Privacy Policy tim138 – Malaysia Member Data Protection

Tim138 (operating under the domain tim138.best) understands that your privacy is a deeply personal and important matter. As an online entertainment platform serving users in Malaysia, we are subject to strict data protection requirements and take this responsibility seriously.

This Privacy Policy clearly explains how we handle your personal information from the moment you first visit the tim138 website through every interaction you make as a registered member — including account registration, deposits via Touch 'n Go eWallet or GrabPay, betting activity, and any communications with our support team.

This policy applies to all services provided by tim138, including Malaysia Super League and EPL Sports Betting, Live Casino, lottery, sports, Mobile Legends and Dota 2 e-sports, and the VIP Rewards Program. It also covers all our communication channels, including the web platform, mobile app, live chat, and email.

Tim138 follows the principle of data minimisation — we only collect information that is genuinely necessary to provide our services safely and efficiently. The following outlines the categories of data we collect and the circumstances in which they are collected:

Data You Provide Directly:

• Registration Information: Your full name, Malaysian mobile number, email address, date of birth, and your chosen password when registering a new account.
• Identity Verification Documents (KYC): A copy of your MyKad, proof of address, and a verification selfie are required to process your first withdrawal or when transaction amounts exceed certain thresholds.
• Financial Information: Details of the payment method you use for deposits, including partially masked bank account numbers or e-wallet account IDs (we do not store your full account number or e-wallet PIN).
• Communications: Any messages, queries, or information you share when interacting with the tim138 support team via live chat, email, or WhatsApp.

Automatically Collected Data:

Tim138 does not collect special category data such as health information, full biometric data, political views, or religious beliefs unless you voluntarily disclose such information in communications with us — and in those cases, it is not stored in your account profile.

Every use of your personal data by tim138 is grounded in a legitimate and necessary purpose. We do not use your data for anything unrelated to delivering the services you have subscribed to. The following are the primary purposes for which your data is used:

• Account Management: Creating, managing, and maintaining your tim138 account, including registration processing, identity verification, and account settings management.
• Transaction Processing: Processing deposits via e-wallet and FPX, withdrawals to your Malaysian bank account or e-wallet, and maintaining accurate transaction records for your reference.
• Gaming Services Provision: Grants you access to all available games, including Sports Betting, Live Casino games such as Baccarat and Roulette, lottery, e-sports, and all other categories on the tim138 platform.
• Security & Fraud Prevention: Detecting and preventing fraud, money laundering, multiple account ownership, and any activities that violate Terms & Conditions tim138.
• Customer Support: Responding to enquiries, resolving technical issues, and providing assistance related to your account or transactions through available support channels.
• Legal Compliance: Meeting applicable legal and regulatory requirements, including Anti-Money Laundering (AML) obligations, Know Your Customer (KYC) requirements, and reporting to authorities where required by law.
• VIP Program & Rewards: Managing the tim138 VIP Rewards program, including points calculation, cashback processing, and communications related to your VIP tier.
• Service Improvement: Analysing platform usage patterns in aggregate and anonymised form to better understand the needs of Malaysian users and improve the overall experience on tim138.
• Marketing Communications: Sending promotional information, exclusive offers, and the latest tim138 updates — subject to your communication preferences, which you may change at any time.

Tim138 does not sell, rent, or trade members' personal data to any third party for their own marketing purposes. This is a firm commitment with no exceptions.

However, there are limited circumstances in which tim138 may need to share your data with certain parties to ensure our services operate properly:

• Payment Processors: tim138 shares necessary transaction information with authorised payment processors to facilitate deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX. All payment processors are bound by strict confidentiality agreements and may only use the data for transaction processing purposes.
• Technology Service Providers: Companies that assist us in managing the platform's technical infrastructure, security systems, email services, and analytics. They are not permitted to use your data for any purpose other than supporting tim138's operations.
• Legal Authorities: tim138 will disclose personal data to Malaysian government or law enforcement authorities when required by a court order, warrant, or valid legal obligation. We do not disclose data beyond what is legally required.
• Fraud Prevention: In cases involving fraud, money laundering, or suspected criminal activity, relevant information may be shared with the appropriate enforcement or industry bodies as required by law.

Member data security is the highest technical priority at tim138. We continually invest in security infrastructure and ensure our systems meet or exceed the latest industry standards. Below are the security layers we have in place to protect your data:

• Data Encryption in Transit: All communications between your device and tim138's servers are secured using TLS 1.3 protocol with 256-bit SSL encryption — the same level of protection used by Malaysian banking institutions such as Maybank and CIMB for their online transactions.
• Data Encryption at Rest: Sensitive data such as MyKad numbers, financial details, and passwords (stored as irreversible one-way hashes) are protected with AES-256 encryption in our database.
• Internal Access Controls: Only tim138 staff with a legitimate business need may access members' personal data, and all such access is logged and regularly monitored. The principle of least privilege is strictly enforced across all internal systems.
• Real-Time Security Monitoring: Intrusion detection systems (IDS) and intrusion prevention systems (IPS) operate around the clock to detect and block any unauthorised access attempts.
• Independent Security Audits: tim138 conducts penetration testing and independent security audits twice a year, carried out by qualified third-party cybersecurity firms. Audit findings are used to drive continuous improvement.
• Incident Response Procedures: tim138 has a well-documented incident response procedure in place. In the event of a data breach that may affect your rights or freedoms, we will notify you within a reasonable timeframe as required by applicable law.

The tim138 platform uses cookies and similar tracking technologies to keep the platform running smoothly, deliver a better experience, and understand how users interact with our services. Below are the types of cookies we use:

You can manage your cookie settings through your web browser. However, disabling mandatory cookies may affect the functionality of the tim138 platform and you may not be able to access all services properly. For guidance on managing cookies in popular browsers, please refer to your browser's privacy settings.

Tim138 does not retain your personal data for longer than necessary. Retention periods vary depending on the type of data and applicable legal requirements:

• Active Account Data: For as long as your account remains active with tim138, we retain your profile information, transaction records, and activity history as needed to deliver our services effectively.
• Financial Transaction Data: Records of all financial transactions are retained for a minimum of 7 years in accordance with Malaysian legal requirements relating to AML compliance and accounting obligations.
• KYC Documents: Identity verification documents are retained for the duration of the active account plus 5 years after account closure, in accordance with licensing requirements and AML regulations.
• Communications Log: Support chat records and emails are retained for 2 years to assist in resolving any disputes and to improve service quality.
• Technical & Log Data: Technical logs such as access logs and security logs are retained for 12 months for security and troubleshooting purposes.
• After Account Closure: When you close your account, we will delete or de-link data that is no longer required for legal purposes within 90 days. Data that must be retained by law will be kept with strictly limited access.

As the owner of your personal data, you have certain rights that tim138 fully respects. Below are the rights available to you and how you can exercise them:

To exercise any of the rights listed above, please contact the tim138 support team by email at support@tim138.best with the subject line "PRIVACY RIGHTS REQUEST" along with your account number. We will process your request within 30 calendar days of receipt.

Tim138 services are exclusively for adults aged 18 and above. tim138 does not knowingly collect, use, or store any personal data belonging to individuals under the age of 18.

The tim138 account registration process requires confirmation that the user is at least 18 years of age, and we conduct periodic age verification checks through our KYC process. Should we discover that personal data belonging to an individual under the age of 18 has been collected without our knowledge, we will immediately take the following steps:

• Suspending and terminating the account in question
• Deleting all personal data associated with the account
• Refunding any deposited funds to the original payment method
• Reporting incidents to the relevant authorities where required

If you know or suspect that a person under the age of 18 has registered for or is using the tim138 platform, please contact us immediately at support@tim138.best so we can take the appropriate action.

Tim138 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or technological developments that affect how we handle data.

When we make significant changes to this policy, we will notify you through the following means:

• Displaying a prominent notice on the tim138 platform homepage for a minimum of 14 days
• Sending notification emails to all registered members with a valid and active email address
• Displaying a notice in your account that is visible upon your next login
• Updating the "Last Updated" date at the top of this document

Material changes to this policy will take effect 14 days after notice is given, unless the changes are required for legal compliance — in which case they may take effect immediately. We recommend reviewing this page periodically.

If you have any questions, concerns, or complaints regarding how tim138 handles your personal data, or if you wish to exercise any of the privacy rights described in this policy, our team is here to help.

You can reach us through the following channels:

• Privacy Email: support@tim138.best — use the subject line "PRIVACY ENQUIRY" for a faster response
• Live Chat: Available directly on the tim138 platform 24 hours a day, 7 days a week for immediate enquiries
• WhatsApp Support: Official number available in the platform's support section after logging in

Tim138 is committed to responding to all privacy-related enquiries within 5 business days. For formal complaints or complex privacy rights requests, processing may take up to 30 calendar days in accordance with legal requirements.

If you are not satisfied with our response to your privacy complaint, you have the right to refer the matter to the Department of Personal Data Protection (JPDP) Malaysia or the relevant regulatory body in your jurisdiction.