Privacy Policy

This Privacy Policy ("Policy") is issued by Giga138 ("we", "us", "our", "the Platform"), the operator of the online gaming platform accessible at giga138.cam and any associated subdomains or mobile interfaces. It sets out how we collect, use, store, disclose, and protect the personal information of individuals ("you", "your", "User") who access or use our services.

Giga138 is committed to handling your personal data with integrity, transparency, and in full compliance with applicable data protection legislation. We recognise that our Users — many of whom are based across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — entrust us with sensitive personal and financial information, and we take that responsibility seriously.

By registering an account, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, please discontinue your use of the Platform and contact us to arrange account closure.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which form part of the contractual framework governing your use of Giga138.

For the purposes of this Privacy Policy, the following terms have the meanings assigned below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, identification number, contact details, location data, financial information, and online identifiers.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, or erasure.
• "Data Controller" — Giga138, in its capacity as the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" — A third party that processes Personal Data on behalf of Giga138 pursuant to a written data processing agreement.
• "KYC Data" — Documents and information collected for identity and age verification purposes, including identity cards, passports, and proof of address.
• "Cookies" — Small text files placed on a User's device by the Platform to store preference data and enable session functionality.
• "Consent" — A freely given, specific, informed, and unambiguous indication of the User's agreement to the processing of their Personal Data.
• "Sensitive Data" — A subset of Personal Data that warrants heightened protection, including financial data, government identification numbers, and health-related information submitted in the context of responsible gambling tools.

Giga138 collects the following categories of personal data from Users:

3.1 Registration & Account Data

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Email address
• Mobile phone number
• Residential address (including city, state, and postcode within Malaysia)
• Username and encrypted password credentials
• Preferred currency (Malaysian Ringgit — MYR)

3.2 Identity Verification (KYC) Data

• National Registration Identity Card (NRIC) number or passport number
• Copies of government-issued photo identification documents
• Proof of address documentation (e.g., utility bills, bank statements)
• Selfie photographs submitted for facial verification purposes
• Source of funds documentation where required by our compliance procedures

3.3 Financial & Transaction Data

• Payment method identifiers (e.g., masked e-wallet account references for Touch 'n Go eWallet, Boost, GrabPay; bank account holder names for Maybank, CIMB, Public Bank, DuitNow, and FPX; cryptocurrency wallet addresses for BTC, ETH, USDT)
• Deposit and withdrawal transaction amounts and timestamps
• Transaction reference numbers issued by payment processors
• Account balance history for AML monitoring purposes

3.4 Gaming Activity Data

• Game session logs, including game type, stake amount, outcome, and timestamp
• Sports betting selections, odds accepted, and settlement results
• Bonus activations, wagering progress, and promotional redemption records
• VIP tier progression data and loyalty point accumulation records

3.5 Technical & Device Data

• IP address and geolocation data derived from IP lookup
• Device type, operating system, and browser version
• Session duration and page interaction data collected via analytics tools
• Cookie identifiers and related tracking data as described in Section 10

3.6 Customer Support Data

• Live chat transcripts
• Email correspondence content and metadata
• Complaint records and resolution outcomes

We collect Personal Data through the following channels:

• Directly from you — when you complete the account registration form, submit KYC documents, initiate or receive a payment, contact our support team, or participate in a promotion.
• Automatically from your device — through cookies, session logs, and our Platform analytics infrastructure when you access and interact with the website or mobile interface.
• From third-party payment processors — when you execute a deposit or withdrawal transaction through Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, FPX, DuitNow, or cryptocurrency networks. These processors share transaction confirmation data with Giga138 to facilitate account crediting.
• From identity verification service providers — when we engage licensed third-party KYC or age-verification providers to authenticate the documents you submit.
• From fraud prevention and AML screening services — as part of our regulatory obligations to detect and prevent financial crime.

Giga138 processes your Personal Data for the following specific purposes:

Giga138 does not use your Personal Data for any purpose not listed above without obtaining your prior explicit consent, except where required by applicable law or a regulatory authority.

Giga138 processes your Personal Data under one or more of the following legal bases:

• Contractual necessity — Processing required to fulfil our obligations under the Terms & Conditions you accepted at registration, including account management, payment processing, and game delivery.
• Legal obligation — Processing required for compliance with applicable regulatory requirements, including KYC/AML obligations, responsible gambling regulations, and lawful authority requests.
• Legitimate interests — Processing for purposes such as fraud detection, platform security, and service analytics, where our interests do not override your fundamental privacy rights.
• Consent — Processing for optional purposes such as marketing communications and non-essential cookies, where you have provided clear, freely given consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Giga138 does not sell, rent, or trade your Personal Data. We may disclose your data to the following categories of third parties, strictly for the purposes described in this Policy:

• Payment processors and e-wallet operators — To facilitate your deposit and withdrawal transactions (e.g., FPX gateway operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow). These processors act as Data Processors under binding data processing agreements.
• Identity verification providers — Licensed KYC service providers who assist Giga138 in verifying your identity and age documents. They receive only the minimum data necessary for verification purposes.
• Game content providers — Generic licensed game studios and live dealer streaming providers who may receive pseudonymised session data to facilitate game delivery and dispute resolution.
• AML and fraud screening services — Third-party compliance platforms engaged to screen transactions and account activity against financial crime databases as required by our regulatory obligations.
• Cloud infrastructure and hosting providers — Our data is hosted on secure cloud infrastructure. Hosting providers process data strictly according to our instructions and are contractually prohibited from accessing it for their own purposes.
• Regulatory and law enforcement authorities — Where we are required to disclose information by a court order, statutory obligation, or lawful request from a competent authority. Giga138 will, where permitted by law, notify affected users of such requests prior to disclosure.

