Data Protection & Privacy
Your privacy is fundamental to how GAS138 operates. This Privacy Policy sets out in clear, plain terms what personal data we collect, how we use it, who we share it with, and the rights you hold over your own information. We encourage you to read this document in full before using the GAS138 platform.
Our Privacy Commitments
All personal data collected by GAS138 is stored with 256-bit SSL encryption. Access is strictly role-limited to authorised personnel with a documented business need. We conduct regular internal security audits and penetration testing to protect your data.
GAS138 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Any data sharing with partners is limited to what is strictly necessary to operate the platform and process your transactions.
You have the right to access, correct, port, and request deletion of your personal data at any time. GAS138 provides clear pathways to exercise each of these rights. We respond to all data subject requests within 30 days of receipt.
We collect only the personal data that is necessary to deliver our services, comply with legal obligations, and maintain account security. We do not collect data speculatively or retain data beyond the periods described in this Policy.
GAS138's data practices are aligned with international data protection standards and our gaming licence obligations. Our internal privacy programme is reviewed annually to reflect regulatory developments and evolving best practices.
We notify registered users of any material changes to this Privacy Policy via email to the registered address on file, with a minimum of 14 days' notice prior to the new policy taking effect, wherever operationally feasible.
GAS138 ("the Company", "we", "us", "our") is committed to protecting and respecting the privacy of all individuals who access or use the GAS138 online casino and sports betting platform at gas138.click and its associated services ("the Platform"). This Privacy Policy ("Policy") explains how GAS138 collects, uses, stores, shares, and protects the personal data of our users ("you", "your", "the User").
This Policy applies to all personal data processed by GAS138 in connection with the Platform, including data collected during account registration, identity verification (KYC), payment processing, gameplay activity, customer support interactions, and marketing communications.
GAS138 processes personal data in accordance with applicable international data protection laws and the data protection obligations imposed by our gaming licence. While GAS138 serves Malaysian users, the Platform is operated internationally, and data processing is conducted in accordance with the standards of our operating jurisdiction.
By registering an account on GAS138 or continuing to use the Platform following notification of any update to this Policy, you acknowledge that you have read and understood the data practices described herein. If you do not agree with this Policy, please discontinue use of the Platform.
For the purposes of this Privacy Policy, the following terms carry the meanings set out below:
GAS138 is the Data Controller for all personal data collected and processed in connection with the Platform. As Data Controller, GAS138 is responsible for ensuring that personal data is processed lawfully, fairly, and transparently, and that appropriate technical and organisational measures are in place to protect it.
GAS138 has appointed an internal Privacy Officer responsible for overseeing compliance with this Policy and applicable data protection laws. For any privacy-related enquiry, request, or complaint, please contact our Privacy Officer using the details set out in Section 16 of this Policy.
GAS138 is not affiliated with, endorsed by, or regulated by Bank Negara Malaysia, the Securities Commission Malaysia, or any other Malaysian government authority. Data protection practices described in this Policy are implemented in accordance with our international licensing obligations and GAS138's own internal privacy standards.
GAS138 collects the categories of personal data described below. The specific data collected in each case depends on the nature of your interaction with the Platform.
GAS138 does not deliberately collect Special Category Data. If you choose to disclose health-related information in the context of a responsible gambling self-exclusion request or support interaction, that information will be processed only to the extent necessary to address your request and will be handled with the highest degree of confidentiality.
GAS138 collects personal data through the following channels and methods:
| Collection Channel | Data Collected |
|---|---|
| Account registration form | Name, email, mobile number, date of birth, country of residence |
| KYC verification process | Government ID copy, proof of address, selfie verification |
| Deposit & withdrawal flows | Payment method identifiers, transaction amounts, timestamps |
| Platform usage (automatic) | IP address, device data, session logs, game activity |
| Cookies & tracking technologies | Browser preferences, session tokens, analytics data |
| Customer support interactions | Communication content, account reference, enquiry details |
| Third-party KYC/fraud partners | Identity verification outcomes, fraud risk scores (no raw biometric data shared) |
GAS138 processes personal data for the following purposes:
GAS138 processes personal data only where a valid lawful basis exists. The primary lawful bases relied upon are:
GAS138 does not sell personal data. We share personal data with third parties only in the following limited circumstances:
To process deposits and withdrawals, GAS138 shares necessary transaction data with Malaysian payment providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow (Bank Negara Malaysia's instant transfer network), FPX, Maybank, CIMB Bank, Public Bank, and Hong Leong Bank. These providers are independent data controllers in respect of their own payment processing activities.
GAS138 engages licensed third-party identity verification service providers to perform KYC checks. These providers process identity documents and verification data on our behalf under binding data processing agreements.
GAS138 uses specialist fraud detection and cybersecurity services that process technical data (including IP addresses and device fingerprints) to identify and prevent fraudulent activity on the Platform.
Licensed international game studios supplying content to GAS138 may receive aggregated or anonymised gameplay data for regulatory reporting and game performance analysis. No personally identifiable information is shared with game studios beyond what is technically necessary for game session initialisation.
