garuda88 Privacy Policy

This Privacy Policy ("Policy") is published by garuda88, the operator of the digital entertainment platform accessible at garuda88.cam ("Platform"). It describes how garuda88 ("we", "us", "our") collects, uses, stores, shares and protects the personal data of individuals ("User", "you", "your") who register for an account, browse the Platform or interact with our services.

garuda88 is an English-language online gaming information and entertainment platform designed for Malaysian adults aged 21 and above. The Platform presents casino-style games, sports betting information, live dealer content, payment guidance and responsible-gambling resources, with all transactional values denominated in Malaysian Ringgit (MYR).

garuda88 takes its data protection obligations seriously. This Policy is intended to be clear, specific and comprehensible. If any section is unclear, please contact us using the details provided in Section 15 before proceeding with account registration.

The following terms have the meanings assigned below throughout this Policy:

• "Personal Data" — any information that, alone or in combination with other data, identifies or is capable of identifying a natural person, including name, identification number, contact details, financial identifiers and digital identifiers such as IP addresses.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. garuda88 is the Data Controller for Personal Data collected through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of garuda88 under documented instructions, such as payment service providers and KYC verification partners.
• "KYC" — Know Your Customer; the identity and payment-ownership verification process required for certain account functions.
• "Cookies" — small text files placed on a User's device by the Platform for session management, security, analytics and preference purposes.
• "PDPA" — Malaysia's Personal Data Protection Act 2010, which governs the processing of personal data in commercial transactions involving Malaysian data subjects.

garuda88 acts as the Data Controller for all Personal Data collected through the Platform. This means garuda88 is responsible for determining why and how your Personal Data is processed, and for ensuring that processing activities comply with applicable data protection law, including the Malaysian Personal Data Protection Act 2010 (PDPA) to the extent applicable.

Where garuda88 engages third-party Data Processors — for example, payment gateway operators, identity verification providers, fraud-detection services or analytics platforms — it does so under contractual arrangements that impose data protection obligations on those processors consistent with this Policy.

Contact details for data-related enquiries are provided in Section 15.

garuda88 collects Personal Data across the following categories, depending on how you interact with the Platform:

4.1 Registration and account data

• Full legal name, date of birth, nationality and country of residence.
• Email address, mobile number and, where provided, physical mailing address.
• Username, encrypted password and security settings.
• Self-declared age confirmation and responsible-gambling limit preferences.

4.2 Identity and KYC documents

• Copies of government-issued photo identity documents (e.g., Malaysian MyKad, passport).
• Proof-of-address documents (e.g., utility bills, bank statements).
• Payment-method ownership evidence (e.g., e-wallet screenshots showing account name, bank statement headers).

4.3 Financial transaction data

• Deposit and withdrawal amounts, dates and payment method identifiers (e.g., masked bank account numbers, Touch 'n Go eWallet reference numbers, DuitNow identifiers, FPX transaction IDs).
• Cryptocurrency wallet addresses and network-level transaction hashes where applicable.
• Account balance history and bonus credit records.

4.4 Platform usage and technical data

• IP address, device type, operating system version and browser identifier.
• Session timestamps, game play history, betting activity, pages visited and features accessed.
• Cookie identifiers and similar tracking technology outputs (see Section 11).

4.5 Communications data

• Records of support communications sent to or received from garuda88, including live chat transcripts and email correspondence.
• Complaint and dispute records.

The table below sets out the principal purposes for which garuda88 processes Personal Data and the corresponding data categories involved:

garuda88 processes Personal Data only where a recognised lawful basis applies. The primary bases used are:

• Performance of a contract: Processing necessary to provide the garuda88 Platform and associated services to you as a registered User, including account management, game access, payment processing and customer support.
• Legal obligation: Processing required to comply with applicable anti-money-laundering (AML) legislation, identity verification requirements, fraud-prevention obligations and any regulatory reporting duties.
• Legitimate interests: Processing carried out for purposes that serve garuda88's legitimate business interests, including platform security, fraud detection, service analytics and responsible-gambling monitoring, provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for optional purposes such as direct marketing communications, where your explicit, specific and freely given consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of prior processing.

garuda88 does not sell your Personal Data. We share Personal Data with third parties only to the extent necessary for the purposes identified in this Policy and on a strictly controlled basis.

Categories of third parties with whom Personal Data may be shared include:

• Payment service providers: Including operators of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank and cryptocurrency processing infrastructure — to facilitate deposits, withdrawals and fraud monitoring.
• Identity verification and KYC partners: Third-party providers engaged to validate identity documents and confirm account eligibility.
• Fraud-prevention and security services: Services that help identify suspicious account activity, device fingerprinting anomalies or payment fraud patterns.
• Game content providers: Licensed international game studios and live-dealer platform operators whose games are accessible through garuda88, to the extent required for game operation and dispute resolution.
• Analytics providers: Platform analytics services that process usage data in pseudonymised form to support service improvement.
• Legal and regulatory authorities: Where garuda88 is required by law, court order or regulatory direction to disclose Personal Data to competent authorities.
• Professional advisers: Lawyers, auditors and compliance consultants engaged under confidentiality obligations in connection with garuda88's legal and financial obligations.

