Privacy Policy — Your Data at ml138

The following definitions apply throughout this Privacy Policy:

• "ml138", "we", "us", "our" — the ml138 platform and its operating entity, accessible at ml138.onl.
• "You", "User", "Player" — any individual who accesses, registers, or interacts with the ml138 platform in any capacity.
• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, either directly (e.g., full name, national ID number) or indirectly (e.g., IP address combined with other available data).
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Platform" — the ml138 website (ml138.onl), mobile-optimised site, and all associated sub-pages, features, games, and services.
• "KYC" — Know Your Customer verification procedures designed to confirm a user's identity, age, and eligibility before withdrawal processing.
• "Third-Party Provider" — any external vendor, game studio, payment processor, or service partner that processes data on ml138's behalf or alongside ml138 under a contractual arrangement.
• "Cookies" — small data files placed on your device by the Platform for session management, analytics, and personalisation purposes.

ml138 collects the minimum Personal Data necessary to deliver its services safely, legally, and efficiently. The categories of data we collect include:

2.1 Registration Data

When you create an ml138 account, we collect your full legal name, date of birth, email address, Indonesian mobile phone number, residential address, and a username of your choosing. This information forms the core of your account profile and is used for identification, communication, and KYC purposes.

2.2 Identity Verification (KYC) Data

Before processing your first withdrawal, we are required to verify your identity. This may involve collecting copies of government-issued identity documents such as your Indonesian KTP (Kartu Tanda Penduduk), SIM (driver's licence), or passport, as well as proof of bank account ownership. KYC documents are stored securely and processed solely for compliance and fraud-prevention purposes.

2.3 Financial Data

We collect information about your deposits, withdrawals, transaction amounts, payment method types (e.g., BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), and transaction timestamps. We do not store full bank account passwords or full card numbers — payment processing is handled by certified third-party payment gateways.

2.4 Gaming Activity Data

We record your betting and gaming history, including game titles played, bet amounts, stakes, winnings, session durations, and the dates and times of activity. This data is used for responsible gaming monitoring, fraud detection, bonus settlement, and dispute resolution.

2.5 Technical and Device Data

We automatically collect technical data when you access the Platform, including your IP address, browser type and version, operating system, device type, screen resolution, referring URL, and session duration. This data is used for security, fraud detection, and platform performance optimisation.

2.6 Communications Data

Any messages you send to ml138's support team via live chat or email are retained as part of your account record for quality assurance, dispute resolution, and regulatory compliance purposes. We do not monitor your communications for marketing profiling without your explicit consent.

2.7 Voluntary Survey and Feedback Data

If you choose to participate in ml138 surveys, promotions, or feedback requests, we collect your responses. Participation is entirely voluntary and non-participation has no effect on your account standing.

ml138 collects Personal Data through the following channels:

• Directly from you: when you complete the registration form, submit KYC documents, initiate a deposit or withdrawal, contact our support team, or participate in a promotion.
• Automatically: through cookies, server logs, and tracking technologies embedded in the Platform that record technical and behavioural data during your visit.
• From payment providers: transaction confirmation data and account ownership verification results are returned to us by your bank or e-wallet provider when you make a deposit or withdrawal.
• From game studios: certified random number generator (RNG) audit data and game-round result records are received from third-party providers such as Pragmatic Play, Evolution Gaming, Spribe, and Pocket Games Soft.
• From identity verification services: where we use a third-party KYC service to cross-reference document data, that service returns a verification outcome (pass/fail) and may share the underlying document image data subject to its own privacy controls.

ml138 processes your Personal Data for the following specific, documented purposes:

ml138 does not use your Personal Data for purposes beyond those listed above without first obtaining your explicit consent or where required by applicable law.

ml138 processes Personal Data on one or more of the following legal bases, depending on the purpose of the processing activity:

• Contract performance: processing is necessary to fulfil the contract you entered into when you registered your ml138 account, including operating your account, processing transactions, and delivering the services you requested.
• Legal obligation: processing is required to comply with applicable anti-money-laundering regulations, age verification obligations, responsible gaming mandates, and any reporting requirements imposed by the regulatory authority under which ml138 holds its international gaming licence.
• Legitimate interests: processing is necessary for ml138's legitimate business interests, including fraud detection, platform security, and the prevention of criminal activity, where such interests are not overridden by your rights and freedoms.
• Consent: for certain processing activities — specifically, the sending of marketing communications and the use of non-essential cookies — we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time by updating your account communication preferences or adjusting your browser cookie settings.

ml138 does not sell your Personal Data to third parties. We share your data only in the following limited, controlled circumstances:

6.1 Payment Processors

When you initiate a deposit or withdrawal, the minimum necessary financial and identity data is shared with the relevant Indonesian bank or e-wallet provider (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata, OVO, DANA, GoPay, ShopeePay, or LinkAja) to execute the transaction. These providers process data under their own privacy policies and applicable banking regulations.

6.2 Game Studio Providers

To deliver casino and sportsbook products, ml138 integrates with certified game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft. A session token and anonymised player identifier are passed to these studios to authenticate your game session. Full identity data is not shared with studio providers.

6.3 KYC and Fraud Prevention Services

Where ml138 uses third-party identity verification or anti-fraud tools, your identity document data and registration data may be processed by those services under data processing agreements that contractually bind them to data protection standards equivalent to or exceeding those described in this Privacy Policy.

6.4 Regulatory and Legal Disclosure

ml138 may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where required by applicable law, a valid legal order, or where disclosure is necessary to protect the rights, property, or safety of ml138, its users, or the public.

