1. Introduction
Dewi138 ("we", "us", "our" or the "Company") operates the online gaming platform accessible at dewi138.cam (the "Platform"). This Privacy Policy describes how we collect, process, store, share and safeguard the personal data of users ("you", "your" or the "User") who register, access or use any service available on the Platform.
We serve players located across Malaysia — including those based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and other cities and states — and we take our obligations in relation to the privacy and security of your personal data seriously. This Policy is written in plain, accessible English so that all users can clearly understand how their data is handled.
By creating an Account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of how we process your data, you should not use the Platform and should contact us to close your Account.
Scope: This Policy applies to all personal data collected through the Platform, including data collected during registration, KYC verification, deposits and withdrawals via Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank), live support interactions and promotional programme participation.
2. Definitions
The following definitions apply throughout this Privacy Policy:
| Term | Definition |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial information and online identifiers. |
| Processing | Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure or destruction, whether by automated or manual means. |
| Data Controller | Dewi138, the entity that determines the purposes and means of processing your personal data. |
| Data Processor | A third party that processes personal data on behalf of Dewi138, under written instruction and subject to contractual obligations. |
| KYC | Know Your Customer — the identity verification process requiring submission of government-issued identification documents. |
| Consent | A freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for a stated purpose. |
| Cookie | A small text file placed on your device by the Platform that stores information about your session, preferences or browsing behaviour. |
3. Personal Data We Collect
3.1 Data You Provide Directly
When you register an Account, complete KYC verification or interact with our Platform, you may provide us with the following categories of personal data:
- Identity Data: Full legal name, date of birth, gender, nationality, MyKad number or passport number;
- Contact Data: Email address, mobile phone number, residential address (including Malaysian state and city);
- Financial Data: Bank account details, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), DuitNow transfer reference information, and transaction history on the Platform;
- Verification Documents: Copies of your MyKad, passport or other government-issued identification, utility bills, and bank statements provided for KYC purposes;
- Account Data: Username, password (stored in encrypted form only), security question answers, two-factor authentication settings.
3.2 Data Collected Automatically
When you access or use the Platform, we automatically collect certain technical and behavioural data, including:
- IP address and approximate geographic location;
- Device type, operating system, browser type and version;
- Session duration, pages visited, betting and gaming activity, and click-stream data;
- Login timestamps and frequency of access;
- Referral source (how you arrived at the Platform).
3.3 Data from Third Parties
We may receive personal data about you from third-party sources in the following circumstances:
- Payment processors and Malaysian e-wallet providers confirming transaction status;
- Identity verification and fraud prevention service providers used during KYC;
- Responsible gambling self-exclusion registers, where you have registered a voluntary exclusion that extends to online gaming platforms;
- Referral partners, where you have been referred to dewi138 under an affiliate or player referral programme.
4. Purpose of Processing
We process your personal data for the following specific purposes:
| Purpose | Description |
|---|---|
| Account Management | Creating, managing and securing your Account on the Platform, including authentication and password recovery. |
| KYC Verification | Verifying your identity and age (21+) in compliance with our licensing obligations and anti-money laundering requirements. |
| Transaction Processing | Processing deposits and withdrawals via Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, USDT, BTC and other supported payment methods. |
| Fraud Prevention & AML | Detecting and investigating suspicious activity, money laundering attempts and fraudulent transactions on the Platform. |
| Customer Support | Responding to your queries, complaints and support requests via live chat and email. |
| Responsible Gambling | Monitoring for signs of problem gambling, enforcing deposit limits and self-exclusion requests, and contacting you if our responsible gambling tools indicate a potential concern. |
| Marketing & Promotions | Sending you information about bonuses, promotions and Platform updates where you have provided consent. You may withdraw consent at any time. |
| Platform Analytics | Improving Platform performance, game offerings, user interface design and support quality based on aggregated, anonymised usage data. |
| Legal Compliance | Fulfilling obligations under our international gaming licence, responding to lawful requests from regulatory authorities, and maintaining required financial records. |
5. Legal Basis for Processing
We process your personal data on the following legal grounds, depending on the specific purpose of processing:
- Contractual Necessity: Processing that is necessary to fulfil the contract between you and Dewi138, including operating your Account and processing financial transactions;
- Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC verification, anti-money laundering obligations and record-keeping requirements under our gaming licence;
- Legitimate Interests: Processing carried out to pursue the Company's legitimate interests in fraud prevention, platform security, responsible gambling monitoring and improving our services, where such interests are not overridden by your rights and interests;
- Consent: Processing based on your specific consent, including sending direct marketing communications. Where consent is the legal basis, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.
