Privacy Policy

nos138 ("the Company", "we", "us", "our") operates the online gaming platform accessible at https://nos138.click ("the Platform"). This Privacy Policy ("Policy") sets out the basis upon which nos138 collects, processes, stores, transfers, and protects the personal data of users ("you", "your", "the User") who access or register on the Platform.

This Policy applies to all registered players, visitors to the nos138 website, and any individual who communicates with nos138 via our customer support channels — including live chat, email, or any other medium.

This Privacy Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, all of which together govern your relationship with nos138.

For the purposes of this Privacy Policy, the following definitions apply:

nos138 collects only the personal data necessary to operate your Account, process your transactions, fulfil our legal and regulatory obligations, and deliver a safe, high-quality gaming experience. The categories of personal data we collect are described below.

nos138 collects personal data through the following channels and means:

• Account Registration: When you create an Account on the nos138 Platform, you provide identity and contact data directly.
• KYC Verification: When you submit identity documents in response to a verification request from nos138 or as part of the withdrawal process.
• Deposits & Withdrawals: Transaction data is generated and recorded whenever you initiate a deposit or withdrawal via an approved payment method — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, or USDT TRC20.
• Platform Usage: Automatically collected as you navigate the Platform, place bets, and interact with games — via server logs, session tracking, and analytics tools.
• Customer Support Interactions: Any information you voluntarily share when contacting our support team via live chat, email, or other communication channels.
• Cookies & Similar Technologies: Information collected via cookies and similar tracking technologies placed on your device when you visit the Platform (see Section 8 for full details).
• Third-Party Verification Services: In limited cases, nos138 may receive identity verification data from licensed KYC service providers engaged to confirm the accuracy of documents you have submitted.

nos138 processes your personal data only for the specific purposes listed below. We do not process data for any purpose that is incompatible with the original purpose of collection without first obtaining your explicit consent.

• Account Management: Creating, maintaining, and securing your registered Account on the nos138 Platform.
• Identity & Age Verification: Confirming that you meet the minimum age requirement (21+) and verifying your identity in compliance with our KYC obligations.
• Transaction Processing: Facilitating MYR deposits and withdrawals via your chosen payment method, including reconciliation and dispute resolution.
• Regulatory Compliance: Meeting our obligations under applicable anti-money laundering (AML) laws, counter-terrorist financing (CTF) regulations, and other legal requirements.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, account takeover, money laundering, and other forms of abuse on the Platform.
• Responsible Gambling: Monitoring gameplay patterns to identify potential problem gambling behaviour and enabling our responsible gambling tools (deposit limits, self-exclusion).
• Customer Support: Responding to your enquiries, resolving disputes, and providing service-related communications.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, reliability, and user experience of the nos138 Platform.
• Marketing Communications: Where you have opted in, sending you promotional offers, bonus notifications, and product updates relevant to your gameplay preferences. You may withdraw this consent at any time.

nos138 processes your personal data on one or more of the following legal bases:

nos138 does not sell, rent, or trade your personal data to any third party. Personal data may be shared with carefully selected third-party service providers only to the extent necessary for them to perform specific functions on nos138's behalf, and always subject to contractual data protection obligations.

Categories of third parties with whom nos138 may share limited personal data include:

• Payment Processors: Licensed payment gateway and e-wallet operators (including Touch 'n Go, Boost, GrabPay, DuitNow, and FPX providers) that process your deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Licensed identity verification service providers that assist nos138 in validating MyKad and other identity documents submitted during the KYC process.
• IT Infrastructure & Cloud Providers: Technology service providers that host, maintain, and support the nos138 Platform infrastructure. All such providers are bound by strict data processing agreements.
• Fraud Detection & AML Screening: Specialist providers that assist nos138 in monitoring for fraudulent activity, money laundering, and other prohibited conduct.
• Regulatory Authorities: Where required by law, regulation, or court order, nos138 may disclose personal data to relevant government bodies or law enforcement authorities in Malaysia or other applicable jurisdictions.
• Dispute Resolution Bodies: Where a formal complaint or dispute is escalated to an independent resolution body, limited relevant data may be shared to facilitate resolution.

In all cases, nos138 requires third-party processors to maintain confidentiality, apply appropriate security measures, and process your data only in accordance with the instructions and purposes specified by nos138.

The nos138 Platform uses cookies and similar tracking technologies to enhance functionality, maintain session state, and collect anonymised usage analytics. Cookies do not enable nos138 to identify you personally unless you are logged in to your Account.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of the nos138 Platform. nos138 does not use third-party advertising cookies or cross-site tracking technologies for commercial advertising purposes.

nos138 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. The following general retention periods apply:

• Account Data & Transaction Records: Retained for a minimum of five (5) years following account closure, in accordance with AML and financial record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or from the date of the last transaction, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the relevant interaction, unless required for an ongoing dispute.
• Technical Logs & Session Data: Typically retained for 90 days unless required for a security investigation or fraud review.
• Marketing Preferences: Retained until consent is withdrawn or the Account is closed.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with nos138's data disposal procedures. Where anonymisation is not practicable, data is destroyed using industry-standard secure deletion methods.

nos138 takes the security of your personal data seriously and implements a layered set of technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction.

• SSL/TLS Encryption: All data transmitted between your device and the nos138 Platform is encrypted using SSL/TLS protocols, ensuring that information cannot be intercepted in transit.
• Encryption at Rest: Sensitive data stored on nos138's servers — including KYC documents and financial information — is encrypted using AES-256 or equivalent standards.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. nos138 personnel who access personal data are subject to confidentiality obligations and receive regular data protection training.
• Two-Factor Authentication (2FA): Available to all Account holders and strongly recommended to protect against unauthorised account access.
• Intrusion Detection: nos138's infrastructure is monitored continuously for anomalous activity, potential intrusions, and security vulnerabilities.
• Third-Party Security Audits: nos138 engages independent security specialists to conduct periodic penetration testing and vulnerability assessments of the Platform.

While nos138 applies robust security measures, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for notifying nos138 immediately if you suspect any unauthorised use of your Account.

As a registered player and data subject, you hold a number of rights over the personal data nos138 holds about you. nos138 is committed to honouring these rights promptly and without unnecessary barriers.

The nos138 Platform is strictly intended for individuals aged 21 years and above. nos138 does not knowingly collect personal data from any person below the age of 21.

If nos138 becomes aware that personal data has been collected from a person below the minimum age — whether through account registration, KYC submission, or any other means — nos138 will immediately close the relevant Account, forfeit all associated funds, and delete the collected personal data in accordance with our data disposal procedures.

nos138 employs age verification procedures at the point of registration and during the KYC process. If you have reason to believe that a minor has used or is using the nos138 Platform, please contact our support team immediately so that appropriate action can be taken.

nos138 reviews this Privacy Policy on a regular basis and may update it to reflect changes in our data practices, applicable law, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

Where changes are material — such as the introduction of a new category of data collection, a change to our data sharing practices, or an amendment to your rights — nos138 will notify registered Account holders via the email address associated with their Account prior to the changes taking effect.

Your continued use of the nos138 Platform following publication of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with any revision, you should stop using the Platform and may request account closure by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or nos138's handling of your personal data, please contact our Data Protection team through any of the following channels. All privacy-related enquiries will be handled with confidentiality and responded to within the timeframes specified in this Policy.

When submitting a data rights request, please include your registered Account username and a clear description of your request. Identity verification may be required before any personal data is disclosed or actioned, to ensure that your information is protected from unauthorised access.