Last Updated: 1 January 2026 | Estimated reading time: 8 minutes
This Privacy Policy is the official document explaining how the box138 platform handles the personal data of all members and visitors to our website. We take our responsibility to protect your privacy seriously and operate in full compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and the best international data protection standards.
By registering or using the box138 platform, you acknowledge that you have read, understood, and agreed to this Privacy Policy. This Policy should be read together with Terms and Conditions which together form the entire agreement between you and the box138 platform.
box138 has never and will never sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Your privacy is not a product to us — it is a responsibility we take wholeheartedly.
1Privacy Policy Introduction & Scope
Box138 is an online betting platform operating under the domain box138.onl, providing sports betting, live casino, bingo, wagering, and various online entertainment categories to users in Malaysia. As a trusted and responsible platform, we place the protection of members' personal data as one of our top operational priorities.
This Privacy Policy applies to all personal information collected by box138 through various channels, including:
- Member account registration and management on the box138.onl platform
- Financial transactions including deposits and withdrawals
- Use of all games and services on the platform
- Communications with the box138 customer support team
- Participation in promotions, bonuses, and marketing campaigns
- Visits and interactions with the box138.onl website
This Policy does not apply to third-party websites or services that may be linked from our platform. We encourage you to review the respective privacy policies of those third parties separately.
2Personal Information We Collect
Box138 collects your personal data responsibly and only to the extent necessary for the services you use. The following are the categories of information we collect:
2.1 Personal Identity Information
- Full name as stated on official identification documents
- Malaysia Identity Card number (MyKad) or passport number
- Date of birth for age verification
- Gender and nationality
- KYC (Know Your Customer) images or documents uploaded
2.2 Contact Information
- Active and monitored email address
- Malaysia mobile phone number
- Current residential address
2.3 Financial Information
- Bank account number and bank name for withdrawal processing
- Bank account holder name
- Digital wallet information (such as Touch 'n Go eWallet or GrabPay)
- Deposit and withdrawal transaction records
2.4 Platform Activity Information
- Betting, gaming, and in-platform activity records
- Bonus history and promotional campaign participation
- Communication logs with the support team
2.5 Technical & Device Information
- IP address and IP-based geolocation data
- Web browser type and device operating system
- Device ID and other relevant technical information
- Login session cookie and session data
We only collect information required for specific purposes that have been communicated to you. This "data minimisation" principle is the foundation of our privacy practices at box138.
3How We Use Your Personal Data
The personal data we collect is used solely for lawful, specified purposes. Below is a summary table of how we use your data:
| Purpose of Use | Data Used | Legal Basis |
|---|---|---|
| Identity verification (KYC) | Identity, documents, images | Legal obligations |
| Member account management | Identity, contact details, login | Contract fulfillment |
| Deposit & withdrawal processing | Financial, identity | Contract fulfillment |
| Customer support | Contact details, account activity | Contract fulfillment |
| Fraud prevention & AML | All categories | Legal obligations |
| Marketing (with consent) | Contact details, game preferences | Your consent |
| Platform improvement | Technical, platform activity | Legitimate interest |
| Regulatory requirement compliance | Identity, financial | Legal obligations |
We will not use your data for any other purpose not stated here without first obtaining your renewed consent, unless required by law.
4Information Sharing with Third Parties
Box138 maintains a strict policy regarding the sharing of members' personal data. We do not sell, rent, or disclose your data to third parties except in the following limited situations:
4.1 Trusted Service Providers
We only share the necessary data with service providers that help us operate the platform, including:
- Identity verification (KYC) provider: To process document verification automatically and securely
- Payment processor: Banks, digital wallets, and payment gateways to facilitate transactions
- Cloud infrastructure provider: For secure, high-performance data storage
- Game software provider: To ensure continuity of your gaming experience
All these service providers are bound by strict confidentiality agreements and are only permitted to process your data in accordance with box138's instructions.
4.2 Legal Authorities
Box138 may disclose your personal data to government authorities or regulatory bodies when required by Malaysian law, including in cases of criminal investigation, anti-money laundering (AML) compliance, or by valid court order.
box138 does not share your personal data with advertisers, third-party marketing companies, or any other commercial entities without your explicit prior consent.
4.3 Cross-Border Data Transfers
In situations where your data needs to be transferred outside Malaysia (for example, to international cloud provider servers), box138 ensures such transfers are carried out with protection equivalent to or exceeding Malaysia's PDPA standards, including the use of recognised standard contractual clauses.
5Security & Data Protection
Protecting your personal data from unauthorised access, loss, or misuse is box138's highest technical priority. We continuously invest in sophisticated security infrastructure and conduct regular security audits to ensure the best possible protection.
