Privacy Policy —
How Garuda404 Protects Your Data

Introduction

Garuda404 ("we", "us", "our", or "the Company") is committed to protecting the privacy and personal data of all individuals who access or use the Garuda404 online casino and sports betting platform at garuda404.cam (the "Platform"). This Privacy Policy (the "Policy") sets out in detail the categories of personal data we collect, the purposes for which we process that data, the legal grounds on which processing is based, and the rights available to you as a data subject.

This Policy applies to all users of the Platform, including registered players, visitors browsing without an account, and any person who contacts our customer support team. It should be read together with our Terms & Conditions, which govern your use of the Platform generally.

By accessing the Platform or registering a Garuda404 account, you acknowledge that you have read and understood this Policy. If you do not agree with any aspect of this Policy, you should not use the Platform. We process personal data only where a lawful basis for doing so exists, and we are committed to handling your information with care, integrity, and transparency.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, location data, or any combination of data that could identify an individual.
• "Processing" — Any operation performed on personal data, whether automated or manual, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is Garuda404.
• "Data Processor" — A third party that processes personal data on behalf of and under the instructions of the Data Controller.
• "Data Subject" — The natural person to whom personal data relates — in this context, you, the user or player.
• "Cookies" — Small text files placed on your device by the Platform when you visit, used to store session information, preferences, and analytics data.
• "KYC" — Know Your Customer procedures, including identity and age verification processes required by applicable anti-money laundering and licensing obligations.
• "Sensitive Personal Data" — A subset of personal data that warrants heightened protection, including data relating to health, financial circumstances, or government-issued identification numbers.

Data Controller

Garuda404 acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, Garuda404 is responsible for determining the purposes and means by which personal data is processed, and for ensuring that processing activities comply with applicable data protection obligations.

Where Garuda404 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification providers, or analytics platforms — those providers act as Data Processors and are bound by contractual data processing agreements that restrict the use of personal data to the specific services being provided.

Data We Collect

Garuda404 collects personal data through several channels: directly from you during account registration and platform use, automatically through technical systems as you interact with the Platform, and from trusted third-party service providers where necessary for compliance and service delivery purposes.

4.1 Data Provided Directly by You

4.2 Data Collected Automatically

When you access and interact with the Platform, our technical systems automatically record certain data to ensure the Platform functions correctly, to protect against fraud and abuse, and to understand usage patterns:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, device identifiers.
• Usage Data: Pages viewed, games played, betting markets accessed, session duration, click-path data, search queries within the Platform.
• Transaction Data: Bet placement history, game session logs, win/loss records, bonus activation and wagering progress records.
• Location Data: General geographic location inferred from IP address, used for fraud prevention and regional compliance purposes. We do not collect precise GPS location data.
• Cookie Data: Session identifiers, preferences, analytics identifiers — detailed further in Section 10.

4.3 Data from Third Parties

In limited circumstances, Garuda404 receives personal data from trusted third-party sources for compliance and fraud prevention purposes, including identity verification agencies, fraud screening services, and payment providers such as DuitNow, FPX, and Malaysian banking institutions participating in online banking verification processes.

Legal Basis for Processing

Garuda404 processes personal data only where a valid legal basis exists. Depending on the purpose of processing, the applicable legal basis may be one or more of the following:

• Contractual Necessity: Processing required to perform the contract between Garuda404 and the Player — including account creation, managing your balance in MYR, processing deposits and withdrawals, and providing access to games and betting markets.
• Legal Obligation: Processing necessary to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, age verification requirements under applicable gaming licensing conditions, and data retention obligations.
• Legitimate Interests: Processing carried out in pursuit of Garuda404's legitimate interests, where those interests are not overridden by your data protection rights — including fraud detection, platform security monitoring, service improvement analytics, and responsible gambling programme operations.
• Consent: Where Garuda404 relies on consent as a legal basis (such as for certain marketing communications or non-essential cookies), consent will be obtained expressly and separately. You may withdraw consent at any time without affecting the lawfulness of prior processing.

