Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is issued by garuda138 ("the Platform", "the Operator", "we", "us", "our"), the entity responsible for the online gaming platform accessible at https://garuda138.cam. This Policy applies to all individuals ("you", "the User") who register an account, visit the Platform or interact with any of its features or services.

garuda138 is committed to protecting and respecting the privacy of all users, including Malaysian players who may be subject to the Personal Data Protection Act 2010 (PDPA) of Malaysia. This Policy describes the categories of personal data we collect, the purposes for which that data is processed, the circumstances in which it may be shared, and the rights you hold with respect to your own personal information.

2. Definitions

The following terms carry the meanings set out below throughout this Policy:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, transfer or deletion.
• "Data Controller" — the entity that determines the purposes and means of Processing Personal Data. For users of garuda138, the Data Controller is garuda138.
• "Data Processor" — any third party that processes Personal Data on behalf of garuda138 in accordance with documented instructions.
• "KYC" — Know Your Customer; the identity and age-verification process applied to all garuda138 accounts prior to the release of withdrawal requests.
• "Cookie" — a small text file stored on a user's device by a web browser, used to retain session state or analytical information.
• "PDPA" — the Personal Data Protection Act 2010 of Malaysia, governing the processing of personal data in commercial transactions within Malaysia.

3. Data We Collect

3.1 Information You Provide Directly

When you register, verify your account, make a deposit or contact our support team, you provide garuda138 with information that may include:

• Full legal name as it appears on a government-issued identity document.
• Date of birth (for mandatory 21+ age verification).
• Residential address, including city and postcode (e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam).
• Email address and mobile phone number.
• Username and encrypted password credentials.
• Payment method details, including Malaysian bank account numbers (Maybank, CIMB, Public Bank, Hong Leong), e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay) and cryptocurrency wallet addresses where applicable.
• Identity documents submitted for KYC verification, such as a Malaysian MyKad or passport.
• Responsible-gambling preferences, including deposit limits and self-exclusion requests.

3.2 Information Collected Automatically

When you access the Platform, certain information is collected automatically through technical means:

• IP address and approximate geographic location.
• Device type, operating system version and browser type.
• Session duration, pages visited and navigation patterns within the Platform.
• Deposit and withdrawal transaction records, including amounts, timestamps and payment method used.
• Wagering history, game sessions accessed and betting markets viewed.
• Cookie and similar tracking technology data, as described in Section 8.

4. How We Process Your Data

garuda138 processes Personal Data for the following purposes. The table below summarises the primary uses and the associated legal basis for each category of processing activity.

5. Legal Basis for Processing

Where Malaysian data protection law and internationally recognised privacy principles require garuda138 to identify a lawful basis for each category of Processing, garuda138 relies on the following grounds:

• Contractual Necessity: Processing required to create, manage and fulfil the account agreement between garuda138 and the User, including payment processing and account verification.
• Legal Obligation: Processing mandated by applicable law, including KYC requirements, anti-money-laundering obligations and responsible-gambling regulatory duties.
• Legitimate Interest: Processing conducted to pursue the reasonable business interests of garuda138, provided those interests are not overridden by the User's privacy rights. This includes fraud prevention, platform security and aggregate analytics.
• Consent: Processing carried out with the User's explicit, informed and freely given consent, primarily for direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. Data Sharing

6.1 Service Providers and Data Processors

garuda138 engages third-party Data Processors to support the delivery of its services. These include payment processing partners (including Malaysian payment infrastructure providers for DuitNow, FPX and e-wallet services), KYC verification technology providers, cloud infrastructure and hosting partners, and customer support platform providers. All Data Processors are contractually bound to process Personal Data only in accordance with garuda138's documented instructions and to implement appropriate security measures.

6.2 Regulatory and Law Enforcement Disclosure

garuda138 may disclose Personal Data to regulatory authorities, law enforcement agencies or licensed gaming regulators where required to do so by applicable law, court order or regulatory directive. In such cases, garuda138 will disclose only the minimum information necessary to satisfy the legal requirement.

6.3 No Sale of Personal Data

7. Data Retention

garuda138 retains Personal Data for the minimum period necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law. The following indicative retention periods apply:

• Account registration data — retained for the duration of the active account plus five years following permanent closure, to meet anti-money-laundering record-keeping requirements.
• KYC documents — retained for five years from the date of submission or the date of account closure, whichever is later.
• Transaction records — retained for a minimum of five years in accordance with financial crime prevention obligations.
• Support communications — retained for two years from the date of the final communication in a support thread.
• Marketing consent records — retained until consent is withdrawn plus one year to demonstrate compliance with marketing obligations.
• Session and navigation logs — retained in aggregate and anonymised form for up to 24 months for platform improvement purposes.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual.