5.1 Technical Security Measures
- 256-bit SSL Encryption: All communications between your browser and box138 servers are fully encrypted using the latest TLS protocol
- Stored data encryption: Sensitive data such as banking information and KYC documents are stored in encrypted form within the database
- Two-Factor Authentication (2FA): Additional security layer for account login
- Real-time monitoring: An intrusion detection system (IDS) that continuously monitors for suspicious activity
- Network segregation: Isolated server infrastructure with multi-layer firewall
5.2 Internal Access Controls
Access to member personal data within box138's internal systems is strictly limited on a need-to-know basis. All staff with access to sensitive data are required to undergo background checks and comprehensive data protection training.
5.3 Incident Response
In the event of a data security breach involving your personal information, box138 is committed to notifying you and the relevant authorities within the timeframe prescribed by law, and to taking immediate and comprehensive remedial action.
While we take all reasonable steps to protect your data, no security system can be guaranteed 100% safe. You also play an important role by keeping your account password confidential.
6Cookies & Tracking Technologies
The box138.onl website uses cookies and similar tracking technologies to enhance user experience, maintain session security, and understand our platform's usage patterns in aggregate.
6.1 Types of Cookies We Use
Essential Cookies
Required for core platform functions such as login authentication, session security, and account preferences. These cookies cannot be disabled.
Analytics Cookies
Helps us understand how visitors interact with the website for the purpose of improving overall user experience.
Functional Cookies
Saves your preferences such as language, display settings, and game preferences to deliver a more personalised experience.
Marketing Cookies
Used to display more relevant promotions and content based on your interests. You may opt out at any time.
6.2 Cookie Management
You can manage your cookie settings through your web browser at any time. Please note that disabling certain cookies may affect the functionality or user experience of the box138 platform. For full guidance on cookie management, refer to your web browser's documentation.
7Your Rights Under Malaysia's PDPA
As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by box138:
Access Rights
You may request a copy of your personal data held by us at any time.
Right to Rectification
You may request corrections to any inaccurate or incomplete personal information we hold.
Right to Erasure
Under certain circumstances, you may request the deletion of your personal data from our systems.
Right to Withdraw Consent
You may withdraw your consent to data processing at any time.
Right to Object
You may object to data processing for direct marketing purposes or legitimate interests.
Right to Data Portability
You may request your data in a machine-readable format for portability purposes.
To exercise any of the above rights, please contact our privacy team via Live Chat or email at [email protected]. We will process your request within 21 working days in accordance with Malaysia's PDPA requirements. Please note that some of these rights are subject to certain legal exemptions, particularly where KYC and AML obligations are involved.
8Data Retention Period & Deletion
Box138 retains your personal data only for as long as necessary for the stated purposes or as required by law. Our data retention schedule is as follows:
| Data Category | Retention Period | Reason |
|---|---|---|
| Identity & KYC information | 7 years after account closure | AML obligations & legal requirements |
| Financial transaction records | 7 years | Tax & audit requirements |
| Wagering activity logs | 3 years after account closure | Dispute resolution |
| Support communication logs | 2 years | Service records |
| Cookie & session data | Up to 12 months | Platform Features |
| Marketing data (with consent) | Until consent is withdrawn | Consent-based |
Upon expiry of the defined retention period, your personal data will be securely deleted or permanently anonymised across all box138 systems. The deletion process follows strict security procedures to ensure data cannot be recovered.
9Changes to Privacy Policy
Box138 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or platform improvements. All changes will take effect as soon as the latest version is published on this page.
For changes that are significant or involve a reduction of your rights, we will notify you by email to the address registered on your account at least 14 days before the changes take effect. Your continued use of the box138 platform after the effective date of such changes will be considered as your acceptance of the updated Privacy Policy.
We recommend reviewing this Privacy Policy page periodically to stay informed about how we protect your personal information. The "Last Updated" date at the top of this page will always reflect the latest version.
box138's Privacy Commitment to You
Privacy is more than a legal obligation for box138 — it is the foundation of trust we build with every member. Here are the six pillars of our privacy commitment:
Military-Grade Encryption
All your data is protected with 256-bit SSL encryption and the latest security protocols meeting global financial industry standards.
Secure & Fast KYC
Our identity verification process uses secure automated technology, ensuring your documents are processed swiftly and stored with strict safeguards.
Secured Bank Information
Your bank account number and payment details are stored in an isolated, encrypted environment, accessed only for withdrawal purposes.
No Data Selling
Box138 has never sold, rented, or disclosed your personal data to advertisers or any third party for their commercial interests.
Full PDPA Compliance
All our data practices are regularly audited to ensure full compliance with Malaysia's Personal Data Protection Act 2010 and international standards.
24/7 Privacy Support
Our dedicated support team is available to assist you with any data privacy enquiries via Live Chat, 24 hours a day, every day.
box138 Privacy FAQ
Below are the most frequently asked questions from our members regarding the Privacy Policy and data protection on the box138 platform.