Privacy Policy

This Privacy Policy ("Policy") is issued by Satset138 ("we", "us", "our", "the Platform") and governs the collection, processing, storage and disclosure of personal data relating to individuals ("User", "you", "your") who access or register on the Satset138 website located at https://satset138.cam and any associated services offered under the Satset138 brand.

Satset138 operates as an online gaming platform serving Malaysian users. In the course of providing casino entertainment, sports betting markets and related services, Satset138 necessarily collects and processes personal data. We are committed to doing so transparently, proportionately and in accordance with recognised data protection principles.

By accessing the Platform, creating an account or submitting any personal information to Satset138, you acknowledge that you have read and understood this Policy. If you do not agree with the terms set out in this document, you must discontinue use of the Platform. This Policy should be read alongside the Satset138 Terms and Conditions, which form part of the overall agreement governing your use of the Platform.

For the purposes of this Policy, the following definitions apply:

Satset138 collects the following categories of personal data in connection with the operation of the Platform:

Satset138 does not intentionally collect sensitive personal data — such as racial or ethnic origin, political opinions, religious beliefs or health information — except where such data is incidentally provided by a User through identity documents or communications. Any such data will be handled with commensurate care and used solely for the purposes stated in this Policy.

Satset138 collects personal data through the following channels and mechanisms:

• Direct submission: Data provided by the User during account registration, KYC document upload, payment processing, contact form completion or support interactions.
• Automated technical collection: Technical data gathered automatically when a User accesses the Platform, including IP addresses, device identifiers, session logs and cookie-based tracking as described in Section 10 of this Policy.
• Third-party data providers: Identity verification and fraud-screening services may supply supplementary information used to confirm the accuracy of User-provided data during KYC assessment.
• Payment processors: Information shared by e-wallet operators, online banking services and cryptocurrency-related processors in connection with deposit and withdrawal transactions denominated in MYR or cryptocurrency equivalent.
• Gaming content providers: Session and game-outcome data transmitted from third-party casino and sports-betting content suppliers in connection with active gameplay.

Satset138 processes personal data for the following purposes:

• Account management: Creating, maintaining and securing User accounts, including authentication, password management and account communication.
• Identity verification (KYC): Confirming that each User is who they claim to be and is eligible to use the Platform under the eligibility criteria set out in the Terms and Conditions, including the minimum age requirement of 21 years.
• Payment processing: Facilitating MYR deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong and cryptocurrency channels.
• Gaming operations: Enabling participation in casino games, sports betting markets and live dealer tables; recording game outcomes and maintaining transaction integrity.
• Fraud prevention and security: Detecting, investigating and preventing fraudulent activity, money laundering, unauthorised account access and bonus abuse.
• Responsible gambling: Monitoring account behaviour to identify potential indicators of problem gambling; applying and enforcing deposit limits, cooling-off periods and self-exclusion as requested or required.
• Customer support: Responding to User enquiries, resolving disputes and maintaining records of support interactions for quality assurance purposes.
• Legal and regulatory compliance: Meeting obligations imposed by applicable laws, responding to lawful requests from competent authorities and maintaining audit records.
• Platform improvement: Analysing aggregated and anonymised usage data to improve the Satset138 user experience, technical performance and service offering.
• Promotional communications: Where a User has consented to marketing communications, sending relevant offers, bonus announcements and service updates by email or notification.

Satset138 does not process personal data for automated decision-making that produces legal or similarly significant effects without human review, except where explicitly disclosed and consented to by the User in connection with fraud-screening or identity verification.

Satset138 processes personal data on one or more of the following lawful bases:

• Contractual necessity: Processing is required to enter into and perform the contract constituted by the Satset138 Terms and Conditions, including account creation, payment processing, KYC verification and gaming operations.
• Legal obligation: Processing is necessary to comply with applicable legal and regulatory requirements, including anti-money laundering obligations, responsible gambling mandates and record-keeping rules.
• Legitimate interests: Processing is necessary for Satset138's legitimate business interests, including fraud prevention, platform security, abuse detection and service improvement, provided those interests are not overridden by the User's rights and interests.
• Consent: Processing is based on the User's freely given, specific and informed consent, primarily in the context of optional marketing communications. Users may withdraw consent at any time by contacting the Satset138 support team.

Satset138 does not sell, rent or trade personal data to third parties for commercial purposes. Personal data may, however, be disclosed in the following circumstances:

• Service providers: Satset138 engages trusted third-party processors — including identity verification services, payment processors, gaming content suppliers and technical infrastructure providers — who process personal data strictly on Satset138's behalf and in accordance with applicable data protection principles.
• Fraud and compliance partners: Satset138 may share data with fraud-prevention databases, industry shared intelligence networks or compliance service providers where necessary to investigate suspected financial crime or Terms and Conditions violations.
• Regulatory and law enforcement authorities: Satset138 will disclose personal data where required to do so by applicable law, court order, regulatory directive or lawful request from a competent public authority. Satset138 will not disclose data beyond the minimum necessary to comply with such requirements.
• Business restructuring: In the event of a merger, acquisition, asset transfer or similar corporate restructuring involving Satset138, personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection commitments.

Where personal data is shared with third-party processors, Satset138 maintains written data processing agreements with those parties requiring them to apply appropriate technical and organisational security measures and to process data only for the purposes specified by Satset138.

