Privacy Policy Garuda55 – Our Commitment to Protecting Malaysian Players' Data

This Privacy Policy is issued by Garuda55 ("We", "Platform") and applies to all users who access or use the Garuda55 platform, including the website, mobile applications, and all related services provided by Garuda55 to players in Malaysia.

This document details the types of personal data we collect, the purposes of collection, how we use it, retention periods, and your rights as a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA).

Garuda55 acts as the data controller for all personal information collected from Malaysian players. We take full responsibility for ensuring your data is processed lawfully, fairly and transparently in accordance with the principles of PDPA 2010.

2.1 Data You Provide Directly

During the registration process and your use of the Garuda55 platform, you provide us with the following personal data:

• Identity Information: Full name, MyKad number, date of birth, gender and nationality.
• Contact Information: Email address, mobile phone number and residential address in Malaysia.
• Financial Information: Payment method details such as Touch 'n Go eWallet, GrabPay, DuitNow, FPX (Maybank2u or CIMB Clicks), Boost, or ShopeePay — stored in encrypted format.
• Security Information: Passwords (stored as irreversible hashes), security questions, and two-factor authentication (2FA) details.

2.2 Automatically Collected Data

When you use the Garuda55 platform, our systems automatically record the following technical information:

• IP address and approximate geographic location based on IP.
• Device type, operating system, browser type and version.
• Activity log records including pages visited, session duration and actions taken within the platform.
• Cookie data and similar tracking technologies for user experience improvement.
• Complete game records including bets, wins, losses and transaction history.

2.3 Data from Third Parties

In certain cases, Garuda55 may receive data about you from legitimate third parties, including identity verification service providers for KYC purposes, approved payment providers, and fraud prevention agencies to protect the platform and other players.

Garuda55 uses your personal data only for legitimate, clearly stated purposes. The legal basis for each processing purpose is as follows:

3.1 Contractual & Operational Purposes

• Creating and managing your player account on the Garuda55 platform.
• Processing deposits and withdrawals via approved payment methods in MYR.
• Verifying your identity through the KYC process to meet compliance requirements.
• Providing gaming services, tracking game history and calculating winning payouts.
• Providing customer support and resolving complaints or disputes.

3.2 Security & Compliance Purposes

• Detecting and preventing fraud, money laundering, and other unlawful activities.
• Ensuring compliance with applicable licensing requirements and regulatory obligations.
• Implementing responsible gaming policies and identifying signs of problem gambling.
• Maintaining platform security and protecting other players from suspicious activity.

3.3 Service Improvement Purposes

• Analysing usage patterns to improve the design and functionality of the Garuda55 platform.
• Personalising your gaming experience based on your preferences and play history.
• Sending information about relevant promotions, bonuses and special offers — only if you have consented to receive marketing communications.

Garuda55 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, in the following limited circumstances, we may share your data with trusted parties:

4.1 Third-Party Service Providers

We share necessary data with service providers that help us operate the platform, including:

• Payment gateway providers such as Touch 'n Go, GrabPay, DuitNow and FPX to process transactions in MYR.
• Approved identity verification (KYC) service providers used to authenticate the validity of documents.
• Hosting and cloud infrastructure providers that store data on secure servers.
• Analytics software used to understand platform usage patterns on an aggregated and anonymised basis.

All third-party providers are bound by strict confidentiality agreements and are only permitted to use your data for the specific purposes designated by Garuda55.

4.2 Legal Requirements

Garuda55 may disclose your data to authorities when required by Malaysian law or a valid court order. This includes financial crime investigations, anti-money laundering enforcement, and related regulatory requirements.

Garuda55 uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions smoothly. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login sessions and account security. These cookies cannot be disabled.
• Performance Cookies: Collecting information on how you use the platform to help us improve performance and usability.
• Functional Cookies: Saving your preferences such as language, theme, and other settings to deliver a more personalised experience.
• Analytics Cookies: Helping us understand overall usage patterns — all data is anonymous and aggregated.

6.1 Retention Period

Garuda55 retains your personal data for as long as your account remains active or as long as necessary for the stated purposes. Following account closure, we retain records for the following minimum periods:

• Financial transaction records: Seven (7) years from the date of the transaction, in line with Malaysian legal requirements.
• KYC and identity verification records: Five (5) years after account closure.
• Gaming records: Three (3) years from the date of the game.
• Support communication logs: Two (2) years from the date of case resolution.

6.2 Security Measures

Garuda55 implements comprehensive technical and organisational security measures to protect your data, including:

• Data encryption in transit using TLS 1.3 and 256-bit SSL.
• Data encryption at rest using AES-256.
• Role-based access control (RBAC) — only authorised staff may access player data.
• Regular security audits conducted by accredited independent cybersecurity firms.
• Security awareness programme for all Garuda55 staff who handle player data.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights, which you may exercise at any time:

• Right of Access: Requesting a copy of the personal data we hold about you.
• Right to Rectification: Requesting correction of inaccurate or incomplete personal data.
• Right to Erasure: Requesting the deletion of your personal data under certain circumstances, subject to legal retention requirements.
• Right to Object: Objecting to the processing of your personal data for direct marketing purposes.
• Right to Withdraw Consent: Withdraw your consent for data processing at any time, with the understanding that this may affect our ability to provide certain services.

Garuda55 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, new legal requirements, or service improvements. When material changes occur:

• We will display a prominent notice on the Garuda55 platform homepage at least 30 days before any changes take effect.
• Active players will receive notifications via the email address registered to their account.
• The "Last Updated" date at the top of this document will be updated to reflect the latest revision.

Continued use of the Garuda55 platform after any changes take effect will be considered acceptance of the revised Privacy Policy. If you do not agree with the changes, you may close your account by contacting our support team.

Garuda55 has appointed a Data Protection Officer (DPO) responsible for ensuring the platform's compliance with PDPA 2010 and all relevant privacy policies. If you have any questions, concerns or complaints regarding how Garuda55 handles your personal data, please contact us through the following channels:

• Email: support@garuda55.online (with the subject line "Privacy Complaint – DPO")
• Live Chat: Available 24/7 via the Garuda55 platform
• Response Time: Within 14 working days for all privacy-related enquiries

If you feel your complaint has not been resolved to your satisfaction by Garuda55, you have the right to refer the matter to the Department of Personal Data Protection (JPDP) Malaysia or the relevant regulatory body.