiality agreements.
• Legal Requirements — When required by Malaysian law, court order, or directive from a competent regulatory authority.
• Fraud Prevention — Share information with fraud prevention agencies or law enforcement authorities when required to investigate suspected criminal activity.
• Business Transfer — In the event of a merger, acquisition, or sale of IBC138 assets, your information may be transferred to the new entity. You will be notified in advance of any such changes.

In all instances of data sharing, IBC138 ensures that recipients adhere to data protection standards equivalent to or higher than our own. We never share sensitive information such as passwords, full credit card details, or full MyKad numbers with any third party.

04 Data Security & Technical Protection

IBC138 makes serious investments in security infrastructure to protect your personal data from unauthorised access, loss, misuse, or accidental disclosure. The technical security measures we have in place include:

• 256-bit SSL/TLS Encryption — All data transmitted between your device and IBC138's servers is encrypted using the same industry-grade encryption technology employed by banking institutions.
• Hashed Password Storage — Your password is never stored in plain text. We use strong hashing algorithms to ensure your password cannot be read by anyone, including our own staff.
• Two-Factor Authentication (2FA) — An additional security layer available to all members to protect accounts from unauthorised access.
• 24/7 Monitoring — Our systems are continuously monitored to detect any suspicious activity or intrusion attempts.
• Firewall & DDoS Protection — IBC138 servers are protected by enterprise-grade firewalls and anti-DDoS systems to ensure continuous platform availability.
• Regular Security Audits — We conduct regular penetration testing and security audits by independent experts to ensure our systems remain up to date and fully protected.

While we take all reasonable measures to protect your data, no security system is entirely foolproof. You also play an important role in keeping your account secure — use a strong password, never share your login credentials, and report any suspicious activity to the IBC138 support team promptly.

05 Use of Cookies & Tracking Technologies

IBC138 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. We use the following types of cookies:

• Essential Cookies — Required for core platform functions such as login, session management, and security. These cookies cannot be disabled without affecting platform functionality.
• Performance & Analytics Cookies — Helps us understand how members use the platform, which pages are most visited, and where technical issues occur. This data is collected in aggregate and anonymised form.
• Functional Cookies — Saves your preferences such as language, display settings, and login information for your convenience on future visits.
• Marketing Cookies — Used to display relevant promotions and advertisements based on your interests and browsing behaviour (with your consent only).

You can manage cookie settings through your internet browser. Most browsers allow you to block or delete cookies. Please note, however, that disabling certain cookies may affect your experience and the functionality of the IBC138 platform.

06 Data Storage & Retention

IBC138 retains your personal data for as long as your account is active or as needed to provide services to you. Our data retention periods are as follows:

• Active Account Data — Retained for as long as your account remains active on the IBC138 platform.
• Financial Transaction Records — Retained for a minimum of 7 years in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• Communication Logs — Retained for 3 years for customer support reference and dispute resolution purposes.
• Closed Account Data — Following account closure, core data is retained for 5 years before being securely deleted, unless retention is required for legal purposes.
• Marketing Data — Deleted immediately once you withdraw your consent to receive marketing communications.

When your data is no longer required, IBC138 ensures it is deleted or anonymised in a secure and thorough manner. We use data deletion methods that comply with internationally recognised information security standards.

07 Your Rights Under PDPA

As an IBC138 member in Malaysia, you have certain rights regarding your personal data under the Personal Data Protection Act 2010 (PDPA). We fully respect and support the exercise of these rights:

To exercise any of the rights above, please contact our privacy team by email at support@ibc138.my. We will process your request within 21 business days as required under Malaysia's PDPA.

08 Children's Data Protection

The IBC138 platform is strictly for users aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18. Our Privacy Policy includes specific protections for minors:

• IBC138 uses an age verification process during registration to screen underage users.
• If we discover or suspect that a child's personal data has been collected inadvertently, we will take immediate steps to delete that data and close the account in question.
• Parents or guardians who suspect their children have registered on the IBC138 platform are urged to contact us immediately at support@ibc138.my.

09 Third-Party Links & Services

The IBC138 platform may contain links to third-party services such as payment providers (Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, FPX). Once you click those links and leave the IBC138 platform, our Privacy Policy no longer applies.

We encourage you to read the Privacy Policy of any third-party platform or service you use. IBC138 is not responsible for the privacy practices or content of any third-party websites linked to our platform.

Payment providers working with IBC138 undergo our security and privacy assessment process to ensure they meet equivalent data protection standards. However, once you are on their platform, their own policies apply.

10 Privacy Policy Updates

IBC138 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. All amendments will be published on this page with an updated "Last Updated" date.

For significant amendments involving how we use or protect your data, we will notify you via in-platform notification or email at least 14 days before changes take effect. This gives you sufficient time to review the changes and make an informed decision about your continued use of the IBC138 platform.

11 Contact Our Privacy Team

If you have any questions, concerns, or wish to exercise your rights regarding your personal data, the IBC138 privacy team is here to help:

• Privacy Email: support@ibc138.my — Please state "Data Privacy Enquiry" in your email subject line.
• Live Chat: Available 24/7 directly on the IBC138 platform for immediate assistance.
• Response Time: We are committed to responding to all privacy-related enquiries within 3 business days.
• For formal complaints: Refer IBC138 FAQ page for guidance on how to submit a formal complaint.

You also have the right to lodge a complaint with the Personal Data Protection Department of Malaysia (JPDP) if you believe IBC138 has violated your privacy rights under the PDPA 2010. However, we encourage you to reach out to us first so we can resolve any issues directly and promptly.