8. Cookies & Tracking Technologies

8.1 What Cookies garuda138 Uses

The garuda138 Platform uses the following categories of cookies and similar technologies:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication tokens and security cookies. They cannot be disabled without preventing access to the Platform.
• Functional Cookies: Remember user preferences such as language settings and responsible-gambling limit configurations between sessions.
• Analytics Cookies: Collect aggregate, anonymised data about how the Platform is used, including which pages attract the most visits and where navigation exits occur. This data is used to improve the Platform experience.

8.2 Managing Your Cookie Preferences

Non-essential cookies (functional and analytics categories) may be declined or withdrawn through your browser settings. Most modern browsers allow you to view, block or delete cookies through the privacy or security settings menu. Please note that disabling functional cookies may affect the usability of certain Platform features.

9. Data Security

garuda138 implements a layered set of technical and organisational security measures designed to protect Personal Data against unauthorised access, accidental loss, destruction or disclosure. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between the User's device and garuda138 servers.
• Encryption of sensitive data fields (including payment method details and password hashes) at rest within the database infrastructure.
• Role-based access controls that restrict internal access to Personal Data to authorised personnel on a need-to-know basis.
• Regular security assessments, penetration testing and vulnerability scanning of Platform infrastructure.
• Incident response procedures that include prompt notification obligations to relevant authorities and affected Users where required by applicable law.

While garuda138 takes all reasonable steps to protect your Personal Data, no internet transmission is entirely free from risk. Users are encouraged to maintain strong, unique passwords and to enable any two-factor authentication features available on their account.

10. Your Rights

Subject to applicable law and the verification of your identity, garuda138 recognises and will honour the following rights in respect of your Personal Data:

To exercise any of the above rights, please contact the garuda138 Data Protection team via the support channel listed in Section 14. Requests will be acknowledged within five business days and resolved within 14 calendar days, unless the complexity of the request reasonably requires an extension, in which case you will be informed.

garuda138 may need to verify your identity before actioning any data rights request to protect against fraudulent access to another individual's Personal Data.

11. Protection of Minors

garuda138 is strictly an adult platform. The Services are not directed at, intended for, or permitted to be used by any individual under the age of 21. garuda138 does not knowingly collect or process Personal Data from persons under 21 years of age.

Where garuda138 becomes aware or has reasonable grounds to believe that a User is under 21, the Account will be immediately suspended, any pending transactions will be paused and an investigation will be conducted. If the suspicion is confirmed, the Account will be permanently closed and any deposited funds will be returned to the source payment method following the investigation.

If you have reason to believe that a minor has gained access to the Platform, please notify garuda138 immediately via live chat or the support email address set out in Section 14.

12. International Data Transfers

garuda138 may transfer Personal Data to countries outside of Malaysia in connection with the use of cloud infrastructure, KYC verification systems and customer support platforms. Where such transfers occur, garuda138 ensures that appropriate safeguards are in place to protect the transferred data to a standard equivalent to that required under Malaysian data protection law, including through the use of contractual data protection clauses binding on the receiving party.

Users who require more detailed information about the specific safeguards applied to international data transfers may submit a written request to the garuda138 Data Protection contact set out in Section 14.

13. Changes to This Privacy Policy

garuda138 reviews and updates this Privacy Policy periodically to reflect changes in operational practice, applicable law or regulatory guidance. Where a material change is made to this Policy, garuda138 will notify registered Users by email to the address on record and by displaying a prominent notice on the Platform no less than seven calendar days before the revised Policy takes effect.

Continued use of the Platform after the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not accept a material revision, you should request Account closure before the revision takes effect.

All previous versions of this Policy are archived and are available on request from the garuda138 Data Protection contact below.

14. Contact Us

For questions, data rights requests, privacy concerns or complaints relating to this Privacy Policy or the handling of your Personal Data by garuda138, please contact the Data Protection team through the following channels:

• Website email: [email protected] (plain text only — not a clickable link)
• Live chat: Available 24 hours a day, 7 days a week through the Platform
• Subject line for written queries: "Privacy Policy Enquiry — [Your Account Username]"

All privacy-related requests are treated with strict confidentiality. garuda138 will not discuss the details of any individual data rights request with any party other than the verified account holder to whom the data relates.