Privacy Policy c118 – Our Commitment to Protecting Your Personal Data

c118 is an online entertainment platform operating in Malaysia, committed to protecting the privacy of all users who register and use our services. This Privacy Policy sets out in detail our practices regarding the collection, use, disclosure, retention, and security of your personal data.

This Policy applies to all personal information collected by c118 across all channels — including the c118.my website, any associated mobile applications, email communications, customer support interactions, and any other means by which you interact with c118. This Policy also applies to information we collect about you from legitimate third-party sources, such as identity verification providers or financial institutions during the KYC process.

From a legal standpoint, c118 acts as a "Data Processor" as defined under Malaysia's Personal Data Protection Act 2010 (PDPA). This means we bear full legal responsibility for ensuring that all personal data we handle is processed lawfully, fairly and transparently, in accordance with the principles set out in the PDPA 2010.

c118 collects various categories of personal data necessary to operate the platform safely and meet legal requirements. Below is a full list of the types of data we may collect:

c118 does not collect special categories of sensitive data such as biometric data, health information, or religious beliefs except where strictly required by law and with your explicit consent. We also do not collect personal data from individuals under the age of 21 — any account found to belong to an underage individual will be closed immediately.

c118 uses your personal data solely for lawful, specific and transparent purposes. The following are the primary purposes for data collection by c118:

• Account Management: Creating, verifying, maintaining and managing your account c118 yours, including the identity verification (KYC) process mandated by Malaysia's anti-money laundering laws.
• Financial Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u, CIMB Clicks), as well as securely processing winning withdrawals to your Malaysian bank account.
• Gaming Services Provision: Allows you to access and play all games available on c118, including slots, Live Casino, progressive jackpots, and Sports Betting.
• Platform Security: Detecting, investigating and preventing fraud, money laundering, bonus abuse and any activity that violates our Terms & Conditions c118.
• Service Communications: Sending important notices regarding your account, policy updates, security information and responses to customer support enquiries.
• Marketing (With Consent): Sending information about promotions, new bonuses, the latest games and special offers c118 — only to users who have explicitly consented to receive marketing communications.
• Legal Compliance: Fulfilling obligations c118 under applicable Malaysian laws, including the PDPA 2010, the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001, and any directives issued by the relevant authorities.
• Platform Improvements: Analyses platform usage patterns on an aggregated and anonymised basis to enhance the user experience, improve technical functionality and develop better new features for players c118.

c118 will not use your personal data for any purpose other than those stated above without first obtaining your explicit consent. Whenever we intend to use your data for a new purpose not previously mentioned, we will notify you and seek your consent again.

c118 does not sell, rent or trade members' personal data to third parties. However, in the course of operating the platform, c118 may need to share certain personal data with the following parties under limited and controlled circumstances:

• Payment Service Providers: Necessary financial data is shared with payment gateway providers to process your deposit and withdrawal transactions. This includes Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and the relevant FPX member institutions. All these providers are bound by strict data protection agreements with c118.
• KYC Service Providers: Your identity information may be shared with authorised third-party identity verification service providers for the purposes of KYC verification as required under Malaysian law.
• Game Developers: Gaming activity data that cannot directly identify you personally may be shared with game developers for technical maintenance and game fairness audit purposes.
• Legal Authorities: c118 will disclose personal data to the police, courts, or other enforcement agencies when required to do so by a court order, warrant, or valid Malaysian legal requirement.
• Auditors & Professional Advisors: Lawyers, accountants or consultants appointed by c118 may need to access certain data in the course of their professional duties, subject to strict confidentiality obligations.

In all of the above data-sharing instances, c118 ensures that only the minimum necessary data is shared, and all receiving parties are bound by adequate contractual protections to prevent data use beyond the permitted scope.

Platform c118 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform's technical functions run smoothly. The following are the types of cookies used by c118:

• Essential Cookies: Required for core platform functions such as login session authentication, security and technical stability. These cookies cannot be disabled without affecting platform functionality c118.
• Performance Cookies: Collects usage data that cannot personally identify you, such as the most frequently visited pages and time spent on the platform. This data is used to improve platform performance and the overall user experience c118.
• Functional Cookies: Saves your preferences such as interface language, game settings, and display options so you don't have to reconfigure them each time you use c118.
• Analytics Cookies: Support c118 understanding how users interact with the platform as a whole for the purpose of continuous improvement. Analytics data is in aggregate form and does not contain personally identifiable information.

