1. Introduction and Scope
This Privacy Policy governs the collection, processing, storage, transfer and deletion of personal data in connection with use of the wks138 website. For the purpose of this policy, "personal data" means any information that identifies or can reasonably be used to identify a natural person, including name, identity document number, email address, payment details, device identifiers and IP address.
This policy applies to all visitors, registered users and any person who interacts with a wks138 feature. By accessing wks138, you acknowledge that you have read this policy and agree to the data-handling practices described herein. If you do not accept this policy, you should discontinue use of wks138.
2. Definitions
- Controller refers to the entity responsible for determining the purposes and means of personal data processing under this policy.
- Data subject means the identified or identifiable natural person to whom personal data relates.
- Processing means any operation performed on personal data, including collection, storage, use, transfer, correction or deletion.
- KYC means Know Your Customer — the verification process involving identity and address documents to confirm eligibility.
- Consent means a freely given, specific and informed indication of the data subject's agreement to a particular processing activity.
3. Categories of Data Collected
wks138 may collect the following categories of personal data, depending on the feature used:
3.1 Identity and Contact Data
Full name, date of birth, MyKad or passport number, nationality and residential address may be collected during account registration or KYC verification. An email address is typically required to create and manage an account.
3.2 Payment and Transaction Data
Records of deposit amounts, withdrawal requests, selected payment methods and transaction identifiers may be retained for fraud prevention, compliance and dispute resolution. Payment method details such as a bank account name or wallet reference may be captured to confirm ownership. Full card or account numbers are not retained in plain text by wks138.
3.3 Verification Documents
Copies of identity documents, proof-of-address documents and selfie images submitted during KYC review are stored for the period required by applicable compliance obligations. wks138 strongly recommends submitting documents only through the authorised HTTPS portal and not via social media, messaging apps or email attachments.
3.4 Technical and Usage Data
Device type, operating system, browser version, IP address, referring URL, pages visited, session duration and interaction events may be logged automatically. This data helps detect suspicious activity, improve reliability and understand how Malaysian users engage with wks138 across different devices and connection types.
3.5 Communications Data
Support requests, feedback submissions and enquiries submitted through wks138 channels may be stored to resolve the issue, improve service quality and maintain a record for reference.
| Data Category |
Typical Purpose |
Retention Basis |
| Identity and contact |
Account management, KYC, age verification |
Duration of account plus compliance period |
| Payment and transaction |
Deposits, withdrawals, fraud prevention |
Duration required by financial rules |
| Verification documents |
Regulatory compliance, account security |
Applicable legal minimum |
| Technical and usage |
Security monitoring, service improvement |
Up to 24 months or as required |
| Communications |
Support resolution, service quality |
Duration reasonably required |
4. Lawful Basis for Processing
Personal data is processed on one or more of the following grounds:
- Contractual necessity: Processing required to fulfil obligations to a registered user, including account management, payments and KYC.
- Legal obligation: Processing required to comply with applicable legislation, anti-money-laundering rules or regulatory direction.
- Legitimate interest: Processing for fraud detection, service security, abuse prevention or service improvement where the interest is not overridden by the data subject's rights.
- Consent: Marketing communications and optional features where consent has been freely given and may be withdrawn at any time.
5. How wks138 Uses Personal Data
wks138 uses collected personal data for the following purposes:
- creating and managing user accounts;
- verifying the age and identity of account holders to comply with the 21+ eligibility requirement;
- processing deposits, withdrawals and refunds via supported Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank and Hong Leong;
- detecting and preventing fraud, unauthorised access, self-exclusion bypasses and abuse of promotional offers;
- responding to account enquiries, support requests and complaints;
- fulfilling legal and regulatory obligations;
- improving website performance, reliability and security;
- sending account-related notifications where these are necessary to deliver the service.
wks138 does not use personal data to make automated decisions that produce significant legal effects without human review, except where required by fraud-prevention systems operating under a legitimate-interest basis.
6. Cookies and Tracking Technologies
wks138 may use cookies and similar technologies to recognise returning visitors, maintain session state, measure traffic patterns and support security functions. A cookie is a small text file stored by your browser when you visit a website.
Session cookies are temporary and are deleted when you close your browser. Persistent cookies remain for a defined period and help with preference retention. You can configure your browser to refuse or delete cookies. If you do so, certain features of wks138 may function differently.
