Purpose Limitation
mitra138 collects personal data only for clearly stated purposes. Data gathered for identity verification is not repurposed for unrelated marketing activities without your explicit consent.
Data Protection · Transparency · User Rights
Privacy Policy
This Privacy Policy explains how mitra138 collects, uses, stores and protects the personal information of users who access our platform. We are committed to transparent data practices that respect the privacy of every Malaysian adult who uses mitra138.
Our Data Principles
How mitra138 Approaches Your Privacy
These six principles underpin every data decision made within the mitra138 platform. Full clause-level detail follows in the policy document below.
Data Minimisation
We request only the information necessary to operate your account, complete KYC verification and process MYR transactions through supported Malaysian payment channels.
Security by Design
Technical and organisational measures protect your data from unauthorised access, disclosure and accidental loss. Security practices are reviewed on an ongoing basis.
Retention Limits
Personal data is held only for as long as required to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations.
User Rights
mitra138 users have meaningful rights over their personal data, including the right to access, correct, restrict processing of and request deletion of their information.
Accountability
mitra138 is responsible for the personal data it holds. Any third parties who process data on our behalf are subject to contractual obligations that mirror our own data protection standards.
Introduction
mitra138 (accessible at mitra138.cam) is an English-language online casino and sports betting information platform designed for Malaysian adults aged 21 and above. This Privacy Policy ("Policy") sets out the basis on which mitra138 ("we", "us", "our") collects, processes, stores and protects the personal data of individuals ("you", "the User") who register for an account or otherwise interact with the platform.
This Policy should be read alongside the mitra138 Terms and Conditions. By creating an account or using the platform in any capacity, you acknowledge that you have read and understood this Policy and agree to the data practices described herein.
Note for Malaysian users: Personal data processed by mitra138 in connection with Malaysian residents may be subject to applicable Malaysian data protection legislation. Users are encouraged to review their rights under applicable law in addition to the rights described in this Policy.
Definitions
The following definitions apply throughout this Policy unless the context requires otherwise:
"Personal Data"
Any information relating to an identified or identifiable natural person, including name, address, email, device identifiers and financial records.
"Processing"
Any operation performed on personal data, including collection, storage, use, disclosure, erasure and destruction.
"Data Controller"
The entity that determines the purposes and means of processing personal data — in this case, mitra138.
"Data Processor"
A third party that processes personal data on behalf of mitra138 under a written agreement and subject to mitra138's instructions.
"Consent"
A freely given, specific, informed and unambiguous indication of the User's agreement to processing of their personal data for a stated purpose.
"KYC"
Know Your Customer — the identity and payment ownership verification process required before withdrawal requests are processed.
Data Controller
mitra138 is the data controller for the personal information collected through the mitra138.cam platform. As data controller, mitra138 determines why and how personal data is processed in connection with the provision of its services.
Where mitra138 engages third-party service providers — for example, payment processors facilitating DuitNow, FPX, Touch 'n Go eWallet or Boost transactions — those providers act as data processors under contractual terms that bind them to comparable data protection standards.
Data We Collect
mitra138 collects personal data through several channels depending on the nature of the user interaction. The categories of data collected are set out below:
| Category | Examples | Collection Point |
|---|---|---|
| Identity Data | Full legal name, date of birth, national identification number, passport or MyKad details | Registration; KYC verification |
| Contact Data | Email address, mobile phone number, residential address (including city — e.g. Kuala Lumpur, Penang, Johor Bahru) | Registration; account settings |
| Financial Data | Bank account details, e-wallet identifiers (Touch 'n Go, Boost, GrabPay), transaction history, MYR deposit and withdrawal records | Deposit and withdrawal actions |
| Technical Data | IP address, browser type and version, device type, operating system, session timestamps | Automatic collection during platform use |
| Usage Data | Pages visited, games accessed, bet history, session duration, clickstream data | Automatic collection during platform use |
| Communications Data | Live-chat transcripts, email correspondence, support ticket content | Customer support interactions |
| Verification Documents | Copies of identity documents, proof of address, payment method ownership evidence | KYC verification process |
mitra138 does not intentionally collect special-category personal data (such as health, biometric or political information) in the ordinary course of platform operation. If such data is incidentally disclosed by a User, it will not be used for any purpose beyond the immediate context in which it was provided.
Lawful Basis for Processing
mitra138 relies on the following lawful bases for processing personal data, depending on the nature and purpose of the processing activity:
- Contractual necessity — processing required to open and administer your account, process deposits and withdrawals, and deliver the mitra138 service as described in the Terms and Conditions.
- Legal obligation — processing required to comply with applicable anti-money laundering, KYC, age verification and other regulatory requirements.
- Legitimate interests — processing necessary for fraud prevention, platform security, responsible gambling monitoring, and service improvement, where such interests are not overridden by your fundamental rights.
- Consent — where mitra138 seeks to send optional marketing communications or to use non-essential cookies, consent will be sought separately and may be withdrawn at any time.
How We Use Your Data
Personal data collected by mitra138 is used exclusively for the following documented purposes:
- To create, verify and administer your mitra138 account, including completion of KYC requirements.
- To process MYR deposits and withdrawals through supported payment channels including DuitNow, FPX, Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost and GrabPay.
- To provide customer support through English, Bahasa Melayu and Chinese-language support channels.
- To detect and prevent fraudulent activity, bonus abuse, money laundering and other prohibited conduct.
- To monitor account activity for responsible gambling purposes, including identifying patterns that may indicate problem gambling behaviour.
- To comply with applicable legal and regulatory obligations, including age verification, anti-money laundering checks and reporting requirements.
- To communicate platform updates, policy changes and security notices relevant to your account.
