Privacy Policy

This Privacy Policy (hereinafter "Policy") is issued by Garuda888 (hereinafter "Garuda888", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at garuda888.cam and all associated subdomains and mobile-optimised services.

This Policy describes how Garuda888 collects, uses, stores, discloses, and protects the personal data of individuals ("you", "Member", "User") who access or use the Garuda888 platform. It applies to all registered account holders and to any visitor who interacts with the platform, regardless of the device or connection method used.

Garuda888 takes the privacy of its members seriously — particularly given that our primary user base consists of Malaysian players who expect their financial and personal information to be handled with the same standard of care as a licensed financial institution. This Policy is designed to meet that expectation.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, which together form the complete set of agreements governing your use of the Garuda888 platform.

For the purposes of this Privacy Policy, the following terms shall carry the meanings assigned to them below:

• "Personal Data" means any information that identifies or can identify a natural person, directly or indirectly, including name, email address, IP address, device identifier, payment details, and account activity records.
• "Processing" means any operation performed on personal data, including collection, recording, storage, alteration, retrieval, disclosure, erasure, or destruction.
• "Data Controller" means Garuda888, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means a third party engaged by Garuda888 to process personal data on its behalf under a written data processing agreement.
• "KYC Data" means identity and address verification documents submitted by a Member as part of the Know Your Customer compliance process.
• "Sensitive Data" means personal data that warrants heightened protection, including government-issued identification numbers, financial account details, and health-related information.
• "Cookie" means a small data file placed on a user's device by the platform to enable session management, functionality, and analytics.

Garuda888 collects personal data that is necessary to provide the services described on the platform, comply with applicable legal obligations, and maintain a secure gaming environment. The categories of personal data we collect are set out in the table below:

Garuda888 does not intentionally collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, or health data) beyond what is strictly required for identity verification or responsible gambling assessments.

Garuda888 collects personal data through the following channels:

The majority of personal data we hold is provided by you directly — during account registration, during the KYC verification process, when you make a deposit or withdrawal, when you contact our support team, or when you interact with promotional offers.

When you access Garuda888 from any device, technical data — including your IP address, browser type, device identifiers, and session activity — is collected automatically through our server logs and cookies. This data is used primarily for security, fraud prevention, and platform performance monitoring.

When you deposit via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX, or other payment methods, our payment processors may share transaction confirmation data with us. Garuda888 does not receive or store your full payment credentials — only a transaction reference and confirmation status are communicated to us.

For certain high-risk or high-value accounts, Garuda888 may use third-party identity verification services to cross-check the documents you submit during KYC. These providers operate under strict data processing agreements and are prohibited from retaining your data beyond the verification window.

Garuda888 processes your personal data only for defined, legitimate purposes. The specific purposes for which each category of data is used are as follows:

• Account Management: To create, maintain, and operate your Garuda888 account, including authentication, account recovery, and preference management.
• Transaction Processing: To process deposits, withdrawals, bonus credits, and adjustments to your account balance in MYR or equivalent cryptocurrency value.
• Identity Verification (KYC/AML): To verify your identity and age as required by our licensing obligations, and to detect and prevent money laundering, fraud, and financial crime.
• Customer Support: To respond to support queries submitted via live chat or email, and to maintain a record of your support history for quality assurance and dispute resolution purposes.
• Responsible Gambling: To monitor your gambling activity and apply responsible gambling tools — deposit limits, session timers, self-exclusion — where you have activated them or where our systems identify potential at-risk behaviour.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account abuse, and technical attacks against the platform.
• Legal Compliance: To comply with applicable laws, regulations, licensing conditions, and lawful requests from competent government or regulatory authorities.
• Platform Analytics: To analyse aggregated, anonymised usage patterns in order to improve platform performance, fix technical issues, and develop new features.
• Marketing Communications (opt-in only): To send you promotional offers and bonus notifications where you have explicitly opted in to receiving marketing communications. You may withdraw this consent at any time.

Garuda888 processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary to perform our obligations under the Terms & Conditions you have agreed to — including account registration, payment processing, and service delivery.
• Legal Obligation: Processing is required to comply with applicable laws, including anti-money-laundering regulations, KYC obligations, and licensing conditions imposed by our regulatory authority.
• Legitimate Interests: Processing is necessary for Garuda888's legitimate interests in operating a secure, fair, and commercially viable gaming platform — including fraud detection, abuse prevention, and platform analytics — provided those interests do not override your fundamental rights.
• Consent: For optional activities such as marketing communications, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Garuda888 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following circumstances, and only to the minimum extent necessary:

When you make a deposit or withdrawal, relevant transaction data is shared with the payment processor handling that transaction — which may include Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow / FPX, or cryptocurrency network validators. These providers operate under their own privacy policies and are independent data controllers in respect of that transaction data.

KYC documents are shared with authorised third-party identity verification service providers under data processing agreements that prohibit those providers from using your data for any purpose other than verification. All such providers are required to maintain ISO 27001-equivalent security standards.

Garuda888 may disclose your personal data to competent government authorities, regulators, or law enforcement agencies where required by applicable law, court order, or regulatory direction. We will notify you of such disclosures where legally permitted to do so.

Our platform is hosted on third-party cloud infrastructure. These providers act as data processors and process personal data solely on Garuda888's instructions. They are contractually prohibited from accessing or using your data for any independent purpose.

In the event of a merger, acquisition, or sale of all or substantially all of Garuda888's business assets, personal data may be transferred to the successor entity. Members will be notified in advance of any such transfer that materially changes how their data is handled, and will have the option to request account closure before the transfer takes effect.