Where analytics tools are used, the resulting data should be anonymised or aggregated so it does not directly identify individual Malaysian users. The use of third-party tracking is limited to functionality reasonably required to operate wks138.
7. Data Sharing and Third Parties
wks138 does not sell personal data. Sharing may occur in the following circumstances:
- Payment processors: Personal and transaction data may be shared with payment service providers handling MYR deposits or withdrawals, including those facilitating DuitNow, FPX or eWallet transactions, to complete the requested operation.
- Identity verification services: Document images and identity data may be passed to a KYC service provider to complete age and identity checks.
- Legal and regulatory authorities: Data may be disclosed to a competent authority where required by applicable Malaysian or international law, a court order or a regulatory direction.
- Technology and infrastructure providers: Hosting, security and operational service providers may have limited and controlled access to data where necessary to deliver their contracted function.
Any third-party service provider handling wks138 user data is expected to apply security and confidentiality standards consistent with those described in this policy.
8. Security of Personal Data
wks138 applies reasonable technical and organisational measures to protect personal data against accidental or unlawful access, loss, alteration or disclosure. These measures include HTTPS encryption for data in transit, access controls for internal systems and periodic review of security configurations.
No transmission over the internet or electronic storage system can be guaranteed to be completely secure. Users are encouraged to use a unique, strong password, avoid sharing login credentials and access wks138 only from devices and networks they trust. If you suspect unauthorised account access, contact wks138 support promptly.
wks138 will not ask you to confirm passwords, full card numbers or complete identity document content through email, social media or messaging apps. Such requests should be treated as phishing attempts and reported immediately.
9. Data Retention
Personal data is retained for the period necessary to fulfil the purpose for which it was collected, subject to the following considerations:
- Account and identity data is generally retained for the duration of the active account and a minimum period following closure, as required by anti-money-laundering, fraud prevention or other regulatory rules.
- Transaction records may be held for a longer period where financial compliance, dispute resolution or statutory obligations require this.
- Communications and support data is retained while the matter remains open and for a reasonable period thereafter.
When data is no longer required and no legal basis for extended retention exists, wks138 will delete or anonymise it in a secure manner.
10. Your Rights as a Data Subject
Subject to applicable law and reasonable verification of your identity, you may exercise the following rights in respect of your personal data held by wks138:
Right of Access
Request a copy of the personal data wks138 holds about you and information about how it is used.
Right to Rectification
Ask for inaccurate or incomplete personal data to be corrected without undue delay.
Right to Erasure
Request deletion of your data where continued processing is no longer justified, subject to legal retention obligations.
Right to Restriction
Ask that processing of your data be temporarily suspended while an accuracy dispute or objection is assessed.
Right to Object
Object to processing based on legitimate interests where your particular circumstances provide a compelling reason.
Withdrawal of Consent
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any right, submit a clear request to the wks138 website email address displayed in the footer. Include enough information to allow your identity to be verified. wks138 will respond within a reasonable period and will not charge a fee for a routine request unless the request is manifestly unfounded or excessive.
11. Minors and Age Restriction
wks138 is intended solely for adults aged 21 and above. The deliberate collection or processing of personal data relating to a minor is prohibited. If wks138 becomes aware that personal data from a person under 21 has been collected, steps will be taken to delete that information promptly.
Parents, legal guardians and account holders are responsible for ensuring that minors do not use their devices, credentials or payment details to access age-restricted wks138 services.
12. International Data Transfers
Personal data collected from Malaysian users may be processed or stored in systems located outside Malaysia where infrastructure or service providers operate. In such cases, wks138 applies contractual or equivalent protections to ensure that data transferred outside Malaysia receives a comparable level of protection.
Users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and elsewhere in Malaysia are treated consistently under this policy regardless of the physical location of processing systems.
13. Changes to This Privacy Policy
wks138 may update this Privacy Policy to reflect changes in data-handling practices, legal requirements or service features. The effective date at the top of this page will be updated when material changes are made. Continued use of wks138 following an update constitutes acceptance of the revised policy.
Users are encouraged to review this policy periodically and should not rely on a saved or printed version as the current text. In the event of a significant change affecting how wks138 processes sensitive personal data, wks138 will endeavour to provide notice through the website.