Privacy Policy

Section 01

Introduction

daya138 ("the Platform", "the Company", "we", "us", "our") operates the online gaming and sports betting services accessible at daya138.cam. In providing these services, we collect and process certain personal data belonging to registered players, prospective players, and website visitors ("you", "the user", "the data subject").

This Privacy Policy ("the Policy") describes in detail what personal data we collect, why we collect it, how it is processed and stored, with whom it may be shared, how long it is retained, and what rights you have in relation to your data. This Policy applies to all data processing activities conducted by daya138 in connection with the Platform.

By creating an account, accessing the Platform, or otherwise interacting with our services, you acknowledge that you have read and understood this Policy. Where consent is required as the legal basis for processing, your explicit consent will be sought at the relevant point of data collection.

Malaysian Users: Malaysia's Personal Data Protection Act 2010 (PDPA) governs the processing of personal data in commercial transactions by persons established in Malaysia. While daya138 operates under international licensing, we are committed to handling your personal data in a manner consistent with recognised data protection principles, including those reflected in the PDPA.

Section 02

Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

Term	Meaning
"Personal Data"	Any information relating to an identified or identifiable natural person — including name, contact details, payment information, device identifiers, and behavioural data generated through Platform use.
"Processing"	Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, alteration, or deletion.
"Data Controller"	daya138, as the entity that determines the purposes and means of processing your personal data.
"Data Processor"	A third-party service provider who processes personal data on behalf of daya138, subject to contractual data processing obligations.
"KYC Data"	Identity and verification documents provided during the Know Your Customer process, including government-issued ID, proof of address, and payment method documentation.
"Cookies"	Small text files placed on your device by the Platform to facilitate session management, analytics, and personalisation.
"Sensitive Data"	Categories of personal data that warrant heightened protection, including financial information, identity documents, and data relating to gambling behaviour.

Section 03

Data We Collect

daya138 collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from third-party verification services used for KYC and fraud prevention.

3.1 Registration & Account Data

Full legal name
Date of birth (required to verify 21+ age eligibility)
Email address
Mobile phone number
Residential address (city, state, postcode — Malaysian addresses accepted in standard format)
Username and encrypted password
Preferred language and currency (default: MYR)

3.2 KYC & Verification Data

Copy of government-issued photo identification (Malaysian MyKad, passport, or equivalent)
Proof of residential address (utility bill, bank statement, or similar document dated within 3 months)
Payment method documentation (screenshot or partial statement confirming ownership of linked bank account, e-wallet, or cryptocurrency wallet)

3.3 Transaction & Financial Data

Deposit and withdrawal amounts, dates, and associated payment method identifiers
Transaction reference numbers generated by DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency networks
Account balance history
Bonus and promotional credit activity

3.4 Gaming & Behavioural Data

Game session records including game type, stakes, outcomes, and duration
Sports betting selections, odds accepted, and bet settlement data
Session frequency, average session duration, and deposit patterns — used for responsible gambling monitoring
Live chat and support communication transcripts

3.5 Technical & Device Data

IP address and approximate geographic location derived therefrom
Device type, operating system, browser type and version
Pages visited, time on page, referral source, and navigation paths within the Platform
Cookie identifiers and session tokens

Section 04

How We Use Your Data

daya138 processes personal data for the following specific and documented purposes:

Purpose	Data Used	Legal Basis
Account creation & management	Registration data, contact details	Contract performance
Identity & age verification (KYC)	KYC documents, date of birth	Legal obligation
Processing deposits & withdrawals	Transaction data, payment method details	Contract performance
Fraud prevention & AML compliance	Financial data, IP address, device data	Legal obligation / legitimate interest
Responsible gambling monitoring	Gaming behaviour, deposit patterns	Legal obligation / legitimate interest
Customer support delivery	Account data, communication records	Contract performance
Promotional communications (opted-in)	Email, contact details	Consent
Platform analytics & improvement	Technical and behavioural data	Legitimate interest
Security & abuse prevention	IP address, device identifiers	Legitimate interest

Marketing Communications: If you have opted in to receive promotional communications from daya138, you may withdraw that consent at any time by contacting [email protected] or by using the unsubscribe mechanism included in each communication. Withdrawal of marketing consent does not affect the lawfulness of prior processing.

