Luxury138 Privacy Policy –
Malaysian Personal Data Protection

This Privacy Policy ("Policy") is published by Luxury138 ("We", "Platform") and applies to all individuals who use, register with, or access the Luxury138 platform at https://luxury138.ws, including all subpages, mobile applications, and related services.

Luxury138 recognises that personal data is both highly valuable and sensitive. We take a responsible and transparent approach to everything involving the handling of your personal information. This Policy has been drafted in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international industry best practices.

By using the Luxury138 platform, you consent to the collection and use of your personal data as described in this Policy. If you do not agree, please discontinue use of our platform.

Luxury138 collects several categories of personal data depending on how you interact with our platform. Below is a summary of the data we collect:

Luxury138 collects personal data through the following channels:

• Account Registration: When you register as a luxury138 member, we collect basic information such as your name, email address, and phone number.
• Identity Verification (KYC): To process withdrawals exceeding RM5,000 or as a security measure, we may request a copy of your identification card or other supporting documents.
• Financial Transactions: Every time you make a deposit via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, our system records the transaction details.
• Platform Usage: Technical and usage data are collected automatically through cookies, server logs, and similar tracking technologies.
• Communications: When you contact the Luxury138 support team via Live Chat or email, a record of that communication is retained.
• Promotions & Contests: If you participate in any Luxury138 promotions or contests, the information you provide will be collected.

Luxury138 uses the personal data we collect solely for legitimate and necessary purposes. We never use your data for anything unrelated to our services. The primary purposes for which we use data include:

• Creating and managing your member account on the Luxury138 platform.
• Processing deposits and withdrawals in MYR via your preferred payment method.
• Verifying your identity to fulfil anti-money laundering (AML) and know-your-customer (KYC) legal requirements.
• Providing effective customer support and addressing your enquiries or complaints.
• Personalising your platform experience — including relevant game recommendations such as slots, Live Casino, badminton betting, or e-sports based on your gaming habits.
• Sending you promotional notifications, bonuses, and exclusive Luxury138 offers (with your consent).
• Monitoring for fraudulent activity and ensuring platform security.
• Complying with applicable legal and regulatory obligations.
• Conducting internal analysis to improve Luxury138's services and user experience.

Luxury138 does not sell, rent, or trade your personal data to third parties. However, in certain limited circumstances, we may need to share your personal data with the following categories of third parties:

• Payment Service Providers: Required transaction information is shared with providers such as Touch 'n Go eWallet, GrabPay, DuitNow, and FPX providers to securely process your transactions.
• Game Software Providers: Minimal technical data required to operate the games is shared with licensed third-party software providers.
• Authorities & Regulatory Bodies: We will disclose required information to Malaysian legal authorities where mandated by law or court order.
• IT Service Providers: Server hosting and cybersecurity providers bound by strict confidentiality agreements.

All third parties we work with are required to comply with privacy standards equivalent to or stricter than those of Luxury138, and they are prohibited from using your data for any purpose other than those specified.

Luxury138 employs a combination of technology, procedures, and organisational controls to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our key security measures include:

• Data in Transit Encryption: All data transmitted between your device and Luxury138's servers is encrypted using TLS 1.3 protocol with a 256-bit SSL certificate.
• Storage Encryption: Sensitive data stored in our databases is encrypted using AES-256 encryption.
• Layered Access Controls: Access to members' personal data is restricted to staff who require it to perform their duties only (principle of least privilege).
• Two-Factor Authentication (2FA): You can enable 2FA on your Luxury138 account for an additional layer of protection.
• 24/7 Security Monitoring: Our cybersecurity team monitors all system activity around the clock and responds immediately to any threats.
• Regular Security Audits: Luxury138 conducts regular external security audits carried out by qualified, independent cybersecurity firms.

Luxury138 uses cookies and similar tracking technologies to enhance the user experience and platform security. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions — including login, gaming sessions, and transaction processing. These cookies cannot be disabled.
• Performance Cookies: Helps us understand how users interact with the platform for improvement purposes. This data is collected in aggregate and anonymised form.
• Functional Cookies: Remembering your preferences such as language, display settings, and favourite game selections.
• Security Cookies: Used to detect unauthorised access attempts and protect your account.

You can manage your cookie settings through your web browser. However, disabling essential cookies may affect the functionality of the Luxury138 platform. For more information on managing cookies, please refer to your web browser's documentation.

In the course of its operations, Luxury138 may transfer your personal data to servers or storage facilities located outside Malaysia. Any such transfer will be carried out with adequate safeguards to ensure your data remains secure and protected to a standard equivalent to that provided under Malaysia's PDPA 2010.

Luxury138 only transfers data to countries or regions with adequate data protection laws, or through safeguard mechanisms such as data processing agreements that comply with international standards.

Luxury138 retains your personal data only for as long as necessary to fulfil the purposes set out in this Policy, or as required by applicable law.

• Active Account Data: Retained for the duration your account is active on Luxury138, plus 5 years following account closure (to meet AML legal requirements).
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysian financial regulations.
• Communication Logs: Customer support communication records are retained for 3 years for reference and service improvement purposes.
• Marketing Data: Retained until you withdraw your consent or request deletion.

Upon expiry of the designated retention period, your personal data will be securely deleted or anonymised in accordance with security-standard deletion procedures.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have a number of rights regarding the personal data Luxury138 holds about you. We are committed to respecting and facilitating the exercise of these rights:

To exercise any of the rights above, please contact our data protection team at privacy@luxury138.ws or via Live Chat. We will process your request within 30 business days.

The Luxury138 platform is strictly for individuals aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18.

If we discover that we have collected personal data from someone under the age of 18, we will take immediate steps to delete that data and close the account in question. Parents or guardians who suspect their child has registered on Luxury138 should contact us immediately at support@luxury138.ws.

Luxury138 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements.

You will be notified of any material amendments via an in-platform notification or by email to your registered address at least 14 days before the changes take effect. For minor amendments that do not materially affect your rights, we may update only the "Last Updated" date at the top of this document.

Your continued use of the Luxury138 platform after any amendments take effect will be considered your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by Luxury138, please reach out to us through the following channels:

• Privacy & Data Email: privacy@luxury138.ws — for personal data rights requests, privacy complaints, and policy enquiries.
• General Support Email: support@luxury138.ws — for general enquiries related to your account and services.
• Live Chat: Available 24/7 within the Luxury138 platform for immediate assistance.

Luxury138's data protection team will acknowledge privacy-related requests within 3 business days and fully resolve data requests within 30 business days, in line with the requirements of Malaysia's PDPA 2010.