6. Data Sharing & Disclosure
6.1 Service Providers (Data Processors)
We share your personal data with third-party service providers who act as Data Processors under written contracts that restrict their use of your data to specified purposes only. These include:
- Payment processing providers facilitating transactions via DuitNow, FPX, Touch 'n Go eWallet and other Malaysian payment networks;
- Identity verification and KYC service providers;
- Cloud hosting and data storage infrastructure providers;
- Customer support platform operators;
- Fraud detection and cyber-security service providers;
- Audit and compliance consultants operating under confidentiality obligations.
6.2 Regulatory and Legal Disclosure
We may disclose your personal data to competent regulatory authorities, law enforcement agencies or courts where required by applicable law, court order, or where we have a good-faith belief that disclosure is necessary to protect our rights, prevent fraud, or protect the safety of our users. We will notify you of any such disclosure where legally permitted to do so.
6.3 Business Transfers
In the event of a merger, acquisition, sale of assets or corporate restructuring involving Dewi138, your personal data may be transferred to the acquiring or resulting entity. You will be notified in advance of any such transfer and of any material change to how your data will be processed as a result.
We do not sell your data. Dewi138 does not sell, rent, trade or otherwise transfer your personal data to any third party for commercial marketing purposes. This is a firm policy and not simply a legal disclaimer.
7. Data Retention
We retain your personal data for no longer than is necessary for the purpose for which it was collected, taking into account our legal and regulatory obligations. The following indicative retention periods apply:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of Account + 5 years post-closure | KYC and AML compliance obligations |
| KYC verification documents | 5 years from submission date | Regulatory record-keeping requirements |
| Financial transaction records | 7 years from transaction date | Financial reporting and audit obligations |
| Customer support communications | 3 years from last interaction | Dispute resolution and quality management |
| Marketing consent records | Until consent is withdrawn + 1 year | Proof of consent for compliance purposes |
| Technical logs and session data | 90 days from collection | Security monitoring and fraud detection |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with you as an individual.
8. Security Measures
Dewi138 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These measures include:
- Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data transmitted between your device and our servers;
- Access Controls: Role-based access controls ensuring that personal data is only accessible to staff and systems with a demonstrated operational need;
- Two-Factor Authentication: Available and encouraged for all user Accounts; mandatory for administrative access to internal systems;
- Intrusion Detection: 24/7 automated monitoring for suspicious access patterns, brute-force attempts and anomalous activity;
- Penetration Testing: Regular independent security assessments of our infrastructure and Platform code;
- Vendor Security Reviews: All third-party service providers are assessed for security compliance before engagement and subject to ongoing monitoring.
Despite these measures, no transmission of data over the internet can be guaranteed to be completely secure. You are responsible for maintaining the security of your own Account credentials. If you suspect that your Account has been compromised, please contact our support team immediately via live chat.
9. Cookies & Tracking Technologies
9.1 Types of Cookies Used
We use the following categories of cookies and similar tracking technologies on the Platform:
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Session management, authentication, security tokens, fraud prevention. Essential for the Platform to function. | No — required for basic functionality |
| Functional | Remembering your preferences (language, currency display, notification settings) between sessions. | Yes — via browser settings |
| Analytics | Aggregated, anonymised data on how users navigate the Platform, used to improve performance and user experience. | Yes — via cookie preferences |
| Marketing | Tracking which promotions you have viewed or engaged with, to avoid showing you the same offer repeatedly. No data is passed to external advertising networks. | Yes — via cookie preferences |
9.2 Managing Your Cookie Preferences
You can control non-essential cookies through your browser settings or our cookie preference tool. Disabling certain cookies may affect the functionality of the Platform. Instructions for managing cookies in popular browsers (Chrome, Firefox, Safari, Edge) are available through those browsers' help documentation.