6.5 Corporate Transactions

In the event of a merger, acquisition, asset sale, or restructuring of ml138's operating entity, your Personal Data may be transferred as part of that transaction. You will be notified by email or by prominent notice on the Platform at least 30 days before any such transfer takes effect, and you will have the right to request deletion of your data before the transfer is completed.

ml138 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and registration data: retained for the duration of your account and for a minimum of five (5) years following permanent account closure, in line with anti-money-laundering record-keeping obligations.
• KYC documents: retained for a minimum of five (5) years following the last transaction associated with the verified account, or longer if required by the applicable regulatory authority.
• Transaction records: retained for a minimum of five (5) years from the date of each transaction.
• Gaming activity records: retained for three (3) years from the date of each session, or longer if required for an ongoing dispute or investigation.
• Support communications: retained for three (3) years from the date of each interaction.
• Marketing consent records: retained until consent is withdrawn and for one (1) year thereafter as a compliance record.
• Cookie and analytics data: retained in accordance with the specific cookie type — session cookies expire when you close your browser; persistent analytics cookies are retained for up to thirteen (13) months.

When retention periods expire, Personal Data is securely deleted or anonymised in a manner that makes re-identification impossible.

ml138 implements a multi-layered security framework to protect your Personal Data from unauthorised access, disclosure, alteration, or destruction. Key measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the ml138 Platform, ensuring that data in transit cannot be intercepted in readable form.
• Encrypted storage of sensitive data fields (including passwords, which are stored as salted cryptographic hashes and never in plaintext) and KYC document files at rest.
• Access controls: employee access to Personal Data is granted on a strict need-to-know basis. All internal access is logged, and access rights are reviewed quarterly.
• Two-factor authentication (2FA) is available for all user accounts and is mandatory for all ml138 administrative systems.
• Penetration testing and vulnerability assessments are conducted by independent third-party security firms on a regular schedule.
• Incident response: in the event of a confirmed data breach affecting your Personal Data, ml138 will notify affected users within 72 hours of becoming aware of the incident, describing the nature of the breach, the data affected, and the steps being taken to address it.

The ml138 Platform uses cookies and similar tracking technologies to operate core Platform functions, improve performance, and — where you have provided consent — to deliver personalised content. The types of cookies we use are:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function correctly. They manage your login session, maintain your preferences during a visit, and protect against cross-site request forgery. Strictly necessary cookies cannot be disabled without breaking core Platform functionality.

9.2 Performance and Analytics Cookies

These cookies collect anonymised data about how users interact with the Platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data helps us improve the Platform's performance and usability. These cookies require your consent and can be disabled via your browser settings or our cookie preference centre.

9.3 Functionality Cookies

These cookies remember your preferences — such as your preferred language or recently viewed game categories — to provide a more personalised experience on return visits. They require your consent.

9.4 Managing Your Cookie Preferences

You may withdraw consent for non-essential cookies at any time by adjusting your browser's cookie settings. Most modern browsers allow you to block, delete, or receive notifications about cookies. Disabling non-essential cookies will not affect your ability to use the Platform's core features, though some personalisation functionality may be limited.

ml138 respects your rights over your own Personal Data. Subject to applicable law and our regulatory obligations, you hold the following rights:

• Right of Access: you may request a copy of all Personal Data that ml138 holds about you, including the purposes for which it is being processed and the categories of recipients with whom it has been shared.
• Right to Rectification: if any Personal Data we hold about you is inaccurate or incomplete, you may request that we correct or update it. Name corrections may require supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): you may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no other legal basis applies. This right is subject to our legal retention obligations — for example, KYC and transaction records must be retained for a minimum of five years.
• Right to Restriction of Processing: you may request that we restrict processing of your data while a dispute over accuracy or the legal basis for processing is being resolved.
• Right to Data Portability: where processing is based on consent or contract performance, you may request your Personal Data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: you may object to processing based on legitimate interests at any time. ml138 will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw Consent: where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time via your account settings or by contacting support. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our Data Privacy team by emailing [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 48 hours and provide a substantive response within thirty (30) calendar days. For complex requests, we may extend this period by a further thirty days, with prior written notice.

The ml138 Platform may reference or integrate third-party services — including game studios, payment gateways, and analytics tools — whose own privacy policies govern data collected through their respective systems. ml138 does not control and is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party provider whose service you access in connection with the Platform.

ml138's Platform does not contain outbound links to third-party websites. Any data sharing with third parties occurs as described in Clause 6 under controlled, contractually governed arrangements — not through unsolicited redirection to external sites.

The ml138 Platform is strictly restricted to adults aged 21 and over. ml138 does not knowingly collect Personal Data from individuals under the age of 21. If we become aware that a user is under 21, the account will be immediately suspended, all data associated with the account will be reviewed, and data collected from the minor will be securely deleted to the extent permitted by our legal retention obligations.

ml138 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. When material changes are made, we will provide advance notice via a prominent notice on the Platform and, where feasible, by email to your registered address, at least seven (7) days before the changes take effect.

The current version of this Privacy Policy is always identifiable by the "Last updated" date displayed in the page header. We encourage you to review this policy periodically. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the revised policy.

Prior versions of this Privacy Policy are available upon request by contacting our support team.

If you have any questions, concerns, or requests relating to this Privacy Policy or ml138's data practices, please reach out to us through either of the following channels:

• Live Chat: Available 24/7 via the support widget on the Platform. Indonesian-speaking agents are on duty during WIB peak hours for users who prefer to discuss privacy matters in Bahasa Indonesia.
• Email: [email protected] — for Data Rights Requests, use subject line "Data Rights Request — [Your Username]". For general privacy enquiries, use "Privacy Enquiry". Responses are typically provided within 48 hours.

For formal data rights requests, please include your registered username, a description of your request, and a copy of a government-issued ID so that we can verify your identity before processing the request. This verification step protects you from unauthorised third-party access to your data.