Privacy Policy IPO138 – Personal Data Protection for Malaysian Players

01 Introduction

IPO138 is fully committed to protecting the privacy and personal data security of every player who uses our platform in ipo138.fun. This Privacy Policy explains in detail how we collect, store, use, and protect your information.

This document applies to all users of the ipo138 platform, including website visitors, registered members, and any individuals who interact with our services through our website, mobile app, or any of our official communication channels.

By registering an account with ipo138 or continuing to use our services, you confirm that you have read and understood this Privacy Policy, and that you consent to us processing your personal data as described herein.

02 Information We Collect

IPO138 only collects information that is strictly necessary to provide our players with a safe, fair, and high-quality service. The categories of data we collect are as follows:

Personal Identity Information

• Full name as per official identification document
• Date of birth and gender
• IC or passport number
• Full current residential address
• Nationality and country of residence

Contact Information

• Active email address
• Valid mobile phone number

Financial Information

• Bank account or e-wallet details used for deposits and withdrawals
• Transaction history including deposits, withdrawals, and wagering activity
• Wins and losses records

Technical & Usage Data

• IP address and estimated geographic location information
• Device type, operating system, and browser version
• Access logs and gaming session activity
• Cookie and website usage data

03 How We Use Your Data

Every piece of information we collect has a clear and legitimate purpose. ipo138 will not use your data for any purpose not stated in this Privacy Policy without first obtaining your additional consent.

We use your personal information for the following purposes:

• Identity verification and KYC — to verify your age eligibility and compliance with anti-money laundering (AML) requirements.
• Account management — to create, maintain, and protect your player account with high-level encryption.
• Financial transaction processing — to handle deposits, withdrawals, and bonus calculations accurately and securely.
• Service communications — to send transaction notifications, important account updates, and customer support responses.
• Security and fraud prevention — to detect and prevent suspicious activity, multi-account usage, and fraud attempts.
• Legal compliance — to fulfil reporting obligations to the relevant licensing authorities and regulatory bodies.
• Service improvement — to analyse aggregated usage patterns in order to improve the gaming experience and platform capabilities.
• Responsible gaming — to identify playing patterns that may indicate risk and offer appropriate self-management tools.

04 Information Sharing

Ipo138 maintains a strict confidentiality policy. We only share your personal information in limited circumstances and with parties that have signed legally binding confidentiality agreements.

Parties that may receive your information include:

• Payment service provider — payment gateways and banking institutions to process legitimate financial transactions.
• Identity verification provider — certified third-party KYC services to verify identity documents.
• Regulatory authority — licensing bodies and statutory authorities where required by law.
• Gaming software providers — gaming software providers that require minimum session data to operate games properly.
• Internal security team — our fraud prevention and compliance unit for legitimate investigation purposes.

All third parties involved in processing your data are required to adhere to data protection standards equivalent to or higher than those we practise at ipo138. Cross-border information sharing is only conducted with adequate safeguards, including internationally recognised standard contractual clauses.

05 Data Security

We invest heavily in security infrastructure to ensure your data is always protected. ipo138 employs multiple layers of technical security and strict operational procedures to prevent unauthorized access, data breaches, and cyber threats.

• 256-bit SSL/TLS encryption secures all communications between your device and our servers in real time.
• Data encryption at rest ensures all data stored in our databases remains unreadable even in the event of unauthorised access.
• Two-factor authentication (2FA) available and recommended for all player accounts.
• 24/7 Monitoring by our cybersecurity team to detect and respond to any suspicious activity.
• Limited data imaging — only authorised personnel may access player personal data, and such access is logged and audited regularly.
• Penetration testing (penetration testing) is conducted periodically by independent security experts to identify and patch any system vulnerabilities.

06 Cookies & Tracking Technologies

Ipo138 uses cookies and similar tracking technologies to enhance user experience, ensure account security, and analyze our platform's performance.

Types of Cookies We Use

• Essential Cookies: Required for core platform functions such as login authentication and session management. These cookies cannot be disabled.
• Performance Cookies: Collecting aggregated, anonymous data about how you use our website to help us improve our services.
• Functional Cookies: Remembering your preferences such as language, display settings, and game preferences for a more personalized experience.
• Security Cookies: Detecting and preventing fraudulent activity and protecting the integrity of your session.

You can manage your cookie settings through your web browser at any time. However, disabling certain cookies may affect the functionality and security of the platform. Third-party cookies are only used from verified providers who have signed a data processing agreement with IPO138.

07 Your Rights Over Your Personal Data

Ipo138 respects and protects your rights over your personal data. You have the following rights, which you may exercise at any time by contacting our team:

To submit any request relating to the above rights, please contact our Data Protection Officer via email at [email protected]. We will process your request within 30 calendar days.

08 Data Retention Period

Ipo138 does not retain your personal data longer than necessary for the stated purposes or as required by law. Our data minimization principle ensures that data no longer needed is securely deleted or anonymized.

Upon expiry of the designated retention period, data will be permanently deleted or anonymised using approved procedures so that it can no longer be linked to any individual.

09 International Data Transfers

As an online platform operating globally, ipo138 may transfer and process your personal data outside Malaysia. Any such data transfer is carried out with adequate safeguards and in compliance with applicable data protection laws.

The safeguards we use for international data transfers include:

• Internationally recognized Standard Contractual Clauses with all third-party data processors.
• Assessment of adequate data protection standards in the recipient country before any transfer is permitted.
• Legally binding data processing agreements with all parties involved.
• Data encryption in transit to ensure confidentiality even while data is being transferred.

10 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, please contact us through the following channels:

• Privacy Email: [email protected]
• 24/7 Customer Support: [email protected]
• Response Time: Within 3 business days for general inquiries; 30 days for formal data rights requests.

You may also lodge a complaint with the relevant data protection authority in your country of residence if you believe we have failed to address your concerns satisfactorily.