Section 05

Legal Basis for Processing

daya138 relies on the following legal bases to process personal data, consistent with internationally recognised data protection frameworks:

Contract Performance: Processing necessary to perform our obligations under the Player Account agreement, including service delivery, payment processing, and account administration.
Legal Obligation: Processing required to comply with applicable law, including anti-money laundering obligations, age verification requirements, and data retention mandates under licensing conditions.
Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — provided such interests are not overridden by your rights and freedoms.
Consent: Processing for purposes where we have obtained your explicit consent, including direct marketing communications. Consent may be withdrawn at any time without affecting prior processing.

Section 06

Data Sharing & Disclosure

daya138 does not sell your personal data to third parties. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to contractual confidentiality obligations:

Payment Service Providers: DuitNow, FPX network banks (Maybank, CIMB, Public Bank, Hong Leong, RHB), Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency processing partners — for the purpose of completing financial transactions only.
Identity Verification Services: Third-party KYC and document verification providers engaged to authenticate player identity and verify age in accordance with regulatory requirements.
Game Content Providers: Licensed game studios (including but not limited to Evolution Gaming, Pragmatic Play, and PG Soft) may receive anonymised session data for game integrity purposes. Full personally identifiable information is not shared with game providers.
Fraud Prevention & AML Services: Specialist providers engaged for transaction monitoring, IP analysis, and suspicious activity detection.
IT Infrastructure Providers: Cloud hosting and data storage providers operating under strict data processing agreements.
Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or the lawful request of competent regulatory authorities — disclosure will be made to the minimum extent required.

No Unauthorised Onward Transfer: All third parties who receive personal data from daya138 are contractually prohibited from using that data for any purpose other than the specific service they have been engaged to provide.

Section 07

Cookies & Tracking Technologies

daya138 uses cookies and similar tracking technologies to operate the Platform efficiently, maintain your session, and understand how the Platform is used. The following categories of cookies are in use:

Cookie Type	Purpose	Retention
Strictly Necessary	Essential for Platform functionality including login session maintenance, security tokens, and language preference storage. Cannot be disabled.	Session / up to 30 days
Performance / Analytics	Aggregate data on page visits, feature usage, and navigation paths. Used to improve Platform design and responsiveness. No individual player identification.	Up to 12 months
Functional	Remembers your preferences such as preferred language, currency display, and notification settings to personalise your experience.	Up to 12 months
Responsible Gambling	Tracks session duration and deposit frequency locally to support the reality check and session limit features. Data is processed on-device where possible.	Session

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent normal Platform functionality. Disabling analytics and functional cookies will not prevent access to the Platform but may reduce personalisation quality.

Section 08

Data Retention

daya138 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any overriding legal or regulatory retention obligations. The following retention schedule applies:

Account and Registration Data: Retained for the duration of your active account, plus 5 years following account closure, to satisfy anti-money laundering record-keeping requirements.
KYC Documentation: Retained for 5 years from the date of last activity or account closure, whichever is later — consistent with standard AML/CTF retention obligations.
Transaction Records: Retained for 7 years from the date of each transaction in accordance with financial record-keeping standards.
Gaming Session Logs: Retained for 3 years from the date of each session for dispute resolution and responsible gambling audit purposes.
Support Communication Records: Retained for 2 years from the date of the last communication in a given thread.
Marketing Consent Records: Retained from the date of consent until withdrawal, plus 1 year thereafter as evidence of prior consent.
Technical & Log Data: Retained for up to 12 months for security and abuse prevention purposes, then deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using industry-standard data sanitisation processes.

Section 09

Your Rights

Subject to applicable law and certain regulatory limitations, you have the following rights in relation to the personal data daya138 holds about you:

Right of Access

Request a copy of the personal data we hold about you, together with information about how it is being processed.

Right to Rectification

Request correction of inaccurate or incomplete personal data. For KYC data, updated documentation will be required.

Right to Erasure

Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.

Right to Restriction

Request that we restrict processing of your data in certain circumstances — for example, while the accuracy of the data is being contested.