Given the global nature of online gaming infrastructure, some of the third-party Data Processors used by garuda88 may be located in, or operate infrastructure hosted in, jurisdictions outside Malaysia. Where such transfers occur, garuda88 takes steps to ensure that adequate data protection safeguards are in place, including:

• Contractual data processing agreements incorporating standard data protection clauses with all third-party processors.
• Transfer only to processors whose data protection standards garuda88 has assessed as providing an adequate level of protection for the rights of Malaysian data subjects.
• Minimising the scope of Personal Data transferred to only that which is strictly necessary for the specific processing purpose.

Personal Data is retained only for as long as necessary to fulfil the purpose for which it was collected or as required by applicable law. The general retention framework applied by garuda88 is as follows:

• Active account data: Retained for the duration of the account relationship.
• Closed account data: Financial transaction records, KYC documents and account activity logs are typically retained for a minimum of five years following account closure to meet AML and regulatory obligations.
• Support and dispute communications: Retained for a minimum of three years after resolution of the relevant matter.
• Marketing consent records: Retained for the duration of marketing activity plus a reasonable period to demonstrate consent compliance.
• Technical and analytics data: Anonymised or pseudonymised where possible and retained for up to twenty-four months for platform improvement purposes.

Where retention is no longer required and no legal obligation requires continued storage, garuda88 will securely delete or anonymise the relevant Personal Data.

garuda88 implements a layered approach to information security, applying technical and organisational controls appropriate to the sensitivity of the data and the risk of processing. Measures include:

• TLS/SSL encryption for all data transmitted between your device and the garuda88 Platform.
• Encryption of sensitive data fields at rest within garuda88's storage infrastructure.
• Role-based access controls limiting employee access to Personal Data to those with a legitimate operational need.
• Regular internal security reviews and vulnerability assessments of Platform infrastructure.
• Multi-factor authentication options for account access.
• Documented data-breach response procedures including notification protocols where applicable.

While garuda88 takes its security obligations seriously, no internet-based system is completely immune from the risk of unauthorised access. You should also take personal responsibility for account security by using a strong, unique password and not sharing login credentials with any third party. garuda88 will never ask for your password through any communication channel.

garuda88 uses cookies and similar technologies (such as local storage and session tokens) to support Platform operation and improve user experience. The categories of cookies used are:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, anti-CSRF protection and load-balancing cookies. These cannot be disabled without preventing Platform access.
• Security cookies: Used to detect fraudulent login attempts, unusual device patterns and session anomalies. These are required for Platform integrity.
• Analytics cookies: Used to collect aggregated, pseudonymised data about how Users navigate the Platform, which pages are most visited and where users encounter issues. This data informs service improvements.
• Preference cookies: Store your display and notification preferences to improve session consistency. These are optional.

You may manage non-essential cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent access to authenticated Platform features. Where applicable, cookie consent may be managed through a consent banner presented on your first visit.

garuda88 is strictly for adults aged 21 and above. We do not knowingly collect, process or retain the Personal Data of individuals under the age of 21.

If garuda88 discovers or reasonably suspects that a User is under 21, we will immediately suspend the relevant Account, cease all processing of the associated Personal Data and take steps to securely delete it, subject to any overriding legal obligation to retain records of the incident.

If you are a parent or guardian and believe that a minor has registered or used a garuda88 Account, please contact us immediately using the details in Section 15 so that appropriate action can be taken without delay.

Subject to applicable data protection law, you may exercise the following rights in relation to your Personal Data held by garuda88. The availability of specific rights may depend on the lawful basis under which processing occurs and any overriding legal obligations.

To exercise any of the above rights, please contact garuda88 using the details provided in Section 15. We will require you to verify your identity before processing any rights request to protect against unauthorised disclosure.

garuda88 may update this Privacy Policy periodically to reflect changes in data processing activities, applicable law or regulatory guidance. The most current version will always be available on this page, with the review date noted.

Where changes are material — for example, a new processing purpose, a new category of third-party recipients or a change to the lawful basis for an existing processing activity — garuda88 will publish a notice on the Platform prior to the amendment taking effect. For changes that require fresh consent, garuda88 will seek that consent before the new processing commences.

Your continued use of the garuda88 Platform after an updated Policy has been published and any required notice period has expired will constitute your acknowledgement of the updated Policy.

For any questions, concerns or requests relating to this Privacy Policy or the processing of your Personal Data, please contact garuda88 through the following channel:

• Data enquiries email: [email protected] (displayed as plain text — not a clickable link)
• Subject line recommended: Privacy Policy Enquiry — [your registered username]
• Support availability: 24 hours a day, 7 days a week
• Response target: Within 5 business days for data subject rights requests; within 2 business days for general privacy enquiries

When submitting a rights request or privacy enquiry, please include your registered username, a description of your request or concern, and (where relevant) the specific data categories or processing activities your request relates to. Do not include your account password or any one-time security codes in correspondence.