Garuda888 uses cookies and similar tracking technologies to operate the platform efficiently and to understand how Members use it. The categories of cookies we use are described below:

Garuda888 does not use third-party advertising or behavioural tracking cookies. We do not allow advertising networks to place cookies on our platform for the purpose of profiling you across other websites.

You may manage or delete cookies through your browser's settings. Please note that disabling strictly necessary cookies will impair your ability to log in and use the platform. For instructions on managing cookies in major browsers (Chrome, Firefox, Safari, Edge), please refer to your browser's built-in help documentation.

Garuda888 retains personal data for only as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply as general guidance:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years after account closure, to satisfy anti-money-laundering record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years from the date of last account activity, in compliance with AML/CFT regulations. Physical and digital copies are securely destroyed after the retention period expires.
• Transaction Records: Retained for seven (7) years from the date of the transaction for financial audit and regulatory reporting purposes.
• Support Communication Records: Retained for three (3) years from the date of the last communication, to support dispute resolution.
• Technical Logs: Retained for twelve (12) months for security investigation purposes, then permanently deleted.
• Marketing Preferences: Retained until you withdraw consent or request deletion.

When data is no longer required, it is securely deleted from active systems and queued for permanent deletion from backup systems in accordance with our scheduled purge cycle. Where data cannot be fully deleted due to legal obligations, it is anonymised such that it can no longer be linked to any individual.

Garuda888 maintains a comprehensive information security programme designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Encryption in Transit: All communications between your device and Garuda888 servers are encrypted using TLS 1.3 with strong cipher suites. The platform enforces HTTPS across all pages and endpoints.
• Encryption at Rest: Sensitive personal data and KYC documents stored in our databases are encrypted using AES-256.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis. All access is logged and subject to regular audit review.
• Two-Factor Authentication: Internal administrative systems require multi-factor authentication. Members are strongly encouraged to enable 2FA on their accounts.
• Penetration Testing: The platform undergoes regular third-party security assessments including penetration testing and vulnerability scanning.
• Incident Response: Garuda888 maintains a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify you and relevant authorities within the timeframe required by applicable law.

Subject to applicable law, you have the following rights in relation to the personal data Garuda888 holds about you. You may exercise any of these rights by contacting our support team in writing. We aim to respond to all data rights requests within 30 calendar days.

Please note that certain rights may be subject to limitations where Garuda888 has a legal obligation to retain data (such as AML record-keeping requirements) or where exercising a right would conflict with the rights of another individual. Where we are unable to fulfil a request in full, we will explain the reason in writing.

To submit a data rights request, please contact our support team via live chat or email. Include your registered account username and a clear description of the right you wish to exercise. Identity verification may be required before the request is processed.

Garuda888 is an online gaming platform strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been submitted by a person who does not meet the minimum age requirement, we will immediately suspend that account and delete all associated personal data.

If you are a parent or guardian and believe that a minor in your care has registered an account on Garuda888, please contact our support team immediately. We will investigate and take prompt action.

Garuda888 operates infrastructure across multiple data centres and engages service providers located in different jurisdictions. As a result, your personal data may be transferred to, stored in, and processed in countries other than Malaysia. These countries may have data protection laws that differ from those applicable in Malaysia.

Where personal data is transferred outside Malaysia, Garuda888 ensures that appropriate safeguards are in place to protect your data, including:

• Transferring only to countries that maintain an adequate level of data protection, as assessed by Garuda888's data protection review process.
• Implementing contractual clauses in agreements with data processors that require them to maintain data protection standards equivalent to those applicable under this Policy.
• Restricting cross-border transfers to the minimum data necessary for the specific processing purpose.

By using the Garuda888 platform, you acknowledge and consent to the transfer of your personal data to jurisdictions outside Malaysia as described in this section.

The Garuda888 platform may contain references to third-party services — including payment providers such as Maybank, CIMB, Touch 'n Go eWallet, and Boost — which operate under their own privacy policies. When you access or use a third-party service in connection with your Garuda888 account, your interaction with that service is governed by the third party's privacy policy, not this one.

Garuda888 exercises no control over third-party data practices and accepts no responsibility for the privacy or security standards of external services. We recommend reviewing the privacy policy of any third-party provider before sharing personal data with them.

Garuda888 reserves the right to update or amend this Privacy Policy at any time. Material changes — defined as changes that significantly affect how we collect, use, or share your personal data — will be communicated to registered Members via the email address on their account no less than seven (7) calendar days before the change takes effect.

Minor updates — such as clarifications, corrections of typographical errors, or formatting changes that do not affect the substance of the Policy — may be made at any time without prior notice. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Your continued use of the Garuda888 platform after the effective date of any amendment constitutes your acceptance of the updated Policy. If you disagree with any change, you should cease using the platform and request account closure before the effective date of the change.

If you have any questions about this Privacy Policy, wish to exercise a data rights request, or believe that your personal data has been handled in a manner inconsistent with this Policy, please contact the Garuda888 data protection team through the following channels:

• Live Chat: Available 24/7 through the Garuda888 platform. This is the fastest channel for urgent privacy queries — average response time 3–5 minutes.
• Email: [email protected] — mark the subject line as "Privacy Request" and include your registered account username and a description of your query. Do not attach sensitive documents unless instructed by our team.
• Support Hours: All privacy and data requests are handled by our compliance team, which operates on Malaysian Standard Time (MST, UTC+8). We aim to acknowledge all email requests within 2 business days and resolve them within 30 calendar days.

For issues relating to responsible gambling or self-exclusion, please visit our dedicated Responsible Gambling page. For questions about account eligibility, bonuses, or payment terms, please refer to our Terms & Conditions.