10. Protection of Minors
Dewi138 is an adult-only platform strictly limited to users aged 21 and above. We do not knowingly collect, store or process the personal data of any person under the age of 21. All new registrations are subject to age verification as part of the KYC process.
If we become aware that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant Account, delete all associated personal data and, where applicable, refer the matter to appropriate authorities in accordance with our child protection obligations.
🔞 If you believe a minor has registered on our Platform using false information, please contact our support team immediately at [email protected] (plain text — not a clickable link) or via 24/7 live chat. We take this matter extremely seriously.
11. International Data Transfers
Dewi138 operates under an international gaming licence and some of our service providers are located in countries outside of Malaysia. As a result, your personal data may be transferred to and processed in countries that do not have data protection laws equivalent to those in your country of residence.
Where such transfers are necessary, we ensure that appropriate safeguards are in place, including:
- Contractual clauses requiring the recipient to protect personal data to a standard equivalent to the protections in this Policy;
- Technical security measures (encryption, access controls) applied to all data regardless of where it is processed;
- Regular security assessments of international data processors.
By using the Platform, you acknowledge and consent to the transfer of your personal data to our international service providers under the safeguards described in this section.
12. Your Data Rights
As a user of the dewi138 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details set out in Section 14.
Request a copy of all personal data we hold about you. We will respond within 30 calendar days.
Request correction of inaccurate or incomplete personal data held on your Account.
Request deletion of your personal data where it is no longer necessary, subject to our legal retention obligations.
Request that we temporarily halt processing of your data in certain circumstances, such as while a rectification request is under review.
Request a structured, machine-readable copy of personal data you have provided to us, where processing is based on consent or contract.
Object to processing based on legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling grounds.
Withdraw previously given consent for processing (e.g., marketing emails) at any time, without affecting prior lawful processing.
Lodge a complaint with the relevant data protection authority in your jurisdiction if you are not satisfied with how we have handled your data rights request.
Processing Time: We aim to respond to all data rights requests within 30 calendar days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and reason within the initial 30-day period. There is no charge for exercising your rights, unless a request is manifestly unfounded or excessive.
13. Changes to This Privacy Policy
Dewi138 reserves the right to update or revise this Privacy Policy at any time. We will notify you of material changes by posting a notice on the Platform and, where appropriate, sending an email notification to your registered address at least 14 days before the changes take effect.
The "Last Updated" date shown at the top of this page reflects the date of the most recent revision. Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not accept the revised terms, you must discontinue use of the Platform and close your Account.
Previous versions of this Policy are available on request by contacting our support team.
14. Contact Us & Data Protection Enquiries
If you wish to exercise any of your data rights, have a question about how we handle your personal data, or wish to raise a concern or complaint, please contact us through the following channels:
Live Chat Support (Fastest): Available 24/7 through the Platform. For urgent privacy matters, live chat ensures the quickest response.
Email: [email protected] — for formal data rights requests and written correspondence. Please mark the subject line clearly as "Privacy Request" or "Data Rights Enquiry". Allow up to 2 business days for initial acknowledgement and up to 30 calendar days for full resolution.
Data Rights Requests: When submitting a data access, rectification, erasure or portability request, please include your registered username, the email address associated with your Account, and a clear description of your request. We may need to verify your identity before processing the request to protect against fraudulent claims.
Effective Date: This Privacy Policy is effective as of 1 January 2026.
Dewi138 is committed to resolving privacy-related concerns promptly and fairly. If you are not satisfied with our response to a data rights request or privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction.