Privacy Policy bonu138 –
Our Commitment to Your Data

1Introduction

Bonu138 takes the protection of users' personal data very seriously. This Privacy Policy ("Policy") describes how we — as the operator of the bonu138.app platform — collect, store, process, and protect the personal information you provide when using our services.

We comply with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international data protection standards. Our approach is built on the principles of transparency, purpose limitation, and user control — you have the right to know what happens to your data, and we are committed to full openness on this matter.

2Personal Data We Collect

Bonu138 collects personal data from several sources to support safe and efficient platform operations. The categories of data collected are as follows:

We do not collect sensitive data such as health information, religious beliefs, or political views unless directly relevant to platform requirements and voluntarily provided by the user.

3How We Use Your Data

Data collected is used solely for legitimate purposes related to the operation of the bonu138 platform. We do not process your data for any other purpose without obtaining your consent first.

• Identity Verification (KYC): Verifying user identity to ensure only eligible individuals access the platform.
• Transaction Processing: Securely processing deposits, withdrawals, and all other financial transactions.
• Account Management: Providing account services, restoring access, and sending important notifications.
• Platform Security: Detecting and preventing fraud, money laundering, and other unlawful activities.
• Responsible Wagering: Monitoring usage patterns to identify signs of problem wagering and taking proactive action where necessary.
• Service Communications: Sending important account updates, promotions you have opted in to receive, and policy information.
• Platform Improvement: Analyzing usage patterns in aggregate to improve the user experience.
• Legal Compliance: Meeting the reporting and compliance obligations set by the relevant authorities.

4Legal Basis for Data Processing

Bonu138 only processes your personal data when there is a valid legal basis to do so. The bases we rely on are:

• Contract Performance: Processing necessary to deliver the platform services you requested — including account management and transaction processing.
• Legitimate Interest: Processing for security purposes, fraud prevention, and platform improvement that does not affect users' fundamental rights.
• Consent: For marketing communications and certain cookie usage — you may withdraw this consent at any time.
• Legal Obligation: Processing required to fulfill legal obligations, including AML (anti-money laundering) reporting.

5Data Sharing with Third Parties

Bonu138 does not sell users' personal data to any third party for marketing or commercial purposes. Your data is only shared in the following situations and with limited parties:

• Service Providers: Payment processors, identity verification (KYC) providers, and gaming software vendors contracted to support platform operations — all bound by strict confidentiality agreements.
• Statutory Authority: When required by law, court order, or investigation by relevant authorities — including the Inland Revenue Board, police, or financial intelligence units (AMLA).
• Fraud Prevention: With fraud detection service providers to protect the platform and other users from unauthorised activity.
• Business Transfers: In the event of a merger, acquisition, or asset sale — users will be notified in advance and data protection rights will remain intact.

All third parties that receive bonu138 user data are bound by data protection obligations equivalent to or stricter than this Privacy Policy.

6Data Security Measures

Data security is at the core of bonu138's technical infrastructure. We continuously invest in security technologies and procedures to ensure your personal data is protected at every stage of processing.

• 256-bit SSL Encryption: All communications between your browser and bonu138 servers are protected by bank-grade encryption.
• Encryption of Stored Data: Sensitive data such as passwords and financial information is stored in encrypted form using the latest industry-standard encryption algorithms.
• Access Controls: Only authorised staff with a legitimate business need may access user data, and all access is automatically logged.
• 24/7 Monitoring: Continuous security monitoring systems to detect and respond to threats in real time.
• Regular Security Testing: Vulnerability assessments and penetration testing are conducted periodically by independent parties.
• Incident Response Procedure: A clear protocol for identifying, reporting, and addressing any data breach within the prescribed timeframe.

7Cookies and Tracking Technologies

Bonu138 uses cookies and similar tracking technologies to enhance the user experience, maintain login sessions, understand usage patterns, and ensure platform security. The cookie categories we use are as follows:

• Essential Cookies: Required for core platform functions such as login verification and session security. Cannot be disabled without affecting platform functionality.
• Performance Cookies: Collecting aggregated information on how users interact with the platform for continuous improvement.
• Functional Cookies: Saving user preferences such as language and display settings for a more personalized experience.
• Analytics Cookies: Helping us understand the most visited pages and how users navigate the platform, using data that does not directly identify individuals.

You can manage cookie settings through your browser. Please note that disabling certain cookies may affect the functionality of some parts of the bonu138 platform. Cookie settings can be changed at any time from your browser settings.

8Data Retention Period

Bonu138 retains personal data only for as long as necessary to fulfil the purposes stated in this Policy or as required by law. Our general data retention principles are as follows:

• Active Account Data: Retained for the duration your account is active plus the mandatory period after account closure (typically 5–7 years) for legal compliance purposes.
• Financial Transaction Records: Retained for a minimum of 7 years as required under Malaysia's financial laws and PDPA.
• Security Logs: Retained for 12 months for investigation purposes in the event of a security incident.
• Support Communication Data: Retained for 2 years for service quality and dispute resolution purposes.
• Marketing Data: Retained for as long as you provide consent and deleted once you withdraw that consent.

Upon expiry of the applicable retention period, data will be securely deleted or anonymised in accordance with established procedures.

9User Rights Regarding Personal Data

Under Malaysia's PDPA and the privacy standards we adhere to, you have several important rights regarding your personal data held by bonu138:

10Amendments to This Privacy Policy

Bonu138 reserves the right to amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technological developments. Any material changes will be communicated to you through:

• Email notification to the address registered to your account.
• Prominent notice on the home page or login page of the bonu138 platform.
• Update the "Last Updated" date at the top of this page.

Continued use of the platform after amendments take effect constitutes your acceptance of the revised Privacy Policy. If you disagree with any changes made, you have the right to close your account and request data deletion in accordance with the established procedure.

11Contact Us Regarding Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us through the following channels:

• Privacy Email: [email protected] (please state "Privacy Inquiry" in the email subject line)
• Live Chat: Available 24/7 on the bonu138 platform — accessible from any page
• Target Response Time: Privacy-related requests are answered within 14 business days

We are committed to resolving any privacy-related concerns fairly and transparently. If you are not satisfied with our response, you have the right to appeal to the relevant data protection authority under applicable law.