Privacy Policy top138 — Protecting Your Personal Data

01 Privacy Policy Introduction & Scope

This Privacy Policy ("Policy") is published by top138 ("Company", "we") and applies to all users accessing the top138.win website, the top138 mobile app, and all related digital services ("Platform").

We understand that your trust is our most valuable asset. When you register as a top138 member, you entrust us with sensitive personal information. We take this responsibility very seriously and are committed to ensuring every piece of your data is handled in a manner that fully respects your privacy.

This Policy complies with internationally adopted data protection principles and should be read together with Terms and Conditions top138. By using our Platform, you confirm your acceptance of the practices described in this Policy.

02 Categories of Personal Data We Collect

Top138 collects various types of personal data depending on how you interact with our Platform. The following is a detailed explanation of each category of data collected:

We never collect data irrelevant to the purposes of our service. Sensitive data such as medical information or political views is not collected under any circumstances.

03 How We Use Your Personal Data

Every use of your personal data on the top138 platform has a clear and legitimate purpose. We will not use your data for any purpose other than those stated below without first obtaining your additional consent:

• Identity Verification (KYC): Verifying your identity during registration and throughout the withdrawal process to ensure account security and prevent fraud.
• Financial Transaction Processing: Securely and accurately processing deposits, withdrawals, and all related transactions you carry out on the Platform.
• Service Provision: Managing your account, granting access to games, and ensuring the Platform functions smoothly at all times.
• Service Communications: Sending account-related notices, security updates, terms changes, and responses to your customer support enquiries.
• Marketing Communications: Sending promotional information, bonus offers, and the latest Platform news — only if you have opted in to receive such communications.
• Fraud Prevention & Security: Identifying, investigating, and preventing any fraudulent activity, money laundering, or unlawful behaviour on the Platform.
• Responsible Gaming: Monitoring gameplay patterns to identify signs of problem gambling and provide appropriate assistance when needed.
• Legal Compliance: Fulfilling the reporting and compliance obligations required by the relevant regulatory authorities.

04 Legal Basis for Data Processing

Top138 processes your personal data on one or more valid legal bases for each processing purpose. Transparency in this matter is our priority:

• Contract Performance: Processing required to deliver the services you have requested, including transaction processing and account management, is carried out on the basis of the contract between you and top138.
• Legal Obligation: Some processing, particularly relating to KYC and anti-money laundering reporting, is mandatory under applicable law.
• Legitimate Interest: Processing for security purposes, fraud prevention, and service improvement is carried out on the basis of the company's legitimate interests, which do not override your privacy rights.
• Consent: For marketing communications and non-essential cookies, we request your explicit consent and you have the right to withdraw that consent at any time.

05 Data Sharing & Disclosure to Third Parties

Top138 does not sell, rent, or transfer your personal data to third parties for their own marketing purposes. However, there are limited situations where we need to share your data with certain parties to enable the Platform to function properly:

• Payment Providers: Required transaction information is shared with payment gateway providers, banks, and eWallet operators to process your deposits and withdrawals.
• Game Software Providers: Required game session data is shared with our licensed game providers to enable gameplay and verify results.
• KYC Verification Providers: Your identity documents are submitted to approved identity verification providers for verification purposes only.
• Legal Authority: We may be required to disclose certain data to law enforcement authorities or regulatory bodies when mandated by law.
• Approved Business Partners: In very limited circumstances, aggregated (non-individual) data may be shared with business partners who have signed strict confidentiality agreements.

06 Data Security & Technical Protection Measures

We continuously invest in high-grade data security infrastructure to ensure your information remains protected against increasingly sophisticated threats in today's cyber landscape.

• Data Encryption in Transit: All communications between your device and top138 servers are protected with 256-bit SSL/TLS encryption, ensuring your data cannot be intercepted in transit.
• Data Encryption at Rest: Sensitive data such as financial information and identity documents is encrypted using AES-256 encryption algorithms while stored in our database.
• Layered Access Control: Access to members' personal data is restricted to staff who genuinely require it to perform their duties, with two-factor authentication mandatory for all personnel.
• 24/7 Security Monitoring: Our automated monitoring system detects suspicious activity and security threats in real time, with immediate response from our cybersecurity team.
• Regular Penetration Testing: Our infrastructure undergoes regular security testing by independent security experts to identify and address any vulnerabilities before they can be exploited.
• Secure Data Centres: Data is stored in data centres meeting international physical security standards with biometric access controls and continuous monitoring.

While no security system can guarantee absolute protection, top138 takes all reasonable steps and follows industry best practices to minimise the risk of a data breach.

07 Data Retention Period

Top138 does not retain your personal data longer than necessary for the stated purposes or as required by law. The following are our data retention guidelines:

• Active Account Data: Retained for the duration of your active account plus any additional period required to resolve disputes or fulfil related legal obligations.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date in line with financial compliance and anti-money laundering requirements.
• KYC Documents: Retained for the duration of the active account period and at least 5 years after account closure for audit and compliance purposes.
• System & Security Logs: Retained for 12 months for security analysis and threat detection purposes.
• Support Communication Records: Retained for 3 years to ensure service continuity and dispute resolution.

When data is no longer needed and there is no legal obligation to retain it, we will securely delete or anonymise it using methods that ensure it cannot be recovered.

08 Cookie & Tracking Technology Policy

Top138 uses cookies and similar tracking technologies to enhance your experience on the Platform, ensure security functions operate correctly, and understand how our Platform is used. The following are the types of cookies we use:

Essential cookies cannot be disabled as they are required for the Platform's core security functions. For optional cookies, you can manage your cookie settings through your account dashboard or your web browser settings. Please note that disabling certain cookies may affect your user experience.

09 Your Rights Regarding Personal Data

As a top138 member, you have clear and enforceable rights over your personal data. We are committed to making it easy for you to exercise these rights without unnecessary barriers:

To exercise any of the above rights, contact our Privacy Officer via Live Chat or email at [email protected]. We will process your request within 30 business days and may require identity verification before taking any action.

10 International Data Transfers

In the course of its operations, top138 may transfer your personal data to parties operating outside Malaysia, including licensed technical service providers and business partners.

Every cross-border data transfer is handled with the utmost care. We ensure that all such transfers are safeguarded through appropriate protection mechanisms, including binding data processing agreements, approved standard contractual clauses, or by confirming that the recipient country provides an adequate level of data protection.

11 Child Protection

Top138 is a platform dedicated to users aged 18 and above. We do not knowingly collect or process personal data of individuals under the age of 18.

If we determine that personal data of a minor has been collected without the knowledge or consent of a parent or legal guardian, we will immediately delete that data and close the relevant account. We encourage parents and guardians to actively monitor their children's online activities.

If you believe a minor has registered an account on our Platform, please contact us immediately at [email protected] so that immediate action can be taken.

12 Contact Our Privacy Officer

Top138 appoints a dedicated Data Privacy Officer (DPO) to ensure compliance with privacy policies and to handle any personal data enquiries or complaints promptly and professionally.

You may contact our Privacy Officer via:

• Live Chat: Available 24 hours a day, 7 days a week via the chat icon in the corner of the Platform.
• Privacy Email: [email protected] — for specific enquiries relating to your personal data and privacy rights.
• General Support Email: [email protected] — for general support including privacy-related issues.

We are committed to responding to all privacy enquiries within 5 business days, and to resolving more complex requests within 30 business days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your country.