Privacy Policy – Personal Data Protection for garuda88 Members in Malaysia

This Privacy Policy ("Policy") is published by garuda88 ("we", "Platform") and describes in detail how we collect, process, store, and protect your personal information when you use the garuda88 platform — including the garuda88.run website, any mobile applications, and all related services we provide.

This policy applies to all individuals who interact with garuda88, including website visitors, prospective members considering registration, active registered members, and former members whose accounts have been closed. By using any part of the garuda88 platform, you confirm that you have read and understood this Privacy Policy and agree to the data processing practices described herein.

garuda88 operates in full compliance with Malaysia's Personal Data Protection Act 2010 (PDPA). We take our responsibilities as a data controller seriously and ensure that every aspect of member data processing is carried out transparently, lawfully, and securely.

Garuda88 collects various types of personal information from our members. Below are the categories of data we collect and how they are obtained:

Garuda88 practices the principle of "data minimisation" — we only collect information that is genuinely necessary for the stated purpose. We do not collect sensitive personal data such as health information, religious beliefs, or political views without a clear operational need and your explicit consent.

The personal data we collect is used solely for lawful and transparent purposes. Below are the specific ways garuda88 uses your information:

• Account Management: Creating and maintaining your Garuda88 account, processing registration, verifying your identity (KYC), and enabling secure login.
• Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX; processing withdrawals to verified accounts; providing complete transaction records within your account.
• Age Verification & KYC: Ensuring all members meet the minimum age requirement of 21 years and satisfy the anti-money laundering (AML) and know-your-customer (KYC) compliance requirements mandated by the relevant authorities.
• Security & Fraud Prevention: Detecting and preventing unauthorised access, fraudulent activity, multiple account usage, or any misuse of the platform that violates our Terms & Conditions.
• Customer Support: Enabling Garuda88's Bahasa Malaysia-speaking support team to provide effective assistance via live chat, WhatsApp, and Telegram whenever you reach out to us.
• Service Communications: Sending important notifications about your account — including deposit confirmations, withdrawal outcomes, security alerts, and significant updates to our terms.
• Platform Improvement: Analysing aggregated usage patterns (without identifying individuals) to understand which features are most useful and to develop a better user experience.
• Marketing (With Consent): Sending information about Garuda88 offers, promotions, and new features only to members who have given consent to receive marketing communications. You may withdraw this consent at any time.
• Legal Compliance: Complying with Malaysian legal obligations, including PDPA 2010, anti-money laundering reporting requirements, and any directives from competent authorities.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), garuda88 processes your personal data on valid legal grounds. Each data processing activity is tied to one of the following bases:

• Consent: For activities such as marketing communications and preference cookies, we require your explicit consent. You may withdraw this consent at any time through your account settings or by contacting us.
• Contract Performance: Processing required to deliver the Garuda88 services you registered for — including account management, financial transaction processing, and provision of platform access.
• Legal Obligation: Processing required to comply with applicable Malaysian law — including PDPA 2010, AML/KYC requirements, and any reporting obligations to relevant authorities.
• Legitimate Interest: Processing for the purposes of fraud prevention, system security, and service improvement — where Garuda88's legitimate interests do not override your privacy rights.

Garuda88 does not sell, rent, or commercialise members' personal data to any third party for their own marketing or commercial purposes. However, in the course of platform operations, we may share necessary data with a limited set of third-party categories as follows:

• Payment Providers: Information required to process transactions is shared with the relevant payment service providers — Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX partner banks (Maybank, CIMB, and others). This sharing is limited strictly to data necessary for transaction verification and settlement.
• Technology Providers: Companies that provide the technical infrastructure for our platform — such as cloud computing services, customer support systems, and security software providers — may process your data on behalf of Garuda88. All such providers are bound by strict data processing agreements.
• Game Providers: To provide live casino, slots, and virtual sports games, a minimum amount of technical data is shared with our game content providers. This sharing is necessary to allow games to function and be properly audited.
• Legal Authorities: When required by Malaysian law, a court order, or a valid request from a law enforcement authority, Garuda88 is obligated to disclose the necessary information. We will notify you of any such request where permitted by law.
• Licensing & Regulatory Bodies: Information required for audit purposes, licence compliance, and AML reporting is shared with the licensing bodies and regulators relevant to Garuda88's operations.

All third parties who receive personal data from garuda88 members are bound by strict confidentiality and data processing agreements, ensuring they use that data only for the stated purposes and protect it to a security standard equal to or exceeding our own.

