Privacy Policy — How Bro138 Protects Your Personal Data

This Privacy Policy ("Policy") is issued by Bro138 ("we", "us", "our", "the Company", "the Platform") and applies to all personal data processed in connection with your access to and use of the Bro138 online gaming platform, accessible at https://bro138.buzz, including all related services, features, and communications.

Bro138 is committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. We process personal data only for the purposes described in this Policy and only to the extent necessary for those purposes.

By registering an Account on Bro138, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the terms of this Policy, you must discontinue use of the Platform and contact us to request Account closure.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means Bro138, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third-party entity that processes Personal Data on behalf of Bro138, under a binding data processing agreement.
• "Member" / "User" / "You" means any individual who has registered an Account on the Bro138 platform or who otherwise interacts with the Platform.
• "Cookies" means small text files placed on your device by the Platform to store session and preference data, as further described in Section 11.
• "KYC" means Know Your Customer — the identity and document verification process applied to Members prior to processing withdrawals or upon request.

Bro138 collects the following categories of Personal Data from Members and Platform visitors, as applicable:

We collect Personal Data through the following means:

4.1 Information You Provide Directly

• When you register an Account on Bro138, including your name, date of birth, email address, and contact details;
• When you submit KYC verification documents in response to our identity verification requests;
• When you make deposits or withdrawal requests, including payment method details;
• When you contact our customer support team via live chat or email;
• When you complete any form or survey on the Platform;
• When you update your account profile or preference settings.

4.2 Information Collected Automatically

• Technical and usage data collected automatically when you access and interact with the Platform, including device identifiers, IP address, browser type, and session activity logs;
• Cookie data and similar tracking technologies, as described in Section 11;
• Transaction records generated automatically when you deposit, place bets, or request withdrawals.

4.3 Information from Third Parties

• Identity verification data from KYC service providers used to authenticate documents submitted by Members;
• Fraud screening data from financial security partners used to protect the integrity of payment transactions;
• Publicly available data consulted for compliance purposes, such as politically exposed persons (PEP) and sanctions list screening.

Bro138 processes your Personal Data for the following specific purposes:

• Account creation and management: To register, maintain, and administer your Bro138 Account, including processing login credentials and account settings.
• Service delivery: To provide access to the Platform's gaming services, process bets, manage game sessions, and deliver the features you have requested.
• Payment processing: To process deposits via Malaysian payment channels (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong) and cryptocurrency methods (BTC, USDT), and to process withdrawal requests to verified payment accounts.
• Identity verification (KYC): To verify the identity of Members prior to processing withdrawals and in compliance with anti-money-laundering and counter-financing-of-terrorism obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account compromise, money laundering, and other illegal conduct on the Platform.
• Responsible gambling: To monitor gaming activity for indicators of problem gambling behaviour, administer responsible gambling tools such as deposit limits and self-exclusion requests, and fulfil our duty of care obligations toward Members.
• Customer support: To respond to queries, complaints, and support requests submitted by Members through our live chat and email channels.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to Members who have opted in to receive such communications. You may withdraw consent for marketing communications at any time.
• Platform improvement: To analyse aggregated usage data for the purpose of improving platform performance, user experience, and game content offerings.
• Legal compliance: To comply with applicable legal and regulatory obligations, respond to lawful requests from competent authorities, and maintain records as required by law.

Bro138 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual necessity: Processing required to fulfil our contractual obligations to you as a registered Member, including account management, payment processing, and service delivery.
• Legitimate interests: Processing necessary for the pursuit of Bro138's legitimate business interests, including fraud prevention, platform security, and service improvement, provided these interests are not overridden by your fundamental rights and freedoms.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money-laundering regulations, KYC obligations, and law enforcement requests.
• Consent: Processing based on your freely given, specific, and informed consent — in particular, the sending of direct marketing communications. You may withdraw such consent at any time by updating your communication preferences in your Account settings or by contacting our support team.

Bro138 does not sell your Personal Data to any third party. We do not share your Personal Data with third parties for independent marketing purposes without your explicit consent. We may disclose your Personal Data only in the following limited circumstances:

7.1 Service Providers (Data Processors)

We engage trusted third-party service providers who process Personal Data strictly on our behalf and under our instructions, including:

• Payment processors — entities facilitating deposit and withdrawal transactions via DuitNow, FPX, e-wallet platforms, and cryptocurrency channels;
• KYC and identity verification providers — services used to authenticate identity documents submitted by Members;
• Fraud prevention and security vendors — services used to detect and prevent fraudulent transactions and unauthorised account access;
• Cloud infrastructure and hosting providers — entities providing the technical infrastructure on which the Platform operates.

All third-party processors are bound by data processing agreements that prohibit them from using your data for any purpose other than delivering the specific services contracted by Bro138.

