Privacy Policy Gajah138 – Personal Data Protection for Malaysia Members

Gajah138 collects two main categories of data — data you provide directly when using the platform, and data collected automatically through our platform technology. Below is a detailed breakdown of each category.

Data you provide directly:

• Registration information: full name (as on your identification card), Malaysian phone number, date of birth, and a self-chosen password.
• Identity verification (KYC) documents: copies of your ID card, bank statement, or other verification documents requested during the KYC process — typically required for withdrawals exceeding a certain threshold.
• Financial information: bank account or digital wallet details (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX account) used for deposits and withdrawals. Full account numbers are stored in encrypted format.
• Communications with customer support: records of live chat conversations, emails, and any other support interactions you have initiated with our team.
• Feedback & surveys: responses you provide in questionnaires, satisfaction surveys, or in-platform game reviews.

Automatically collected data:

• Server log data: IP address, browser type, operating system, access date and time, pages visited, and time spent on the platform.
• Device data: unique device identifier, device model, screen resolution, and device language — used to optimise your mobile experience.
• Gaming activity data: a record of all bets placed, slots spins, game outcomes, and financial transactions in your account — retained for dispute resolution and payment verification purposes.
• Location data: general location information (city/state level) derived from your IP address — used strictly for compliance and fraud detection purposes.

Gajah138 uses personal data collected solely for legitimate purposes directly related to platform operations and the delivery of services to you. We do not use your data for any purpose not stated in this policy without first obtaining your consent.

• Service delivery: Processing registrations, deposits, and withdrawals, and enabling you to access all games and features within the Gajah138 platform.
• Identity verification (KYC): Ensuring all members meet the minimum age requirement of 21 and verifying identity for legal compliance with anti-money laundering regulations.
• Security and fraud prevention: Detecting and preventing fraudulent activity, identity theft, multiple account registrations, and any misuse of the platform that may harm other members.
• Customer support: Handling enquiries, complaints, and support requests efficiently based on your account records and interaction history.
• Responsible gaming: Monitoring betting patterns to identify early signs of problem gambling and proactively offering appropriate support.
• Platform enhancements: Analysing usage data in aggregate (not at an individual level) to understand usage patterns, identify technical issues, and make better-informed product development decisions.
• Service communications: Sending important account-related notifications such as transaction confirmations, security alerts, and changes to our terms of service.
• Marketing (with consent): Sending you promotional information, bonus offers, and platform updates — only if you have opted in to receive them. You may unsubscribe at any time.

Gajah138 does not sell or rent member personal data to any third party for marketing purposes. However, there are limited situations where we need to share certain data with trusted third parties in order to deliver our services to you.

• Payment processors: To process deposits and withdrawals, the necessary transaction details are shared with payment service providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and banks supporting FPX (Maybank2u, CIMB Clicks). These providers are bound by strict data protection agreements with us.
• Game providers: To enable you to play slots, live casino, and table games from providers such as Pragmatic Play and Evolution Gaming, the necessary session data is shared with those providers. They do not receive your full personally identifiable information.
• Analytics services: Anonymised usage data may be shared with analytics platforms to help us understand how the platform is used and improve the overall user experience.
• Legal compliance: Gajah138 will disclose personal data when required to do so by law, court order, or a lawful request from the authorities — including for anti-money laundering (AML) and national security purposes.

Protecting members' personal and financial data is our highest technical priority Gajah138. We continuously invest in our security infrastructure to ensure your data is always protected against unauthorised access, disclosure, alteration, or destruction.

• Transmission encryption: All communications between your device and Gajah138's servers are secured with TLS 1.3 protocol using AES-256-bit encryption, ensuring data cannot be intercepted in transit.
• Storage encryption: Sensitive data stored in our databases — including financial information and identity documents — is encrypted at rest using industry-standard encryption.
• Two-factor authentication: Gajah138 supports two-factor authentication (2FA) for account login and for withdrawal transactions exceeding a certain limit. We encourage all members to enable this feature.
• 24/7 monitoring: Our automated security monitoring systems run around the clock to detect and block unauthorised access attempts, cyberattacks, and suspicious activity in real time.
• Regular security audits: Gajah138 conducts regular vulnerability assessments and penetration testing through independent cybersecurity firms to identify and address weaknesses before they can be exploited.

