Privacy Policy

Orca128 ("we", "us", "our", or "the Platform") operates the online casino and sports betting platform accessible at https://orca128.cam. This Privacy Policy describes how Orca128 collects, uses, stores, shares, and protects personal data belonging to players, visitors, and any other individuals who interact with the Platform ("you", "the User", "the Data Subject").

We take data privacy seriously. This Policy has been written in clear, plain language so that every player — whether accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or anywhere else in Malaysia — can understand precisely how their information is handled, without needing a legal background to make sense of it.

By accessing the Platform, registering an Account, or using any Orca128 service, you confirm that you have read and understood this Privacy Policy. This Policy should be read alongside our Terms & Conditions, which govern the overall legal relationship between you and Orca128.

For the purposes of this Privacy Policy, the following terms carry the meanings assigned to them below:

Orca128 collects personal data through several channels during your interaction with the Platform. The categories of data collected and the contexts in which they are gathered are detailed below.

3.1 Registration Data

When you create an Account, we collect:

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Email address
• Mobile phone number
• Country of residence
• Username and encrypted password

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering obligations and verify player eligibility, we collect:

• Government-issued photo identification (Malaysian IC / MyKad, Driver's Licence, or valid Passport)
• Proof of residential address (utility bill or bank statement dated within 3 months)
• Selfie photograph of you holding your identification document
• Payment method verification (screenshot or confirmation linking your e-wallet or bank account to your registered name)

3.3 Financial Transaction Data

When you make deposits or request withdrawals, we record:

• Transaction amounts, dates, and currencies (MYR, USDT, BTC)
• Payment method used (Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, bank name)
• Transaction reference numbers
• E-wallet account identifiers or bank account details (masked where not operationally required)

3.4 Platform Usage Data

As you use the Platform, we automatically collect:

• IP address and approximate geographic location
• Device type, operating system, and browser version
• Session duration, pages visited, and in-game activity logs
• Wagering history, game preferences, and betting patterns
• Login timestamps and session identifiers

3.5 Communications Data

When you contact Orca128 support or respond to communications from us, we collect:

• Content of support chat transcripts
• Email correspondence sent to or from Orca128
• Any feedback, complaints, or dispute submissions

Orca128 processes personal data on one or more of the following legal bases, depending on the nature of the processing activity:

Orca128 uses the personal data we collect for the following specific purposes:

• Account Management: Creating, maintaining, and securing your Orca128 account, including password reset functionality and account settings management
• Transaction Processing: Facilitating deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, bank transfers, and cryptocurrency, and processing withdrawal requests to your verified payment accounts
• Identity Verification: Verifying your age (21+ requirement), confirming your identity, and completing KYC in accordance with applicable AML obligations
• Fraud Prevention and Security: Monitoring account activity for signs of fraud, unauthorised access, identity theft, money laundering, and bonus abuse; investigating suspicious transactions
• Platform Improvement: Analysing usage patterns, identifying technical issues, and improving the performance, usability, and content of the Platform
• Responsible Gambling: Monitoring wagering activity to identify players who may be displaying signs of problem gambling and providing appropriate intervention, support tools, or referrals
• Customer Support: Responding to your enquiries, resolving disputes, and maintaining records of support interactions for quality assurance purposes
• Legal Compliance: Meeting our obligations under applicable anti-money laundering, data protection, and gaming regulatory requirements
• Promotional Communications: Sending relevant bonus offers, loyalty programme updates, and platform news — only where you have provided consent and subject to your right to opt out at any time

Orca128 does not sell your personal data. We may, however, share it with carefully selected third parties where necessary to operate the Platform, fulfil our legal obligations, or protect legitimate interests. Sharing occurs only on the bases and with the parties described below:

6.1 Payment Service Providers

To process deposits and withdrawals, we share relevant transaction and identification data with licensed payment processors including e-wallet operators (Touch 'n Go, Boost, GrabPay), banking partners via FPX and DuitNow, and cryptocurrency processing infrastructure providers. These parties are contractually bound to use your data only for the processing of transactions on Orca128's behalf.

6.2 Identity Verification Providers

KYC document review may be handled by a specialist third-party verification provider operating under a formal data processing agreement with Orca128. Such providers are granted access to identity documents strictly for the purpose of verification and are bound by confidentiality obligations at least as stringent as those in this Policy.

6.3 Regulatory and Law Enforcement Bodies

Orca128 may disclose personal data to government authorities, regulatory bodies, or law enforcement agencies where required to do so by applicable law, court order, or regulatory directive. Such disclosures will be limited to what is strictly required and will be documented internally.

6.4 Fraud Prevention Networks

We may share relevant account and transaction data with industry fraud prevention services to identify and prevent financial crime. This sharing is conducted under data sharing agreements and is limited to data necessary for the fraud prevention purpose.

6.5 Professional Advisors

Orca128 may disclose personal data to legal counsel, auditors, or accountants where necessary in connection with legal proceedings, compliance reviews, or corporate governance — subject to professional confidentiality obligations.