7.2 Legal and Regulatory Disclosure

Bro138 may disclose Personal Data to law enforcement agencies, regulatory authorities, courts, or other competent public bodies when required to do so by applicable law, court order, or regulatory direction. In such cases, we will disclose only the minimum data required and, where legally permissible, will notify the affected Member of the disclosure.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of assets involving Bro138, your Personal Data may be transferred to the acquiring or successor entity. You will be notified of any such transfer and of any changes to the applicable privacy terms.

Bro138 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations, whichever is longer.

• Active Accounts: Personal Data associated with active Accounts is retained for the duration of the Account's active status plus any applicable statutory retention period following closure.
• Transaction Records: Financial transaction records, including deposit and withdrawal histories, are retained for a minimum period as required by applicable anti-money-laundering regulations.
• KYC Documents: Identity and address verification documents are retained for the period required by applicable identity verification regulations following Account closure.
• Support Communications: Customer support correspondence is retained for a period necessary to resolve disputes and maintain quality assurance records.
• Marketing Data: Data used for marketing communications is retained until you withdraw consent or request erasure, whichever occurs first.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual.

Bro138 implements and maintains a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encrypted storage for sensitive Personal Data and financial records held in our systems;
• Access controls restricting access to Personal Data to authorised personnel on a strict need-to-know basis;
• Multi-factor authentication requirements for administrative access to systems holding Personal Data;
• Regular security audits and vulnerability assessments of our technical infrastructure;
• Incident response procedures for the detection, containment, and reporting of any data security incidents.

As a registered Member or visitor to the Bro138 Platform, you hold the following rights with respect to your Personal Data. Requests to exercise any of these rights should be submitted to [email protected]. We will respond to all valid requests within a reasonable timeframe, typically within 30 calendar days.

10.1 Right of Access

You have the right to request a copy of the Personal Data we hold about you and to receive information about how it is being processed. This is commonly referred to as a Subject Access Request (SAR).

10.2 Right to Rectification

You have the right to request the correction of any inaccurate or incomplete Personal Data we hold about you. You may also update certain information directly through your Account settings.

10.3 Right to Erasure

You have the right to request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. Please note that this right is subject to our legal retention obligations — certain data may be required to be retained by law even following a closure or erasure request.

10.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you prefer restriction over erasure.

10.5 Right to Data Portability

Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format.

10.6 Right to Object

You have the right to object to the processing of your Personal Data based on our legitimate interests, including profiling for marketing purposes. You may also object to processing for direct marketing at any time — in which case we will cease processing your data for that purpose immediately.

10.7 Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing communications, update your preferences in Account Settings or contact [email protected].

Bro138 uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file stored on your device by your web browser when you visit the Platform. Cookies allow us to recognise your device, maintain your session, remember your preferences, and gather usage analytics.

11.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential to the functioning of the Platform, including session management and security. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gambling tool configurations, to provide a more personalised experience.
• Analytics Cookies: Used to collect aggregated information about how Members interact with the Platform, helping us understand usage patterns and improve our services. Data collected is anonymised and not used to identify individual users.
• Security Cookies: Used to detect and prevent fraudulent login attempts and other security threats.

11.2 Cookie Management

You may configure your browser settings to refuse all or certain categories of cookies. Please note that disabling strictly necessary cookies will impair the functionality of the Platform, and you may be unable to access certain features or maintain a logged-in session. Instructions for managing cookies are available through your browser's help documentation.

The Bro138 Platform integrates third-party services necessary for its operation, including payment gateway providers, identity verification services, and gaming content providers. When you interact with these integrated third-party services — for example, by making a deposit via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or FPX — the relevant third party's own privacy policy and terms of service will apply to data processed by that party in connection with your transaction.

Bro138 is not responsible for the data practices of independent third-party services. We recommend reviewing the privacy policies of any third-party payment providers or services you interact with outside of the Bro138 Platform itself.

The Bro138 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. Our registration and KYC processes include age verification steps designed to identify and prevent underage account creation.

If a parent or guardian believes that their child under the age of 21 has submitted Personal Data to Bro138 without their knowledge or consent, they should contact us immediately at [email protected]. Upon verification, we will promptly delete the relevant data and close the associated Account.

Bro138 reserves the right to update, modify, or replace this Privacy Policy at any time. Where material changes are made, we will publish a revised version of the Policy on this page with an updated "Last Updated" date. For significant changes that materially affect your rights or our processing activities, we will endeavour to notify registered Members via email or a prominent notice on the Platform.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree to the revised Policy, you must discontinue use of the Platform and request Account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by Bro138, you may reach our team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week directly through the Bro138 Platform.
• Email: [email protected] (plain text — not a clickable link). We aim to respond to all privacy-related enquiries within 5 business days, and to Subject Access Requests within 30 calendar days.

When submitting a data rights request by email, please include your registered Account username and a clear description of your request to help us process it efficiently. We may be required to verify your identity before actioning your request.

For general enquiries about our Terms of Use, please visit our Terms & Conditions page. For responsible gambling support tools and resources, please visit our Responsible Gambling page.