Privacy Policy Nobita138 –
Personal Data Protection for Malaysian Members

Nobita138 ("we", "our platform") respects the privacy of every individual who uses our services. This Privacy Policy transparently explains how Nobita138 collects, processes, stores, and protects the personal information of members and visitors to our Malaysia-based platform.

This Privacy Policy document has been drawn up based on the requirements of Personal Data Protection Act 2010 (PDPA) Malaysia and covers all your interactions with Nobita138, whether through the website, mobile app or any other communication channel we provide.

By registering an account, accessing or using the Nobita138 platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our platform.

Nobita138 collects your personal information through various means when you interact with our platform. We only collect information that is genuinely necessary for the purposes stated in this Privacy Policy.

Information you provide directly:

• Full name as stated on your official identification document (MyKad or Malaysian passport).
• Identity card number (MyKad) or passport number for identity verification purposes.
• An active email address for account communications and notifications.
• An active Malaysian mobile number for two-factor authentication and communications.
• Malaysian bank account or e-wallet details (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) for processing deposits and withdrawals.
• Date of birth for age verification to confirm you are 18 or above.
• Current residential address in Malaysia.

Automatically collected information:

• The IP address of your device when accessing the platform.
• Type and version of the web browser used.
• Device information including operating system and device model.
• Platform activity logs including pages visited, session duration and actions taken.
• Approximate geolocation data (state/city in Malaysia) derived from your IP address.
• Information on cookies and similar tracking technologies.

Nobita138 uses the personal information collected solely for legitimate purposes directly related to providing our platform services to Malaysian members. The following outlines how your data is used:

• Identity and age verification: Ensuring all members meet the minimum age requirement of 18 years and verifying identity in compliance with Malaysian legal requirements.
• Service delivery: Processing account registration, deposits, withdrawals and all financial transactions on the platform via local payment methods such as Touch 'n Go eWallet, GrabPay, DuitNow and FPX.
• Account communications: Sending important notifications about your account, transactions, promotions, and platform updates via email or SMS.
• Security and fraud prevention: Monitoring account activity to detect and prevent fraud, money laundering and platform abuse.
• Service improvement: Analysing aggregated usage patterns (without identifying individuals) to improve platform features and the overall user experience.
• Legal compliance: Meeting reporting and compliance obligations to the relevant Malaysian authorities as required by law.
• Customer support: Processing enquiries, complaints, and support requests submitted to the Nobita138 support team.
• Responsible gaming: Monitoring gaming patterns to identify members who may need responsible gaming support.

Nobita138 will not use your personal data for any purpose not listed above without first obtaining your consent.

Nobita138 does not sell, rent, or transfer member personal information to third parties for commercial purposes. However, in certain limited situations, we may share your personal information with the following parties:

• Payment service providers: Transaction information is shared with Malaysian e-wallet and local banking providers such as Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow and banks supporting FPX (Maybank, CIMB and others) solely for the purpose of processing financial transactions.
• Technology service providers: We engage trusted third-party providers for IT infrastructure, analytics, and security services. All such providers are bound by strict confidentiality agreements and are not permitted to use your data for any other purpose.
• Legal authorities: Nobita138 will disclose personal information to Malaysian authorities when lawfully required by law, court order, or to assist in financial crime investigations.
• Business transfers: In the event of a merger, acquisition, or sale of Nobita138 assets, member personal information may be transferred as part of that transaction. Members will be notified in advance via their registered email address.

Nobita138 implements comprehensive technical and organisational security measures to protect members' personal data against unauthorised access, loss, destruction or accidental disclosure.

Technical security measures we have in place:

• Data encryption in transit using TLS/SSL 256-bit protocols for all communications between your browser and Nobita138's servers.
• Sensitive data at rest is encrypted using the AES-256 encryption algorithm.
• Two-factor authentication (2FA) for member account logins via OTP sent to a registered Malaysian mobile number.
• Multi-layered firewall and intrusion detection system (IDS/IPS) operating 24/7.
• Regular security vulnerability scanning and penetration testing conducted by independent security experts.
• Role-based access control (RBAC) ensuring that only authorised staff can access members' personal data.

Organisational measures:

• All Nobita138 staff who handle personal data undergo comprehensive data protection training.
• Mandatory confidentiality agreements are signed by all staff and contractors.
• A well-defined security incident response procedure to address any data breaches swiftly and effectively.

Nobita138 uses cookies and similar tracking technologies to enhance the user experience, maintain session security and analyse how members interact with our platform.

Types of cookies we use:

• Essential cookies (required): Required for core platform functions such as login authentication, session management and security. These cookies cannot be disabled as the platform will not function properly without them.
• Performance cookies: Collects information on how you use the platform, such as frequently visited pages and error messages received. All such information is aggregated and does not personally identify any individual.
• Functional cookies: Saving your preferences such as language, display settings, and other options to deliver a more personalised experience.
• Analytics cookies: Helps us understand overall platform usage patterns for continuous improvement purposes.

You can manage or disable cookies through your web browser settings. However, disabling certain cookies may affect the functionality of the Nobita138 platform.

As a Nobita138 member and data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal information:

Nobita138 retains members' personal data for as long as necessary to fulfil the processing purposes stated in this Privacy Policy, or as otherwise required by applicable Malaysian law.

• Active account data: Retained throughout your active membership and for a minimum of 7 years after account closure to comply with financial reporting and anti-money laundering requirements.
• Financial transaction records: Retained for a minimum of 7 years in accordance with the requirements of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001.
• Support communication logs: Retained for 3 years for dispute resolution reference and service improvement purposes.
• Cookie data and access logs: Retained for a maximum of 13 months from the date of collection.

Once the prescribed retention period has lapsed, your personal data will be securely deleted or anonymised in accordance with Nobita138's security procedures.

The Nobita138 platform may contain links or references to third-party websites in certain contexts. Nobita138 is not responsible for the privacy practices or content of those third-party websites.

We recommend reading the Privacy Policy of every website you visit. Nobita138 has no control over how third-party websites collect or use your personal information once you leave our platform.

Nobita138 is an exclusive platform for individuals aged 18 and above. We do not knowingly collect personal information from anyone under the age of 18.

Should Nobita138 discover that personal information belonging to a minor has been collected inadvertently, we will take immediate steps to delete that information and close the account in question. Parents or guardians who suspect their child has registered on Nobita138 are encouraged to contact us at support@nobita138.my without delay.

Nobita138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, new Malaysian legal requirements, or changes to the services we offer.

Members will be notified of any material changes to this Privacy Policy through:

• A prominent notification on the Nobita138 platform homepage.
• A notification email sent to the member's registered email address.
• In-account notification upon your next login.

The "Updated" date at the top of this page indicates the date of the most recent amendment to our Privacy Policy. Your continued use of the Nobita138 platform after the effective date of any amendment constitutes acceptance of the revised Privacy Policy.

If you have any questions, concerns, or wish to submit a request regarding your personal data at Nobita138, please contact our Data Protection Officer through the following channels:

• Email: support@nobita138.my
• Live Chat: Available 24/7 via the chat icon at the bottom corner of the Nobita138 platform
• Response time: All privacy-related enquiries will be responded to within 3 business days

If you are not satisfied with Nobita138's response to your privacy-related request, you have the right to file a complaint with Department of Personal Data Protection (PDPD) Malaysia which is the PDPA regulatory authority in Malaysia.