Privacy Policy

This Privacy Policy ("Policy") describes how Lego138 ("lego138", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at lego138.casa (the "Platform"), collects, processes, stores, and protects the personal data of individuals who access or use our services. This Policy applies to all registered users, visitors, and prospective players ("you", "your") of the Platform.

Lego138 is committed to protecting your privacy and handling your personal data responsibly, transparently, and in accordance with applicable data protection principles. We operate primarily in English for the Malaysian market, serving players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Malaysia.

By accessing the Platform, creating an Account, or using any of our services, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein. If you do not agree to this Policy, please discontinue use of the Platform immediately.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information that identifies or can reasonably identify a living individual, directly or in combination with other data. This includes name, email address, phone number, NRIC number, IP address, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, alteration, and deletion.
• "Data Controller" — lego138, which determines the purposes and means of processing your Personal Data.
• "Data Processor" — a third-party service provider that processes Personal Data on behalf of lego138 under a written data processing agreement.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC" — Know Your Customer verification — the mandatory identity verification process required for Account opening and withdrawal processing.
• "Cookies" — small text files placed on your device by the Platform to store preference and session information.
• "Account" — a registered user profile on the Platform through which real-money gaming services are accessed.

Lego138 collects Personal Data across several categories depending on your level of interaction with the Platform. The following table summarises the categories of data collected:

We do not knowingly collect sensitive personal data (such as racial or ethnic origin, political opinions, or health data) unless required by applicable law for responsible gambling compliance purposes (for example, self-exclusion and problem gambling identification).

4.1 Directly from You

We collect Personal Data directly from you when you register an Account, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in promotions, submit feedback, or update your Account settings.

4.2 Automatically

Technical and Usage Data are collected automatically when you access the Platform through cookies, web beacons, server logs, and similar tracking technologies. This data collection occurs regardless of whether you are logged into an Account.

4.3 From Third Parties

We may receive Personal Data from third-party service providers engaged in the provision of Platform services, including:

• Identity verification and KYC service providers who confirm the authenticity of identity documents;
• Payment processors including Malaysian e-wallet operators, banks, and FPX/DuitNow service providers, who transmit transaction confirmation and payment metadata;
• Anti-fraud and AML (Anti-Money Laundering) screening services;
• Analytics providers who aggregate technical and usage data for Platform improvement purposes.

Lego138 uses your Personal Data for the following purposes:

Lego138 processes your Personal Data on the following legal grounds:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a registered Player — including Account management, game access, and payment processing.
• Legal Obligation: Processing required to comply with applicable laws — including KYC, AML obligations, and age verification requirements (21+ minimum).
• Legitimate Interests: Processing that serves our legitimate business interests, such as fraud detection, Platform security, and service improvement, where these interests are not overridden by your privacy rights.
• Consent: Where you have given explicit consent — such as opting in to receive marketing communications or agreeing to the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Lego138 does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We may share your Personal Data with third parties only in the circumstances described below:

7.1 Service Providers (Data Processors)

We engage trusted third-party service providers to assist in delivering our services. These providers are contractually bound to process your data only as instructed by lego138 and in accordance with applicable data protection standards. Categories include:

• KYC and identity verification platforms;
• Payment processors and Malaysian banking infrastructure providers (DuitNow, FPX, e-wallet operators);
• Cloud hosting and data storage providers;
• Customer support technology providers (live chat systems);
• Fraud detection and AML screening services;
• Analytics and Platform performance monitoring services.

7.2 Legal and Regulatory Authorities

We may disclose your Personal Data to competent regulatory authorities, law enforcement agencies, or courts where required by applicable law, a valid legal order, or to protect the rights, safety, and interests of lego138 and its users.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of lego138's business or assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent privacy protections. You will be notified of any such transfer in accordance with applicable requirements.

The Platform uses cookies and similar tracking technologies to enhance your experience, maintain session continuity, and gather analytical data. The following types of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session management cookies that keep you logged in during an active visit. These cookies cannot be disabled without affecting core Platform functionality.
• Performance and Analytics Cookies: Collect aggregated, anonymised data about how visitors interact with the Platform — including pages visited, session duration, and error occurrences. This data helps us improve Platform performance and content relevance.
• Functional Cookies: Remember your preferences, such as preferred language (English, Bahasa Melayu, Chinese), display settings, and responsible gambling tool configurations.
• Marketing Cookies: Used only where you have provided explicit consent, to deliver relevant promotional content and measure the effectiveness of marketing campaigns.