GAS138 may disclose personal data to competent authorities, courts, or regulators where required to do so by law, court order, or in response to a lawful request from a public authority. GAS138 will, where legally permissible, notify the affected User of such a disclosure.
In the event of a merger, acquisition, or sale of all or substantially all of GAS138's assets, personal data held by GAS138 may be transferred to the acquiring entity. Users will be notified of any such transfer with reasonable notice prior to the transfer taking effect.
GAS138 operates internationally, and personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, GAS138 ensures that appropriate safeguards are in place to protect your personal data, including:
Malaysian users acknowledge that online data transmission involves inherent risks and that GAS138 cannot guarantee the absolute security of data transmitted over the public internet. GAS138 employs industry-standard measures to mitigate these risks to the greatest extent practicable.
GAS138 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, comply with legal obligations, and resolve any disputes or enforce our agreements. The following indicative retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account identity & KYC documents | 5 years following account closure | AML regulatory obligation |
| Transaction records | 5 years following transaction date | Financial regulatory obligation |
| Gaming activity logs | 3 years following account closure | Licence obligation & dispute resolution |
| Customer support communications | 3 years from date of communication | Legitimate interests (dispute resolution) |
| Self-exclusion records | Duration of exclusion plus 5 years | Responsible gambling obligation |
| Marketing consent records | Until consent is withdrawn, plus 1 year | Consent (evidence of compliance) |
| Technical/device logs | 12 months from generation | Security & fraud prevention |
Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with GAS138's data destruction procedures.
GAS138 uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that enable certain Platform functionality and allow us to analyse usage patterns.
You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies; however, disabling essential cookies may impair your ability to access and use the Platform. Detailed cookie management instructions are available through the "Help" section of your browser.
Subject to applicable law and certain exceptions, you have the following rights in relation to the personal data GAS138 holds about you:
Request a copy of the personal data GAS138 holds about you, along with information about how it is used and who it has been shared with.
Request correction of any inaccurate or incomplete personal data held about you. For some data categories, you can update details directly in your Account settings.
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations (e.g., AML record-keeping requirements).
Request that processing of your personal data be restricted in certain circumstances, such as where you contest the accuracy of the data or have objected to processing pending verification of legitimate grounds.
Request a copy of personal data you provided to GAS138 in a structured, machine-readable format, where processing is based on consent or contract.
Object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to GAS138 demonstrating compelling grounds that override your interests.
To exercise any of the above rights, please submit a written request to our Privacy Officer at [email protected] with the subject line "Data Subject Request". We will respond within 30 days of receiving a valid, verifiable request. We may require you to verify your identity before processing any data request.
The GAS138 Platform is strictly intended for adults aged 21 years and above. GAS138 does not knowingly collect, process, or retain personal data from individuals under the age of 21. If GAS138 discovers that an account has been registered by or is being used by a person under 21, that account will be immediately suspended, all associated data will be reviewed, and the matter may be reported to relevant authorities where required by law.
If you are a parent or guardian and believe that your child under the age of 21 may have registered an account on GAS138, please contact us immediately at [email protected]. We will investigate and take appropriate action, including deletion of the underage user's data, within 72 hours of a verified report.
GAS138 implements a comprehensive range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:
Notwithstanding these measures, no data transmission over the internet or electronic storage system is completely secure. GAS138 cannot guarantee the absolute security of personal data in all circumstances and accepts no liability for security breaches that occur despite the implementation of reasonable safeguards.
GAS138 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The effective date at the top of this Policy will be updated to reflect the date of the most recent revision.
For material changes to this Policy — including changes to the categories of data collected, new purposes of processing, or changes to data sharing arrangements — GAS138 will provide registered users with advance notice via email to the registered address on file, with a minimum of 14 days' notice wherever operationally feasible, prior to the revised Policy taking effect.
Your continued use of the Platform following the effective date of any revision constitutes your acceptance of the updated Privacy Policy. If you do not agree with any revision, you must discontinue use of the Platform and may request closure of your Account.
For any questions, requests, or concerns relating to this Privacy Policy or GAS138's data practices, please contact our Privacy Officer:
GAS138 Privacy Officer
Email: [email protected]
Subject Line: "Privacy Enquiry" or "Data Subject Request"
Response Time: Within 30 calendar days of receipt of a valid, verifiable request
Operating Hours: 24/7 (GMT+8, Malaysian Standard Time)
If you are dissatisfied with GAS138's response to a privacy complaint, you may have the right to escalate your complaint to the relevant data protection authority in the jurisdiction applicable to you. GAS138 will cooperate fully with any such authority in accordance with applicable law.
Malaysian users wishing to seek independent advice on privacy rights and data protection may consult relevant Malaysian consumer protection or legal advisory services. GAS138 respects the rights of all users to seek independent guidance regarding their personal data.
GAS138 is committed to handling your personal data with integrity and transparency. If you have any questions about how your data is used, our support team is available around the clock.
For players aged 21 and above only. Gamble responsibly. Privacy Policy effective 1 January 2026.