While we take all reasonable precautions, no security system is entirely foolproof. We therefore also encourage you to help protect your account by using a strong and unique password, never sharing your login credentials with anyone, and reporting any suspicious activity to us promptly.

Platform Gajah138 uses cookies and similar tracking technologies to enhance your experience, ensure security, and understand how the platform is used. Cookies are small text files stored on your device by your web browser.

• Essential cookies (always active): These cookies are required for core platform functions such as maintaining your login session, saving game preferences, and enabling security features. Without them, the platform cannot function properly.
• Performance cookies: Collecting information about how you use the platform — pages visited, links clicked, time spent — to help us identify issues and improve performance. This data is collected in aggregate and cannot be attributed to any individual.
• Functional cookies: Storing your personal preferences such as display language, favourite game settings, and display options to ensure a more personalised experience each time you log in.
• Security cookies: Used to detect and prevent fraud, verify your identity during active sessions, and protect your account from unauthorised access originating from unfamiliar locations or devices.

As a member Gajah138, you have certain rights regarding your personal data. We respect these rights and will handle all related requests seriously and within a reasonable timeframe.

• Right of access: You have the right to request a copy of the personal data we hold about you, including account information, transaction records, and communication history. This request can be made through our customer support.
• Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. Some information can be updated directly through your account settings.
• Right to restrict: Under certain circumstances, you may request that we restrict how we use your data — for example, while a dispute about the accuracy of that data is being resolved.
• Right to object: You may object to the use of your data for direct marketing purposes at any time. Such unsubscribe requests will be processed immediately, no questions asked.
• Right to erasure: Under certain circumstances (for example, where data is no longer needed for its original purpose), you may request the deletion of your personal data. However, some data may need to be retained for legal compliance even after account closure.
• Right to data portability: You may request that we provide your personal data in a machine-readable format for transfer to another service provider where applicable.

To exercise any of the rights above, please contact our data protection team by email at support@gajah138.run and state your request clearly. We will process your request within 30 days of receipt and may require identity verification before processing certain requests.

Gajah138 only retains your personal data for as long as necessary to fulfil the purposes stated in this policy, or as required by applicable law. When data is no longer needed, it will be securely deleted or anonymised.

• Active account data: For as long as your account remains active, all personal data and activity records will be retained to support the continuous delivery of our services and the resolution of any disputes that may arise.
• After account closure: When an account is closed at your request or by Gajah138, core data including identity records, financial transactions, and game records will be retained for a minimum of 5 years for anti-money laundering compliance and future dispute resolution purposes.
• Communications data: Customer support conversation records are retained for 2 years from the date of the last interaction for service quality and complaint resolution purposes.
• Technical log data: Server logs and technical data are retained for 90 days from the date of generation before being automatically deleted.
• Marketing data: If you withdraw consent for marketing communications, your communication preferences (including the withdrawal record itself) will be retained to ensure we do not send you marketing communications in the future.

Gajah138 reserves the right to update or amend this Privacy Policy from time to time in line with changes to platform operations, legal requirements, or industry best practices. The "Last Updated" date at the top of this page reflects the date of the most recent amendment.

• Members will be notified of any material amendments to this Privacy Policy via in-platform notifications and/or email to your registered address at least 7 days before the changes take effect.
• Continued use of the Gajah138 platform after any amendments take effect will be considered acceptance of the revised policy.
• We recommend checking this page periodically to stay informed about how your data is handled.

We take every privacy-related enquiry seriously and aim to provide a satisfactory response within the stipulated timeframe. If you are not satisfied with our response, you have the right to seek assistance from the relevant authority.