Koko138 Privacy Policy – Data Protection for Malaysian Players

When you use the platform koko138, we may collect various categories of personal data depending on how you interact with our services. Below is a summary of the types of data collected:

We do not collect sensitive data such as health information, religious beliefs, or political affiliations unless required by law. All financial data, including credit card numbers, is never stored directly on koko138's servers — it is processed through a PCI-DSS certified payment gateway.

Your personal data is collected through various means as you interact with the platform koko138:

• Account Registration: Information you provide during the registration process, including your name, email address, and phone number.
• Identity Verification (KYC): Identity documents such as MyKad and bank statements uploaded for verification purposes.
• Financial Transactions: Information collected during the deposit and withdrawal process via Touch 'n Go eWallet, GrabPay, DuitNow, FPX through Maybank2u or CIMB Clicks, Boost, and ShopeePay.
• Platform Usage: Activity data automatically generated when you play, browse or interact with any part of the koko138 platform.
• Support Communications: Records of conversations with the customer support team via live chat, email or WhatsApp.
• Cookies and Similar Technologies: Information collected automatically through browser cookies, tracking pixels, and similar technologies when you visit the platform.

We do not purchase personal data from third-party sources for marketing purposes without your consent.

koko138 to use your personal data only for lawful and transparent purposes. The following are the primary purposes for which your data is used:

• Account Management: To create, verify, maintain and protect your koko138 account.
• Transaction Processing: To securely process deposits and withdrawals through your chosen Malaysian payment method.
• Service Delivery: To enable you to access and enjoy all games and features available on the koko138 platform.
• Fraud Prevention & Security: To identify, investigate, and prevent fraudulent activity, money laundering, or security breaches.
• Legal Compliance: To fulfil legal and regulatory obligations in Malaysia, including requirements under PDPA 2010 and AMLA (Anti-Money Laundering Act).
• Customer Support: To handle complaints, respond to enquiries, and resolve issues related to your account.
• Platform Improvements: To analyse aggregated usage patterns for the purpose of improving user experience — this analysis does not identify individuals personally.
• Marketing Communications: To send promotional information, bonuses, and special offers — only if you have consented to receive such communications. You may unsubscribe at any time.

Koko138 will not use your data for any purpose other than those stated above without obtaining your consent beforehand.

koko138 upholds a clear principle: your data is never sold to anyone. However, there are limited circumstances where we may need to share your data with carefully selected third parties:

• Payment Providers: The payment gateways we use to process transactions — such as Touch 'n Go, GrabPay, DuitNow and FPX providers — receive only the data necessary to complete each transaction. All such providers are PCI-DSS certified and maintain their own privacy policies.
• Game Software Providers: Third-party game providers may receive the session data required to deliver your gaming experience. They do not receive your financial details or full identity data.
• Technology Service Providers: Companies that assist us in operating our technical infrastructure, such as cloud services, CDN and analytics tools — subject to strict confidentiality agreements.
• Legal Authority: Malaysian law enforcement agencies, courts, or regulatory authorities when we are legally required to do so — including investigations into money laundering or fraud.
• Risk Management & KYC: Third-party identity verification service providers used for the KYC process. Only the minimum data necessary for verification purposes is shared.

In all of the above cases, we ensure that third parties receiving your data are bound by appropriate data protection agreements and maintain security standards comparable to those of koko138.

koko138 implements multiple layers of security controls to protect your personal data from unauthorised access, loss, or accidental disclosure:

• Encryption in Transit: All communications between your device and koko138's servers are encrypted using TLS 1.3 protocol with a 256-bit SSL certificate.
• Encryption at Rest: Sensitive data stored in our database is encrypted using AES-256 — an internationally recognised encryption standard.
• Strict Access Controls: Only specifically authorised staff may access player data, and every access is logged for audit purposes.
• Two-Factor Authentication (2FA): Available to all player accounts as an additional layer of protection. We encourage all players to enable this feature.
• Periodic Vulnerability Scanning: koko138's systems undergo regular penetration testing and vulnerability scanning by independent security experts.
• 24/7 Monitoring: Automated monitoring systems operate around the clock to detect any suspicious activity or intrusion attempts.
• Data Backup: Data backups are performed regularly and stored at separate locations to ensure service continuity.

