tim138 is committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have over your data as a tim138 account holder.
This Privacy Policy (hereinafter the "Policy") sets out the basis on which tim138 (referred to as "tim138", "we", "us", or "our") collects, processes, stores, and shares personal data from users (referred to as "you", "the Player", or "the User") of the tim138 online gaming platform accessible at https://tim138.click (the "Platform").
tim138 is operated as a premium online casino and sports betting platform serving primarily Malaysian users. We take your privacy seriously. This Policy has been prepared to comply with internationally recognised data protection principles and to clearly communicate your rights regarding the personal data you share with us.
This Policy is to be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated by reference into this document.
The following terms, when capitalised in this Policy, carry the meanings assigned below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that relates to an identified or identifiable living individual, including name, identification number, contact details, financial information, and online identifiers. |
| "Processing" | Any operation performed on personal data, including collection, storage, use, disclosure, erasure, or transfer, whether automated or manual. |
| "Data Controller" | The entity that determines the purposes and means of processing personal data — in this context, tim138. |
| "Data Processor" | A third party that processes personal data on behalf of tim138 under a written agreement, such as a payment processor or identity verification provider. |
| "KYC Data" | Identity documents and related information collected for Know Your Customer verification purposes, including government-issued identification, proof of address, and selfie verification. |
| "Sensitive Data" | A subset of personal data warranting heightened protection, such as financial account details, identity document numbers, or information revealing health or vulnerability status. |
| "Cookie" | A small text file stored on your device by your web browser when you visit the Platform, used to recognise return visits and maintain session state. |
For the purposes of this Policy, tim138 acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, tim138 is responsible for determining the lawful purposes for which personal data is processed and for ensuring that appropriate safeguards are applied.
tim138 operates the Platform under an international online gaming licence. While the Platform serves Malaysian users — including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — the legal jurisdiction governing data protection obligations is that of the licensing authority under which tim138 operates.
For all data protection enquiries or formal requests, please contact our Data Protection point of contact using the details set out in Section 16 of this Policy.
tim138 collects personal data through several channels, including your Account registration, ongoing Platform use, payment transactions, and communications with our support team. The categories of personal data we collect include:
Registration & Identity Data
KYC & Verification Data
Financial & Transaction Data
Technical & Usage Data
Communications Data
tim138 processes your personal data on one or more of the following lawful bases:
| Legal Basis | Application |
|---|---|
| Contractual Necessity | Processing required to create and manage your Account, process deposits and withdrawals, and provide the gaming services you have contracted for. |
| Legal Obligation | Processing required to comply with anti-money laundering (AML) regulations, KYC obligations, responsible gambling mandates, and fraud prevention requirements under applicable law. |
| Legitimate Interests | Processing for fraud detection, platform security, abuse prevention, system performance analytics, and business continuity purposes, where such interests are not overridden by your fundamental rights. |
| Consent | Processing for optional marketing communications, personalised promotional offers, or analytics beyond operational necessity, where you have provided explicit opt-in consent. You may withdraw consent at any time. |
tim138 uses your personal data for the following specific purposes:
tim138 does not sell your personal data to third parties. We do not share your data for third-party marketing purposes without your explicit consent. We may share your data with the following categories of recipients, strictly for the purposes described:
All Data Processors engaged by tim138 are subject to written agreements requiring them to process personal data only on tim138's documented instructions, maintain appropriate security measures, and not share data with unauthorised sub-processors.
Given that tim138 operates under international licensing and uses globally distributed technology infrastructure, your personal data may be transferred to, stored in, and processed in countries outside Malaysia. Not all such countries maintain the same level of data protection as Malaysia or as the jurisdiction of tim138's licensing authority.
Where personal data is transferred internationally, tim138 ensures that appropriate safeguards are in place, which may include standard contractual clauses, binding corporate rules, or reliance on adequacy decisions, as applicable.
tim138 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting obligations. The following general retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account & Registration Data | Duration of Account plus 5 years after Account closure, as required for AML compliance and potential dispute resolution. |
| KYC Documents | 5 years from the date of submission or Account closure, whichever is later, in accordance with international AML standards. |
| Financial Transaction Records | 7 years from the date of the transaction, in line with standard financial record-keeping requirements. |
| Support & Communication Records | 3 years from the date of the interaction, unless the interaction forms part of an ongoing dispute or legal proceeding. |
| Technical & Usage Logs | 12 months for routine operational logs; up to 5 years where logs relate to a security incident or ongoing investigation. |
| Marketing Consent Records | Duration of consent plus 2 years after consent withdrawal, to evidence compliance with consent obligations. |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.