The Orca128 Platform serves Malaysian players and its primary infrastructure is designed with regional data considerations in mind. However, some of the third-party service providers used by Orca128 — including payment processors, KYC providers, and cloud infrastructure vendors — may process data in jurisdictions outside Malaysia.

Where personal data is transferred internationally, Orca128 ensures that appropriate safeguards are in place prior to the transfer. These safeguards may include:

• Contractual data transfer clauses that impose obligations on the recipient equivalent to those in this Privacy Policy
• Transfers to jurisdictions that maintain an adequate level of data protection as assessed by applicable regulatory standards
• Technical and organisational security measures applied at both the sending and receiving end of the transfer

If you have questions about how your data is handled when transferred internationally, you may contact our support team as described in Section 15.

Orca128 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. The table below outlines our standard retention periods by data category:

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an individual. Anonymised aggregated data may be retained indefinitely for statistical and analytical purposes.

Orca128 uses cookies and similar technologies to operate essential platform functions and improve the user experience. A cookie is a small text file placed on your device when you visit a website. The cookies used by Orca128 fall into the following categories:

Strictly Necessary Cookies

These cookies are essential for the Platform to function and cannot be disabled. They are used for session management, login authentication, security token validation, and remembering your language or region preference. No consent is required for these cookies as they are technically necessary.

Performance & Analytics Cookies

We use performance cookies to understand how players interact with the Platform — which pages are visited most frequently, where errors occur, and how navigation flows can be improved. Data collected by these cookies is aggregated and does not identify individual users. These cookies are activated only upon your consent.

Functional Cookies

Functional cookies remember your preferences — such as display settings, preferred language, and game history — so that your experience is consistent across sessions. These are activated with your consent.

What Orca128 Does Not Use

Orca128 does not use third-party advertising cookies, cross-site tracking pixels, or behavioural profiling technologies. You will not be tracked across unrelated websites as a result of using the Orca128 Platform.

Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling strictly necessary cookies will impair Platform functionality and may prevent you from logging in or completing financial transactions. Most modern browsers provide cookie management settings under Privacy or Security options.

Orca128 implements technical and organisational security measures proportionate to the sensitivity of the data we hold. Our security framework includes the following controls:

• Encryption in Transit: All data transmitted between your device and the Platform is encrypted using TLS/SSL protocols with a minimum 256-bit key length
• Encryption at Rest: Sensitive data stored in our databases — including KYC documents and financial transaction records — is encrypted at rest
• Access Controls: Personal data is accessible only to authorised Orca128 personnel who require it for specific operational or compliance functions. Role-based access controls are enforced across all internal systems
• Network Security: Our infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability scanning
• Fraud Detection: Automated monitoring systems flag unusual account activity in real time, triggering human review where appropriate
• Staff Training: All Orca128 personnel who handle personal data receive mandatory data protection and security awareness training
• Incident Response: Orca128 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights, we will notify you and relevant authorities as required by applicable law

As an individual whose personal data is processed by Orca128, you hold the following rights. These rights may be subject to limitations where applicable legal obligations — such as AML retention requirements — take precedence.

To exercise any of the above rights, please contact the Orca128 support team via live chat or the email address listed in Section 15. We will acknowledge your request within 48 hours and respond substantively within 30 calendar days. We may need to verify your identity before processing certain requests.

The Orca128 Platform is intended exclusively for adults aged 21 years and above. We do not knowingly collect, process, or store personal data belonging to individuals below this age. Age is verified as part of the KYC process prior to the release of any withdrawal.

If Orca128 discovers or has reasonable grounds to believe that personal data from an individual under the age of 21 has been collected — whether through a false declaration or any other means — we will immediately take the following steps:

• Suspend the relevant Account pending investigation
• Permanently close the Account upon confirmation of underage status
• Securely delete all personal data associated with the Account except to the extent that retention is required by legal obligation
• Report the matter to relevant authorities where required by applicable law

If you are the parent or legal guardian of a minor and have reason to believe they have registered on the Orca128 Platform, please contact our support team immediately.

The Orca128 Platform does not contain links to third-party websites for commercial or advertising purposes. In the limited circumstances where references to external resources are made (such as responsible gambling support organisations referenced on our Responsible Gambling page), Orca128 is not responsible for the privacy practices or content of those external sites.

If you navigate to an external website from a link referenced on the Platform, that website will be governed by its own privacy policy. We encourage you to review the privacy policies of any third-party website before providing any personal information to that site.

Orca128 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. The "Last Updated" date displayed at the top of this page will be revised whenever a change is made.

For material changes — particularly those that affect how your personal data is used or shared — Orca128 will provide advance notice through one or more of the following channels:

• A notification within your Account dashboard upon next login
• An email sent to your registered email address
• A banner or notice displayed prominently on the Platform homepage

Your continued use of the Platform after the effective date of any amendment will be taken as confirmation that you have reviewed and accepted the updated Policy. If you do not agree with a material change to this Privacy Policy, you may request account closure in accordance with the Terms & Conditions.

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or want to raise a privacy concern, please contact the Orca128 privacy and data support team through the following channels: