Garuda55 Privacy Policy – Data Protection for Malaysia Members

1. Introduction & Scope of Privacy Policy

Garuda55 ("we", "the platform") operates the website garuda55.biz and all related services provided to members in Malaysia. As the data controller, Garuda55 takes full responsibility for how members' personal data is collected, processed, stored and protected.

This Privacy Policy applies to all individuals who register a Garuda55 account, use the platform via web browser or mobile app, contact our customer support team, or simply browse garuda55.biz without registering. It also covers all financial transactions including deposits made via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX, Maybank2u and CIMB Clicks through the platform.

Garuda55 adopts a "privacy by design" approach — meaning privacy protection is built into every aspect of our systems and processes from the earliest stages of development, rather than added as an afterthought. This ensures your data is protected systematically, not left to depend on manual procedures alone.

2. Personal Data We Collect

Garuda55 collects various categories of personal data depending on how you interact with our platform. The full details are as follows:

3. How We Use Your Personal Data

Garuda55 uses your personal data solely for legitimate, clearly stated purposes. We do not process your data for any other purpose without notifying you in advance. The primary purposes for which data is used are as follows:

• Account Management: Creating and maintaining your account, verifying your identity at login, and ensuring the security of your account on the Garuda55 platform
• Service Provision: Processing bets, facilitating deposits and withdrawals in MYR, managing VIP and bonus programmes, and providing access to all games and sports at Garuda55
• Legal Compliance: To fulfil the requirements of the Personal Data Protection Act 2010, Anti-Money Laundering (AML) procedures, age verification, and applicable financial reporting obligations in Malaysia
• Security & Fraud Prevention: Detecting and preventing unauthorised access, fraud, money laundering, and platform abuse that could affect other members
• Platform Improvements: Analysing usage patterns in aggregate, anonymised form to improve the performance, design and functionality of the Garuda55 platform for all users
• Communications: Sending important information about your account, security notices, policy updates and — with your consent — details about new Garuda55 promotions and offers
• Responsible Gambling: Monitoring gameplay patterns to identify early signs of problem gambling and proactively reaching out to members who may need support

The legal basis for each type of data processing varies — some are contractual (such as transaction processing), some are legal obligations (such as KYC identity verification), and some are based on Garuda55's legitimate interests (such as fraud prevention). For marketing purposes, we rely on your explicit consent, which may be withdrawn at any time.

4. Sharing Data with Third Parties

Garuda55 does not sell or rent your personal data to third parties. However, in the course of legitimate business operations, Garuda55 may share your data with a limited set of third-party categories as follows:

• Payment Service Provider: Payment processors for Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow, and the FPX gateway that facilitate your financial transactions — only the data necessary to process the relevant transaction is shared
• Game Software Provider: Technology companies providing casino software, slots, table games and virtual sports — data is shared in anonymised or pseudonymised form only to the extent required for game functionality
• Cloud Service Provider: Server and data storage infrastructure providers that handle the technical operations of the Garuda55 platform — all such providers are bound by strict data processing agreements
• Legal Authorities: Law enforcement agencies, financial regulatory bodies, and courts in Malaysia where Garuda55 is legally required to disclose such information
• Professional Consultants: Lawyers, accountants, and auditors bound by strict professional confidentiality obligations when providing advice to Garuda55

5. Cookies & Tracking Technologies

The Garuda55 platform uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions properly. Cookies are small text files stored on your device when you browse our website.

Garuda55 uses four main categories of cookies:

• Strictly Necessary Cookies: Required for core platform functionality — including login session management, CSRF security and language preferences. These cookies cannot be disabled without affecting platform functionality
• Functional Cookies: Remembering your preferences such as preferred bet limits, odds display, and platform settings you have customised — making each session more comfortable without having to reconfigure your preferences every time
• Analytics Cookies: Collecting aggregated, anonymised data on how members use the platform — used to understand which areas are popular, where technical issues occur, and how the overall experience can be improved
• Marketing Cookies: Used to display relevant Garuda55 advertisements to you on other platforms based on your interests and browsing activity — activated only with your consent

You can manage your cookie preferences through your browser settings at any time. Please note that disabling certain cookies may affect your experience on the Garuda55 platform — for example, disabling session cookies may require you to log in more frequently.