The tim138 Platform uses cookies and similar tracking technologies to provide a functional, secure, and optimised user experience. Cookies are small text files stored on your device by your browser when you visit the Platform. They do not contain executable code and cannot be used to access files on your device outside the browser sandbox.
We use the following categories of cookies:
You may configure your browser to reject or delete cookies. However, disabling strictly necessary cookies will impair the Platform's functionality and may prevent you from logging in or completing transactions. We do not use third-party advertising cookies or tracking pixels for cross-site advertising.
tim138 implements a comprehensive set of technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:
Subject to applicable law and certain conditions, you have the following rights with respect to your personal data held by tim138:
Request a copy of the personal data tim138 holds about you and confirmation of how it is being used.
Request correction of inaccurate or incomplete personal data without undue delay.
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Request restriction of processing where you contest the accuracy of the data or object to its processing, pending resolution of your objection.
Request your personal data in a structured, machine-readable format for transfer to another service provider, where technically feasible.
Object to processing of your data where tim138 relies on legitimate interests as its legal basis, or to processing for direct marketing purposes.
Where processing is based on your consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Lodge a complaint with a competent supervisory authority if you believe tim138 has not handled your personal data in accordance with applicable law.
To exercise any of the above rights, please contact our support team using the details in Section 16. We will endeavour to respond to all data subject requests within 30 days. We may require verification of your identity before fulfilling a request, to prevent unauthorised access to another person's data.
Please note that certain rights — particularly the right to erasure — may be limited where tim138 has a legal obligation to retain specific data (for example, KYC records and transaction logs required for AML compliance).
The tim138 Platform is strictly for individuals aged 21 years and above. We do not knowingly collect personal data from any person under the age of 21.
During the Account registration process, all prospective users are required to confirm that they are at least 21 years of age. Where tim138 becomes aware — through its KYC verification process or otherwise — that an Account has been created by or on behalf of a person under 21, the Account will be immediately suspended, all funds therein will be frozen pending investigation, and the personal data associated with the Account will be handled in accordance with applicable law regarding data collected from minors.
If you are a parent or guardian and you believe that your child has submitted personal data to tim138 without your knowledge, please contact us immediately at the details set out in Section 16 and we will take immediate action.
The tim138 Platform may contain references to or integration with third-party services, including payment processors (Maybank2u, CIMB Clicks, Touch 'n Go eWallet, etc.) and identity verification providers. These third parties operate under their own separate privacy policies, over which tim138 has no control.
When you interact with a third-party payment provider to fund or withdraw from your tim138 Account, that provider will collect your payment data directly in accordance with its own privacy policy. tim138 receives only a confirmation reference and the outcome of the transaction — we do not receive or store your full banking credentials.
tim138 is not responsible for the privacy practices or data handling of any third-party service. We encourage you to review the privacy policies of any third-party service you use in connection with your tim138 Account.
tim138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The version number and effective date displayed at the top of this page indicate the current published version.
Where a material change to this Policy affects your rights or the manner in which tim138 processes your personal data, we will provide notice by displaying a prominent notification on the Platform or by sending a notification to the email address registered to your Account prior to the change taking effect.
Your continued use of the Platform following the effective date of a revised Policy constitutes your acknowledgement of the revised Policy. If you disagree with any changes, you should close your Account and cease using the Platform.
For any enquiries, requests, or complaints relating to this Privacy Policy or tim138's handling of your personal data, please contact our support team through the following channels:
Six core data protection commitments that underpin how tim138 handles your personal information every day.
All data exchanged between your device and the tim138 Platform is secured with 256-bit SSL/TLS encryption — the same standard used by major international banks and financial institutions.
tim138 does not sell, rent, or trade your personal data to any third party for marketing, advertising, or commercial profiling purposes. Your data is used exclusively to operate and improve your gaming experience.
KYC documents submitted for identity verification are stored in encrypted, access-controlled repositories. Access is restricted to authorised compliance personnel and is fully logged and auditable.
You can request access to, correction of, or deletion of your personal data at any time. Requests are acknowledged within 72 hours and responded to within 30 days, subject to identity verification.
tim138 collects only the personal data that is genuinely necessary for the stated processing purposes. We do not collect speculative or disproportionate data about our users.
All categories of personal data are subject to defined retention periods. When the applicable period expires, data is securely deleted or irreversibly anonymised — no indefinite storage.
Understanding how your personal data is handled is part of the trust you place in tim138. We take that responsibility seriously — every transaction, every login, every bet. For players aged 21 and above only.
⚠ 21+ Only · Play Responsibly · For entertainment purposes only · Comply with your applicable local laws