Satset138 retains personal data for as long as is necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law. The following general retention principles apply:

• Active account data: Retained for the full duration of the User's active account relationship with Satset138.
• KYC and identity documents: Retained for a minimum of five years following account closure, consistent with standard anti-money laundering record-keeping expectations.
• Financial transaction records: Retained for a minimum of seven years following the date of each transaction for accounting and regulatory compliance purposes.
• Support and communication records: Retained for a minimum of three years following the date of the relevant interaction to support dispute resolution and quality assurance.
• Marketing preferences and consent records: Retained for the duration of the relevant consent plus a reasonable period thereafter to demonstrate the basis on which communications were sent.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification. Where data cannot be immediately deleted due to technical constraints, it will be isolated from active processing pending secure deletion.

Satset138 implements and maintains appropriate technical and organisational security measures designed to protect personal data against accidental loss, unauthorised access, disclosure, alteration or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between the User's device and the Satset138 platform.
• Encrypted storage of sensitive personal data, including financial information and KYC documents, at rest.
• Access control policies restricting access to personal data to authorised personnel who have a legitimate operational need.
• Two-factor authentication options for User account access to reduce the risk of unauthorised login.
• Regular internal security assessments and technical reviews of the Platform's infrastructure.
• Staff confidentiality obligations and data protection awareness requirements for all employees with access to User personal data.

Whilst Satset138 takes all reasonable precautions, no internet-based system can be guaranteed to be entirely free from security vulnerabilities. Users are encouraged to protect their account credentials, use unique passwords and report any suspected unauthorised account activity to the Satset138 support team immediately.

Satset138 uses cookies and similar tracking technologies to operate the Platform effectively, maintain session continuity and improve the User experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, security cookies and load-balancing identifiers. These cookies cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember User preferences such as language settings, display configurations and responsible gambling tool states. Disabling these cookies may reduce the personalised experience.
• Analytics cookies: Used to collect aggregated and anonymised data about how visitors use the Platform, enabling Satset138 to identify performance issues and improve navigation. Analytics data does not identify individual Users.
• Marketing cookies: Used, where User consent has been given, to deliver relevant promotional information within the Platform. Marketing cookies are not used to transmit personal data to third-party advertising networks.

Users may manage cookie preferences through their browser settings. Blocking all cookies may prevent certain Platform features from operating correctly. Where applicable, Satset138 will seek your consent before placing non-essential cookies on your device.

As a User of the Satset138 platform, you hold the following rights with respect to your personal data. To exercise any of these rights, please contact the Satset138 support team using the details set out in Section 15 of this Policy.

Satset138 will endeavour to respond to data subject requests within 30 calendar days of receipt. In complex cases or where a large volume of requests is received simultaneously, the response period may be extended by a further 30 days with prior notification to the requesting User. Satset138 will not charge a fee for responding to routine data subject requests.

Satset138 is strictly intended for adults aged 21 years and above. The Platform does not knowingly collect, process or store personal data belonging to individuals below the age of 21. Access by or on behalf of minors is expressly prohibited.

If Satset138 discovers or has reasonable grounds to believe that personal data has been collected from a person below the age of 21, the relevant account will be immediately suspended, all associated data reviewed, and any deposits returned through the original payment method subject to applicable verification and anti-money laundering procedures.

The Satset138 Platform integrates services provided by third-party partners, including gaming content suppliers, payment processors, identity verification providers and customer support infrastructure. These third parties may process personal data in the course of delivering their respective services to Satset138.

Satset138 does not include external links to third-party websites on the Platform for browsing purposes. However, payment gateway interfaces may redirect Users to their respective banking or e-wallet environments — such as the Maybank2u or CIMB Clicks online banking portal, or the Touch 'n Go eWallet app — to complete transaction authorisation. Satset138 does not control the privacy practices of those external environments and recommends that Users review the privacy policies of their chosen payment providers independently.

Satset138 is not responsible for the data handling practices of third-party services that Users access independently of the Platform. This Policy applies solely to data processing conducted by Satset138 in connection with the Platform's operation.

Satset138 reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, Platform functionality, data processing practices or industry standards. Material changes that significantly affect Users' rights or the ways in which their data is processed will be communicated to registered Users by email or in-platform notice where operationally feasible.

All revisions will be reflected in an updated effective date at the top of this page. Users are encouraged to review this Policy periodically to remain informed about how their personal data is handled. Continued use of the Platform following any amendment constitutes acceptance of the revised Policy.

If you have questions about this Privacy Policy, wish to exercise any of your data subject rights, or have concerns about the way in which Satset138 handles your personal data, please contact us through the following channels. All contact details are provided as plain text only and are not clickable links or hyperlinks.

• Email: support@satset138.cam (plain text — not a clickable link)
• Live Chat: Available 24 hours a day, 7 days a week through the Satset138 platform. Average response time is under 5 minutes during standard operating hours.
• Support Languages: English, Bahasa Melayu, 中文

Satset138 aims to acknowledge all privacy-related enquiries within 2 business hours and to provide a substantive response within 14 calendar days. For complex requests such as subject access requests or erasure applications, the response period may extend to 30 calendar days as described in Section 11 of this Policy.

Users who are not satisfied with Satset138's response to a privacy concern are encouraged to escalate the matter in writing to the support team, requesting escalation to a senior review. Satset138 treats all privacy complaints with seriousness and will make every reasonable effort to resolve concerns fairly.