Right to Portability

Request a structured, machine-readable copy of the personal data you have provided to us, where technically feasible.

Right to Object

Object to processing based on legitimate interests, including profiling for marketing purposes. You may also withdraw marketing consent at any time.

To exercise any of the above rights, please contact us at [email protected] with the subject line "Data Rights Request" and your registered account email address. We will acknowledge your request within 5 business days and provide a substantive response within 30 days. Where a request is complex or numerous, we may extend this period by a further 30 days with prior notice.

Limitations on Erasure: The right to erasure is subject to overriding legal and regulatory retention obligations. Where we are required to retain your data by law — for example, AML transaction records — we will retain that data for the legally mandated period and restrict its use to compliance purposes only.

Section 10

Data Security

daya138 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, but are not limited to:

256-bit SSL/TLS encryption for all data transmitted between your device and Platform servers
AES-256 encryption at rest for all sensitive data fields including passwords, KYC documents, and financial records
Role-based access controls ensuring that staff access to personal data is limited to what is strictly necessary for their specific function
Multi-factor authentication required for all internal staff access to data processing systems
Regular penetration testing and vulnerability assessments conducted by independent security specialists
Automated intrusion detection and 24/7 security monitoring of all platform infrastructure
Formal data breach response procedure with a target notification timeline of 72 hours for material breaches

While daya138 takes all reasonable precautions, no online system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect any unauthorised access.

Section 11

Minors & Age Policy

The daya138 Platform is strictly intended for persons aged 21 years and above. The Platform does not knowingly collect personal data from persons under the age of 21. Registration by minors is expressly prohibited and constitutes a violation of our Terms and Conditions.

Age verification is conducted as part of the KYC process. Where we discover or have reasonable grounds to suspect that a registered player is under 21 years of age, we will immediately suspend the account, initiate a review, and where confirmed, close the account and return deposited funds net of any bonuses claimed. Personal data of underage players will be deleted from our systems as soon as the review is complete, except where retention is required to document the incident for compliance purposes.

Parental Notice: If you believe that a person under 21 in your household has registered on daya138, please contact us at [email protected] immediately. We will act on all such reports promptly and with full confidentiality.

Section 12

International Data Transfers

As an internationally operated platform, daya138 may transfer personal data to servers or service providers located outside Malaysia. Where personal data is transferred to jurisdictions that may not offer the same level of data protection as Malaysia, we implement appropriate safeguards to ensure that the transfer is lawful and that your data remains protected, including:

Standard contractual clauses incorporated into data processing agreements with recipient entities
Technical and organisational security measures aligned with international best practice
Restrictions on further onward transfer by recipient entities

By using the Platform, you acknowledge that your personal data may be transferred, stored, and processed in jurisdictions outside Malaysia. We will at all times ensure that such transfers are conducted in compliance with applicable data protection obligations.

Section 13

Third-Party Services

The Platform may contain references to third-party services or products — for example, payment method brands such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, Maybank, CIMB, Public Bank, and Hong Leong. These references are for informational purposes only. daya138 is not responsible for the privacy practices of any third-party service provider, and this Policy applies solely to data processing conducted by daya138.

Where you interact with third-party payment services to complete a deposit or withdrawal, your data submitted to those services is governed by the privacy policy of the respective provider. We strongly encourage you to review the privacy policies of any third-party services you use in connection with your daya138 account.

Section 14

Policy Amendments

daya138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where material changes are made, registered players will be notified via the email address associated with their account no less than 14 days before the changes take effect.

The date of the most recent revision to this Policy will always be displayed at the top of this page. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree with the amended Policy, you should contact us to discuss account closure prior to the effective date.

Section 15

Contact & Data Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by daya138, please contact us through the following channels:

Email: [email protected] — use subject line "Privacy / Data Rights Request"
Live Chat: Available 24/7 directly on the Platform
Response SLA: Acknowledgement within 5 business days; substantive response within 30 days
Support Languages: English, Bahasa Melayu, 中文

For matters relating to our Terms and Conditions, please refer to our Terms & Conditions page. For responsible gambling concerns, including self-exclusion and deposit limit requests, please visit our Responsible Gambling page. For general platform questions, our FAQ page covers a broad range of common topics.