Giga138 may transfer your Personal Data to servers or processors located outside Malaysia. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities, incorporated into data processing agreements with recipient entities.
• Adequacy assessments confirming that the recipient jurisdiction maintains a comparable level of data protection to that applicable in Malaysia.
• Technical and organisational security measures equivalent to those applied to data processed within Malaysia.

By using the Giga138 Platform, you acknowledge and consent to the cross-border transfer of your Personal Data as described above, subject to the safeguards outlined in this section.

Giga138 retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligation. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Where anonymised data is retained for analytics purposes, it is no longer considered Personal Data.

Giga138 uses cookies and similar tracking technologies to operate the Platform, enhance user experience, and gather analytics data. The following categories of cookies are used:

• Strictly necessary cookies — Required for core Platform functionality, including session authentication, security tokens, and payment flow management. These cannot be disabled without impairing the Platform's basic operation.
• Functional cookies — Store your preferences such as language settings, game volume controls, and display options to personalise your experience between sessions.
• Analytics cookies — Collect anonymised or pseudonymised data about how Users navigate the Platform, which pages are visited most frequently, and where technical errors occur. This information is used to improve the Platform.
• Marketing cookies — Where you have provided explicit consent, these cookies may be used to present relevant promotional content. You may withdraw this consent at any time via your account settings or browser controls.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform. For guidance on managing cookies on your specific browser or device, please consult your browser's help documentation.

Subject to applicable data protection law, you hold the following rights with respect to your Personal Data held by Giga138. To exercise any of these rights, please contact our support team as described in Section 16.

Giga138 implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. Key measures include:

• AES-256 encryption for all Personal Data stored in our databases.
• TLS 1.3 encryption for all data transmitted between your device and the Platform.
• Multi-factor authentication options for account login.
• Role-based access controls limiting staff access to Personal Data strictly on a need-to-know basis.
• Regular penetration testing and vulnerability assessments conducted by independent security professionals.
• Intrusion detection and prevention systems monitoring for anomalous access patterns.
• Staff training on data protection obligations and security hygiene.
• Incident response procedures including data breach notification protocols.

While Giga138 employs robust security measures, no internet-based platform can guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorised access to your account.

Giga138 is strictly an adults-only platform. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory component of our KYC process, and accounts suspected of belonging to underage individuals are suspended pending documentary verification.

If we become aware that Personal Data has been collected from a person under 21 years of age without parental or guardian consent, we will take immediate steps to delete that information and close the associated account. Any deposits received will be returned to the original payment source where reasonably practicable.

If you are a parent or guardian and believe your child may have registered on the Giga138 Platform, please contact us immediately via the channels described in Section 16.

Where you use our responsible gambling tools — including deposit limit settings, session time controls, cooling-off requests, or self-exclusion — Giga138 processes the related data for the specific purpose of giving effect to your preferences and complying with our responsible gambling obligations.

Self-exclusion records are retained for a minimum of 5 years from the date of exclusion. This data is processed under our legal obligation basis and cannot be deleted on the basis of a right-to-erasure request during the mandatory retention period. This safeguard exists to prevent re-registration by excluded individuals, which could cause harm.

Data submitted in the context of responsible gambling support — such as self-assessments or communications with our welfare team — is treated as Sensitive Data and afforded the highest level of protection. It is not used for any marketing or profiling purpose.

For further information on responsible gambling tools and resources available to Giga138 players, please visit our Responsible Gambling page.

Giga138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, Platform functionality, or applicable law. The "Last Updated" date at the top of this page will be revised with each amendment.

Where amendments are material — meaning they significantly affect how we process your Personal Data or alter your rights — we will notify registered Users by email or by a prominent notice on the Platform prior to the changes taking effect. We encourage you to review this Policy periodically to remain informed of how we handle your information.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not accept the revised terms, you should close your account and cease using the Platform.

For any queries, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact Giga138 through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week through the Platform. Recommended for urgent account-related privacy concerns.
• Email: [email protected] — For formal data subject requests, privacy complaints, or enquiries about data processing. Please mark the subject line as "Privacy Request" to ensure prompt routing to our data protection team. Allow up to 30 days for a full response.

When submitting a data subject request, please provide your registered account username, a description of your request, and any relevant reference numbers. We may be required to verify your identity before processing access, rectification, or erasure requests to protect against unauthorised requests.