While we take every reasonable measure to protect your data, no system is 100% breach-proof. You also play an important role in keeping your account secure — always use a strong password and never share your login credentials with anyone.

Platform koko138 uses cookies and similar tracking technologies to enhance your browsing experience. The types of cookies we use are as follows:

• Essential Cookies (Required): Required for core platform functionality — including login, session verification and security. These cookies cannot be disabled as the platform will not function without them.
• Performance Cookies: Collects information about how you use the platform — pages visited, time spent on each page — to help us improve the user experience. This data is collected in aggregate and does not identify you personally.
• Functional Cookies: Saving your preferences such as language settings, preferred payment methods, and display options for a more convenient experience.
• Marketing Cookies: Used to display relevant promotions based on your interests. These cookies are only activated with your consent.

You can manage your cookie settings through your web browser. Please note that disabling certain cookies may affect the functionality of some areas of the koko138 platform. We do not use cookies to track your activity outside of the koko138 platform.

koko138 retains your personal data for as long as your account remains active, and for any additional period required by law or legitimate business needs:

• Active Account Data: Retained for as long as your account remains active on the koko138 platform.
• Financial Transaction Data: Retained for 7 years after the transaction date, in accordance with the Malaysian Companies Act and applicable financial regulations.
• KYC (Identity Verification) Data: Retained for 5 years after account termination in accordance with Malaysia's AMLA requirements.
• Communication Logs (Customer Support): Retained for 2 years for reference and dispute resolution purposes.
• Technical Data & System Logs: Retained for 90 days for security and fraud detection purposes.

Once the applicable retention period has expired, data will be securely deleted or anonymised so that it can no longer identify you personally. If you request account closure, we will delete or anonymise your data within a reasonable timeframe, unless we are legally required to retain it.

As a data subject under the Malaysia Personal Data Protection Act 2010, you have the following rights regarding the personal data held by koko138:

Platform koko138 is intended for individuals aged 18 years and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we determine that personal data has been collected from an individual under the age of 18 without proper age verification, we will immediately delete that data and close the account in question without notice.

If you are a parent or guardian and discover that your minor child has registered an account on koko138, please contact us immediately at support@koko138.best so that we may take the appropriate action.

Platform koko138 may contain links to third-party websites or services in certain contexts, such as game providers or payment gateways. This Privacy Policy applies solely to the koko138 platform.

We are not responsible for the privacy practices or content of any third-party platforms. We encourage you to read the privacy policies of other platforms before providing them with any personal information. koko138 has no control over how third parties collect, store, or use your data outside of the koko138 platform.

koko138 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, updates to Malaysian law, or other operational reasons. When significant changes are made:

• A notice will be displayed on the platform's main page and on this page for at least 14 days before the changes take effect.
• Players may receive notifications via their registered email address for changes that significantly affect their privacy rights.
• The "Updated" date at the top of this page will be revised to reflect the latest version.

Continued use of the platform koko138 after the changes take effect constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, please contact us to discuss your options, including account closure.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer:

• Email: support@koko138.best (please include "Privacy Inquiry" in the email subject line)
• Live Chat: Available 24/7 within the platform — select "Privacy & Data" under the help category
• WhatsApp: Number available on the platform after login

All privacy-related enquiries will be acknowledged within 48 hours and resolved within 14 working days in accordance with the requirements of PDPA 2010.

If you are not satisfied with our response, you have the right to file a complaint with Department of Personal Data Protection Malaysia which is the regulatory body responsible for enforcing the PDPA 2010 in Malaysia.