Garuda88 invests heavily in data security infrastructure to protect every member's personal information. The technical and organisational security measures we implement include:

• 256-bit SSL Encryption: All communications between your device and Garuda88's servers are encrypted using 256-bit Secure Socket Layer (SSL) — the same standard used by Malaysia's leading banking institutions, including Maybank and CIMB.
• Data-at-Rest Encryption: Sensitive personal data — including payment details and identity information — is stored in encrypted form in our databases, never as plain text.
• Strict Access Controls: Only Garuda88 staff with a legitimate operational need may access members' personal data. Access is controlled through multi-factor authentication and comprehensive audit logs.
• 24-Hour Security Monitoring: Our intrusion detection system and abnormal activity monitoring operate 24 hours a day to identify and respond to security threats in real time.
• Regular Security Testing: garuda88 conducts regular penetration testing and security audits by independent cybersecurity experts to identify and address vulnerabilities before they can be exploited.
• Disaster Recovery: A comprehensive data backup system and disaster recovery plan ensure your information is not lost due to technical failure or any unforeseen incident.

Despite all these security measures, no system is 100% breach-proof. In the event of a data breach affecting your personal information, garuda88 is committed to notifying you within 72 hours of the date we detect it, in line with international data protection best practices.

The Garuda88 website uses cookies and similar tracking technologies to enhance the user experience, analyse usage patterns, and ensure the platform functions correctly. The following are the types of cookies we use:

• Essential Cookies (Required): These cookies are required for the Garuda88 platform to function — including maintaining your login session, remembering language preferences, and securing transactions. They cannot be disabled without affecting core platform functionality.
• Performance & Analytics Cookies: These cookies collect information about how visitors use the Garuda88 website — including the most frequently visited pages, time spent on site, and any error messages encountered. All information is aggregated and does not identify individuals.
• Functional Cookies: These cookies allow the platform to remember choices you have made, such as your username, display preferences, and other personal settings, to improve convenience on future visits.

You can manage or disable cookies through your web browser settings. Please note that disabling essential cookies may affect your ability to log in or use certain features of the Garuda88 platform fully.

Garuda88 retains your personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, or for as long as required by applicable Malaysian law.

Once the defined retention period has expired, your personal data will be securely deleted from all Garuda88 systems using methods that ensure the data cannot be recovered. For data stored in backup format, deletion will be carried out in accordance with the established backup cycle.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by garuda88:

• Right of Access: You have the right to request a copy of the personal data we hold about you. We will provide this information within 21 business days of receiving a complete request.
• Right to Rectification: If the personal data we hold about you is inaccurate, incomplete, or outdated, you have the right to request an immediate correction. You can update most of your information directly through your account profile settings.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data — for example, when the data is no longer needed for its original purpose or when you withdraw the consent on which processing was based. This right is subject to applicable legal retention obligations.
• Right to Object to Processing: You may object to the processing of your data for direct marketing purposes at any time. Upon receiving your objection, we will immediately stop using your data for that purpose.
• Right to Withdraw Consent: Where data processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing that took place prior to the withdrawal.
• Right to Lodge a Complaint: If you are dissatisfied with how garuda88 has handled your personal data, you have the right to lodge a complaint with the Personal Data Protection Commissioner (PDPC) of Malaysia, the regulatory body responsible for the PDPA.

To exercise any of the above rights, contact Garuda88's Privacy Officer by email at privacy@garuda88.run or via our customer support live chat. We will process your request promptly and contact you within 5 business days to confirm receipt.

In the course of operating the Garuda88 platform, some of your data may be processed on servers located outside Malaysia — for example, by cloud computing service providers or international game system providers.

Garuda88 ensures that any transfer of personal data outside Malaysia is carried out with adequate safeguards in place, including:

• Ensuring that the recipient country has data protection laws equivalent to or stricter than Malaysia's PDPA.
• Implementing standard contractual clauses that bind data recipients to protection standards equivalent to Malaysia's PDPA.
• Obtaining confirmation that international service providers have comprehensive data protection programmes and have undergone independent audits.

The Garuda88 platform is exclusively for individuals who are of age 21 years and above only. We do not knowingly collect or process personal data from individuals under the age of 21.

Garuda88 enforces a strict age verification process at registration, including validation of the Malaysian identity card number (MyKad) and supporting document checks during the KYC process. Should we discover that personal data belonging to someone under the age of 21 has been collected — whether through the provision of false information or by any other means — we will take immediate steps to delete that data and close the account in question.

Parents or guardians who believe their minor child may have provided personal information to Garuda88 without their knowledge are advised to contact us immediately at privacy@garuda88.run so that immediate action can be taken.

Garuda88 has appointed a Data Privacy Officer (DPO) responsible for ensuring compliance with this Privacy Policy and Malaysia's PDPA. For any enquiries, data access requests, complaints, or privacy-related feedback, you may reach us through the following channels:

We are committed to handling all privacy-related enquiries and requests with seriousness, transparency, and within a reasonable timeframe. Your trust in Garuda88 is our top priority, and every privacy concern raised will receive the full attention of our Privacy Officer.