You can manage cookie usage through your internet browser settings. However, disabling certain cookies may affect the functionality of some parts of the c118. For more information on how to manage cookies in your browser, please refer to your browser's help documentation.

c118 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or accidental disclosure:

• 256-bit SSL Encryption: All communications between your device and the c118 encrypted using the latest TLS protocol with 256-bit keys — the same standard used by Malaysia's leading commercial banks, including Maybank and CIMB.
• Stored Data Encryption: Sensitive data stored in the database c118 — including passwords, identification card information and financial details — are stored in encrypted format and cannot be read without the appropriate encryption key.
• Internal Access Controls: Access to members' personal data within internal systems c118 restricted to staff who genuinely require access in the course of their duties, with strict role-based access controls in place.
• Two-Factor Authentication: Internal data management systems c118 protected with two-factor authentication for all staff with access to members' personal data.
• 24/7 Monitoring: A continuous security monitoring system detects any unauthorised access attempts or suspicious activity within the c118 at all times, including on Malaysian public holidays.
• Regular Security Audits: c118 conducts regular independent security audits to identify and address any vulnerabilities in the data protection system before they can be exploited.

While c118 takes all reasonable steps to protect your data, no security system is 100% impenetrable. In the event of any security incident involving your personal data, c118 is committed to notifying you within the timeframe stipulated under PDPA law and taking prompt, effective remedial action.

c118 only retains your personal data for as long as necessary to fulfil the original purpose of collection, or as required by applicable Malaysian law — whichever is longer. Below are general guidelines on data retention periods:

• Active Account Data: Retained for the duration of your account c118 your account remains active and for an additional period following account closure as required by law.
• Financial Transaction Records: Retained for a minimum of 7 years after a transaction occurs, in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• KYC Records: Retained for a minimum of 6 years following account closure, in accordance with Malaysia's financial compliance legal requirements.
• Communication Records: Customer support records and emails are retained for 3 years for reference and dispute resolution purposes.
• Technical Data: Access logs and other technical data are retained for 12 months for security and fraud detection purposes.

Once the retention period has ended and there is no legal requirement to retain the data further, c118 will delete or anonymise your personal data in a secure and irreversible manner.

As a registered member c118 and data subjects under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding your personal data:

To submit any request relating to the rights listed above, please contact the c118 via email at [email protected] with the subject line "PERSONAL DATA REQUEST" and the details of your request. c118 is committed to processing your request within 21 working days as stipulated by Malaysia's PDPA 2010.

Platform c118 may contain links or references to third-party services in certain contexts. The Privacy Policy of c118 does not apply to third-party websites, applications or services that are outside our control. c118 is not responsible for the privacy practices of any third-party platforms and we encourage you to read the privacy policy of each platform you visit separately.

In the context of payment services, when you use Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow or FPX to make a deposit at c118, such transactions are also subject to the privacy policy of the respective payment service provider. c118 only receives the data necessary to verify and record payment transactions, and does not have access to your full account information with those providers.

c118 reserves the right to amend this Privacy Policy from time to time to reflect changes in our data handling practices, new legal requirements, or service improvements. Registered members will be notified of any material changes via email or an in-platform notice at least 14 days before those changes take effect.

The "Last Updated" date at the top of this page reflects when this Privacy Policy was most recently revised. Your continued use of the c118 after the effective date of any amendment will be considered your acceptance of the revised policy.

We encourage you to review this Privacy Policy page periodically to stay informed about how we protect your personal data. If you disagree with any changes made, you have the right to close your account c118 you by contacting our customer support team.

c118 has appointed a Data Protection Officer responsible for ensuring the platform's compliance with the PDPA 2010 and for handling all personal data enquiries, complaints and requests from members.

If you have any questions about this Privacy Policy or how c118 handles your personal data, or if you wish to exercise any of your rights as a data subject, please reach us through the following channels:

• Email: [email protected] (with the subject "DATA PRIVACY ENQUIRY")
• Live Chat: Via the platform c118, available 24 hours a day, 7 days a week
• Response Time: c118 is committed to providing an initial response within 3 business days and resolving cases within 21 business days

If you are dissatisfied with how c118 handling complaints related to your personal data, you have the right to lodge a formal complaint with the Department of Personal Data Protection Malaysia under the Ministry of Communications and Digital.