- To improve the performance, security and usability of the mitra138 platform based on aggregated, anonymised usage analytics.
mitra138 does not sell, rent or trade your personal data to unaffiliated third parties for their own commercial purposes. Data shared with third-party payment processors is limited to what is strictly necessary to complete the relevant transaction.
Data Sharing
mitra138 may share personal data with the following categories of recipient, in each case subject to appropriate contractual or legal safeguards:
- Payment service providers — including those operating DuitNow, FPX, Touch 'n Go eWallet, Boost and card payment infrastructure, solely for the purpose of processing authorised transactions.
- Identity verification providers — third-party KYC services that assist mitra138 in verifying the identity and age of users as required by applicable obligations.
- IT and platform infrastructure providers — cloud hosting, security and technical support providers who process data on behalf of mitra138 under strict data processing agreements.
- Fraud and security vendors — specialised services engaged to detect and prevent fraudulent account activity and financial crime.
- Legal and regulatory authorities — where mitra138 is required by law, court order or regulatory directive to disclose personal data.
mitra138 does not share personal data with third parties for advertising, profiling or data-brokering purposes.
Retention Periods
mitra138 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. Indicative retention periods are as follows:
- Account and identity data — retained for the duration of the active account relationship and for a defined period thereafter, in accordance with applicable KYC and anti-money laundering record-keeping requirements.
- Transaction records — retained as required to support financial auditing, dispute resolution and regulatory reporting obligations.
- Support communications — retained for a reasonable period to support ongoing service quality and dispute management.
- Technical and usage logs — retained in aggregate or anonymised form for platform security and performance monitoring.
When personal data is no longer required for any legitimate retention purpose, it is securely deleted or irreversibly anonymised.
Data Security
mitra138 implements technical and organisational security measures proportionate to the sensitivity of the personal data held and the risks associated with its processing. These measures include, without limitation:
- Encryption of personal and financial data in transit and at rest.
- Access controls that restrict personal data to authorised personnel with a documented need to access it.
- Regular security testing and vulnerability assessments of platform infrastructure.
- Audit logging of access to sensitive account and transaction data.
- Staff training on data protection responsibilities and incident response procedures.
Notwithstanding these measures, no internet-based system can guarantee absolute security. In the event of a personal data breach that poses a material risk to affected individuals, mitra138 will take prompt remediation steps and notify affected users in accordance with applicable obligations.
Users play an important role in account security. You are responsible for keeping your mitra138 login credentials confidential. If you suspect that your account has been accessed without your authorisation, contact mitra138 24/7 support immediately.
Your Rights
Subject to applicable law, mitra138 users have the following rights with respect to their personal data. To exercise any of these rights, contact mitra138 support using the details in Section 15.
-
Right of Access
You may request a copy of the personal data that mitra138 holds about you, together with information about how it is being used. -
Right to Rectification
You may request correction of inaccurate or incomplete personal data held about you. Some corrections may require supporting documentation. -
Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations. -
Right to Restrict Processing
You may ask mitra138 to temporarily limit the use of your personal data while a query or complaint is being resolved. -
Right to Data Portability
Where processing is based on your consent or on a contract, you may request that mitra138 provides your personal data in a structured, commonly used and machine-readable format. -
Right to Object
You may object to processing carried out on the basis of legitimate interests. mitra138 will cease such processing unless it can demonstrate compelling legitimate grounds that override your rights. -
Right to Withdraw Consent
Where processing is based on your consent — for example, optional marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
mitra138 will respond to rights requests within a reasonable timeframe. Where a request cannot be fulfilled — for example, because retention is required by law — mitra138 will explain the reason in writing.
Minors
The mitra138 platform is strictly intended for adults aged 21 and above. mitra138 does not knowingly collect personal data from individuals below the minimum age requirement. Age verification is enforced through the KYC process as a mandatory condition of account activation.
If mitra138 becomes aware that personal data has been collected from an individual below the age of 21, that account will be immediately closed, the data will be deleted in accordance with applicable obligations, and any balance will be handled in accordance with the Terms and Conditions and relevant legal requirements.
Cross-Border Data Transfers
mitra138 may engage service providers — including cloud infrastructure, payment processing and security vendors — that process personal data in jurisdictions outside Malaysia. Where such transfers occur, mitra138 takes steps to ensure that appropriate safeguards are in place, which may include contractual clauses that require the recipient to protect the data to a standard comparable to that applicable in the originating jurisdiction.
Users who have concerns about international data transfers may contact mitra138 support for further information about the specific safeguards applied.
Policy Amendments
mitra138 may update this Privacy Policy from time to time to reflect changes in data practices, platform features or applicable legal requirements. Where changes are material, mitra138 will provide advance notice to registered users through an appropriate channel, such as an on-screen notification or email.
The "Last reviewed" date displayed at the top of this page will be updated each time the Policy is amended. Continued use of the mitra138 platform following notification of an update constitutes acceptance of the revised Policy.
Contact Us
To exercise any data rights described in this Policy, to raise a privacy concern, or to request further information about mitra138's data practices, please contact the mitra138 support team using the details below:
Website email: [email protected] (plain text only — not a clickable link)
Support agents are available 24 hours daily in English, Bahasa Melayu and Chinese. For formal written privacy enquiries, using the email address above will ensure your request is routed to the appropriate team. Typical response times for written enquiries may exceed the 3–5 minute live-chat average.
If you believe that your privacy rights have not been adequately addressed by mitra138, you may have the right to lodge a complaint with a relevant data protection authority in your jurisdiction.
Your Privacy Is Protected
Continue Exploring mitra138 with Confidence
Now that you understand how mitra138 handles your personal data, review the Terms and Conditions and Responsible Gambling guide before playing. Informed players make better decisions.