You may manage cookie preferences through your browser settings at any time. Disabling cookies may affect the functionality of certain Platform features. Where required by applicable law, we will seek your consent before deploying non-essential cookies.

Lego138 retains your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Retention periods vary by data category:

• Account and Identity Data: Retained for the duration of your Account and for a period of at least five (5) years following Account closure, to satisfy AML regulatory requirements.
• Transaction and Financial Data: Retained for a minimum of five (5) to seven (7) years in accordance with financial record-keeping obligations.
• KYC Documentation: Retained for the period required by applicable gaming and AML regulations — typically five (5) years from the date of verification or Account closure, whichever is later.
• Technical and Usage Data: Typically retained for a period of up to twenty-four (24) months, after which it is aggregated or deleted.
• Support and Communications Data: Retained for up to three (3) years from the date of the last interaction, to allow for dispute resolution and service quality review.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be associated with any individual.

Lego138 implements and maintains appropriate technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security practices include:

• 256-Bit SSL Encryption: All data transmitted between your device and the Platform is encrypted using industry-standard TLS/SSL protocols.
• Access Controls: Personal Data is accessible only to authorised personnel on a strict need-to-know basis, subject to confidentiality obligations.
• Secure Data Storage: Player data is stored on secured servers with physical and logical access controls, regular security auditing, and vulnerability assessments.
• Fraud Detection Systems: Real-time monitoring systems flag unusual account activity, abnormal transaction patterns, and potential security threats for immediate investigation.
• Incident Response: In the event of a data security incident that poses a material risk to your rights, we will notify affected users in accordance with applicable legal obligations without undue delay.

While we implement robust security measures, no data transmission over the internet can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your Account credentials and for immediately notifying us of any suspected unauthorised access to your Account.

Subject to applicable data protection law and certain legal exemptions (such as AML record-keeping requirements), you have the following rights with respect to your Personal Data held by lego138:

To exercise any of the above rights, please contact our Data Privacy team via the contact details provided in Section 15 of this Policy. We will respond to all verified requests within thirty (30) days. We may need to verify your identity before processing your request to protect against unauthorised access.

The Platform is strictly intended for individuals aged 21 years and above. Lego138 does not knowingly collect or process Personal Data from individuals under the age of 21. Age verification is conducted as part of the mandatory KYC process for all registered Accounts.

If we become aware that Personal Data has been collected from an individual who is under 21 years of age, we will take immediate steps to delete that data and close the associated Account. All Player Funds held in such Accounts will be handled in accordance with our Terms and Conditions and applicable legal requirements.

If you are a parent or guardian and believe that your child has registered on the Platform without your knowledge, please contact our support team immediately so that we can investigate and take appropriate action.

In order to deliver our services, your Personal Data may be processed by Lego138 or its service providers in jurisdictions outside of Malaysia. These may include countries where data protection laws differ from those in your country of residence.

Where Personal Data is transferred internationally, lego138 takes appropriate safeguards to ensure that such transfers are conducted in compliance with applicable data protection principles. These safeguards include:

• Transfers to service providers operating in jurisdictions with adequate data protection frameworks recognised by applicable authorities;
• Execution of data processing agreements that incorporate standard contractual clauses or equivalent data transfer mechanisms;
• Application of technical and organisational security measures consistent with those described in Section 10 of this Policy.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Malaysia as described in this Policy.

Lego138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Where we make material changes to this Policy, we will notify registered users by email or by posting a prominent notice on the Platform prior to the changes taking effect.

The effective date at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically to stay informed about how lego138 protects your Personal Data. Your continued use of the Platform following the effective date of any revision constitutes acceptance of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by lego138, please contact our Customer Support and Data Privacy team. Our support is available 24 hours a day, 7 days a week, in English, Bahasa Melayu, and Chinese.

You may reach us via the live chat function on the Platform, or by email at the address displayed in the footer of this page. When submitting a data rights request or privacy-related enquiry, please provide your registered Account username and a clear description of your request to allow us to respond promptly and accurately.

Lego138 is committed to resolving all privacy-related queries in good faith. We will acknowledge receipt of your request and aim to provide a substantive response within thirty (30) calendar days. Complex requests may require additional time, in which case we will notify you of the extended timeline.