6. Data Storage & Retention Period

Garuda55 retains your personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, or for as long as required under applicable Malaysian law.

• Active Account Data: Retained for the duration your Garuda55 account remains active and for the required period following account closure
• Financial Transaction Records: Retained for a minimum of 7 years after the transaction date, in accordance with Malaysian financial and tax legislation
• Identity Verification Data (KYC): Retained for a minimum of 5 years after the business relationship ends, in line with Malaysia's AML requirements
• Support Communication Logs: Retained for 2 years for quality control and dispute resolution purposes
• Anonymised Analytics Data: May be retained indefinitely as no personally identifiable information is contained
• Responsible Gambling Data: Self-exclusion and self-suspension records are retained for as long as necessary to ensure ongoing protection for the players concerned

Once the retention period has lapsed and no other legal obligation prevents deletion, your personal data will be securely deleted or anonymised so that it can no longer be linked to you as an individual.

7. Data Security & Protection Measures

Garuda55 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or accidental disclosure:

• Data Encryption in Transit: All communications between your device and Garuda55's servers are secured by TLS 1.3 with 256-bit SSL encryption
• Data Encryption at Rest: Sensitive data such as identification card numbers, financial details, and passwords are stored in encrypted format using AES-256 standards
• Layered Access Controls: Access to systems containing personal data is restricted to authorised personnel only, operating under the principle of least privilege — each staff member may only access the data necessary for their specific role
• Two-Factor Authentication: All Garuda55 internal systems containing member data are protected with two-factor authentication to prevent unauthorised access even in the event of a compromised password
• Regular Security Audits: Garuda55 conducts regular internal security assessments and engages independent security firms for penetration testing and external audits
• Incident Response Plan: Garuda55 has a clear incident response procedure to detect, contain and address any security breach swiftly and effectively

8. Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international standards, you have important rights regarding your personal data. Garuda55 respects and facilitates the exercise of these rights:

9. Child Protection

The Garuda55 platform is exclusively for individuals aged 18 and above. Garuda55 does not knowingly collect, process or store any personal data from individuals under the age of 18.

Garuda55's registration process requires robust age verification. Any new registration application showing signs that the applicant may be underage will be rejected and will not be processed. If Garuda55 discovers that a child's data has been collected inadvertently — for example, if a child provided false age information during registration — the account will be closed immediately and all related data deleted as soon as possible.

10. Cross-Border Data Transfers

In certain cases, Garuda55 members' personal data may be transferred to or processed outside Malaysia — for example, when using international cloud services or global gaming technology providers. Garuda55 ensures that all cross-border data transfers are carried out with adequate safeguards in place:

• Only countries or organisations with data protection standards comparable to Malaysia's are used
• Comprehensive data processing agreements are signed with all recipient parties outside Malaysia
• Verified standard data protection clauses are incorporated into all contracts with international service providers
• Data transferred is reduced to the minimum necessary and anonymised where possible

Garuda55 does not transfer members' personal data to countries without a recognised data protection framework without first obtaining your explicit consent or implementing adequate contractual safeguards.

11. Amendments to the Privacy Policy

Garuda55 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or new technologies we adopt. When significant changes are made, we will:

• Updating the "Last Updated" date at the top of this page
• Displaying a clear notice on the Garuda55 platform homepage for at least 14 days before any changes take effect
• Sending email notifications to all active members when changes materially affect their privacy rights
• Maintaining archived versions of previous Privacy Policies, available to members upon request for reference

Continued use of the Garuda55 platform after any amendment takes effect constitutes acceptance of the updated terms. If you do not agree with the changes made, you have the right to close your account and request deletion of data permitted under law.

12. Contact Us Regarding Privacy

If you have any questions, concerns, or requests relating to this Privacy Policy or how Garuda55 handles your personal data, please reach out to us through the following channels:

• Privacy Email: support@garuda55.biz — include the subject line "Data Privacy Enquiry" to ensure your request reaches the right team
• Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the bottom right of the Garuda55 platform
• FAQ: For general enquiries, please refer to the Frequently Asked Questions us first — many common privacy questions are already answered there

Garuda55 is committed to responding to all privacy-related enquiries within 5 business days. For more complex data subject requests, we will provide a substantive response within 30 days as required under Malaysia's PDPA.