How We Use Your Data

Garuda404 uses your personal data for the following purposes:

• Account Management: Creating and maintaining your player account, processing MYR deposits and withdrawals via Malaysian payment methods (Touch 'n Go eWallet, Boost, GrabPay, DuitNow/FPX, Maybank, CIMB, Public Bank, Hong Leong Bank), and managing your game and betting activity.
• Identity & Age Verification: Conducting KYC checks to confirm you are aged 21 or above and that your identity matches the payment methods on your account. This is a mandatory licensing obligation and cannot be waived.
• Fraud Prevention & Security: Monitoring account activity for signs of fraudulent behaviour, multi-accounting, money laundering, or other policy violations. IP address and device data are cross-referenced with known fraud indicators.
• Responsible Gambling Programme: Using your deposit, session, and wagering data to identify patterns consistent with problem gambling and to deliver appropriate responsible gambling interventions, including session reminders, deposit limit enforcement, and self-exclusion management.
• Customer Support: Responding to your queries, resolving complaints, and maintaining records of support interactions for quality assurance and dispute resolution purposes.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve game selection, platform performance, payment processing efficiency, and the overall user experience for Malaysian players.
• Legal & Regulatory Compliance: Retaining records as required by applicable law, responding to lawful requests from regulatory authorities, and fulfilling obligations under applicable gaming licensing conditions.
• Communications: Sending account-related notifications (transaction confirmations, security alerts, policy updates) and, where you have provided consent, promotional communications about bonuses and new features.

Data Sharing & Disclosure

Garuda404 does not sell your personal data. We share personal data with third parties only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment Processors: Financial information is shared with payment service providers — including those facilitating Touch 'n Go eWallet, Boost, DuitNow, FPX, and participating Malaysian banks — solely for the purpose of processing your transactions.
• Identity Verification Providers: Identity and document data is shared with licensed KYC/AML service providers for the purpose of verifying your identity, age, and payment method ownership.
• Game Software Providers: Your username and session token are shared with third-party game studios whose titles are accessible through the Platform. These providers do not receive your financial or identity data.
• Analytics & Security Providers: Pseudonymised usage and device data may be shared with analytics and cybersecurity platforms engaged to support platform performance monitoring and fraud detection.
• Legal & Regulatory Authorities: Garuda404 will disclose personal data to competent authorities, law enforcement agencies, or courts where required to do so by applicable law, lawful order, or as necessary to protect the rights, property, or safety of Garuda404, its players, or third parties.
• Corporate Transactions: In the event of a merger, acquisition, or asset sale, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

Data Retention

Garuda404 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or licensing obligations. Our general retention principles are as follows:

• Active Account Data: Personal data associated with an active player account is retained for the duration of the account relationship and for a period of at least five (5) years following account closure, in compliance with AML record-keeping requirements.
• Transaction Records: Financial transaction records, including MYR deposit and withdrawal history, are retained for a minimum of five (5) years from the date of the transaction, or such longer period as required by applicable law.
• KYC Documentation: Identity verification documents are retained for the period required by applicable AML and licensing obligations, typically five (5) to seven (7) years from the date of verification or account closure, whichever is later.
• Support Records: Customer support correspondence is retained for three (3) years from the date of the interaction, or such longer period as required for ongoing dispute resolution.
• Marketing Consent Records: Records of consent for marketing communications are retained for the duration of the marketing relationship plus three (3) years.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

Data Security

Garuda404 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security practices include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption of sensitive personal data and financial records at rest within our secure database infrastructure.
• Role-based access controls ensuring that personal data is accessible only to authorised personnel who require access for their specific job function.
• Multi-factor authentication requirements for administrative access to production systems.
• Regular security audits, vulnerability assessments, and penetration testing conducted by independent security specialists.
• Incident response procedures for detecting, responding to, and notifying affected individuals and relevant authorities in the event of a data breach, where required by applicable law.

While Garuda404 takes reasonable and proportionate steps to protect your data, no data transmission over the internet or electronic storage system can be guaranteed as 100% secure. You play an important role in protecting your own data by maintaining strong, unique passwords and enabling two-factor authentication on your account.

Cookies & Tracking Technologies

The Garuda404 Platform uses cookies and similar tracking technologies to provide, improve, and secure the service. Cookies are small text files stored on your device that allow the Platform to recognise your browser and remember certain information about your session and preferences.

Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled without impairing Platform functionality. No consent is required for these cookies.
• Functional Cookies: Remember your preferences — such as language settings and display preferences — to personalise your experience. These are set on the basis of your implied consent through continued use.
• Analytics Cookies: Collect anonymised data about how visitors interact with the Platform — which pages are most visited, how long sessions last, and where errors occur — to help us improve the Platform for Malaysian players.
• Fraud Prevention Cookies: Assist in identifying and blocking fraudulent activity and multi-accounting attempts. These serve a security and legitimate interest function.

You can manage or delete cookies through your browser settings. However, disabling strictly necessary cookies will prevent you from logging in or using certain Platform features. For most Malaysian mobile users accessing the Platform through Chrome or Safari, cookie controls are available in the browser's Privacy or Security settings.

International Data Transfers

Garuda404 operates internationally, and your personal data may be transferred to, stored in, or processed in countries outside of Malaysia. Such transfers may occur where our service providers — including payment processors, KYC providers, and cloud infrastructure partners — operate servers or data centres in jurisdictions other than Malaysia.

Where personal data is transferred internationally, Garuda404 takes steps to ensure that appropriate safeguards are in place to protect your data, including contractual protections in the form of data processing agreements with third-party service providers. Garuda404 will not transfer your personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate contractual or technical safeguards.

Your Data Rights

Subject to applicable law — including the Personal Data Protection Act 2010 (PDPA) of Malaysia and the data protection framework applicable to the jurisdiction in which Garuda404 is licensed — you may hold some or all of the following rights with respect to your personal data:

• Right of Access: You have the right to request confirmation of whether Garuda404 processes your personal data and, if so, to obtain a copy of that data along with information about how it is processed.
• Right to Correction: You have the right to request that inaccurate or incomplete personal data held by Garuda404 be corrected or updated. Players may update most account information directly through their account settings.
• Right to Erasure ("Right to be Forgotten"): In certain circumstances, you have the right to request the deletion of your personal data. This right may be subject to limitations where continued retention is required for legal, regulatory, or contractual reasons.
• Right to Restrict Processing: You may request that Garuda404 restricts the processing of your data in certain circumstances, such as while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gambling purposes, where you believe your interests override those of Garuda404.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Children & Minors

The Garuda404 Platform is strictly restricted to individuals aged 21 years and above. We do not knowingly collect, store, or process personal data from individuals under the age of 21. Age verification is a mandatory step in the registration and KYC process for all players.

If Garuda404 becomes aware that personal data has been collected from a person under the age of 21 — whether through a fraudulent registration or any other means — we will take immediate steps to close the account, void any transactions, and permanently delete all associated personal data from our systems.

If you are a parent or guardian and have reason to believe that your child under the age of 21 has registered on the Platform, please contact us immediately at [email protected] so that we can take prompt action.

Third-Party Links & Services

The Garuda404 Platform integrates third-party services — including game software provided by licensed game studios and payment processing services provided by Malaysian financial institutions and e-wallet operators. While Garuda404 takes care in selecting reputable and compliant third-party partners, we are not responsible for the privacy practices of third-party services.

The Platform does not contain links to external third-party websites for advertising or promotional purposes. Any links that exist on the Platform are strictly functional — such as links to payment provider authentication pages — and are necessary to provide the service you have requested.

Policy Amendments

Garuda404 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. When material changes are made, we will notify registered players via their registered email address and/or through a prominent notice on the Platform prior to the changes taking effect.

The "Last updated" date at the top of this Policy reflects when the most recent version was published. Your continued use of the Platform following the effective date of any amended Policy constitutes your acknowledgement of and, where required, consent to those changes.

We encourage all players — particularly those based in Kuala Lumpur, Penang, Johor Bahru, Shah Alam, and Petaling Jaya — to review this Policy periodically to stay informed about how Garuda404 handles their personal data.

Contact & Data Requests

For any questions, concerns, or formal requests relating to this Privacy Policy or Garuda404's data processing practices, please contact our Data Protection team through the following channels:

We aim to acknowledge all privacy-related requests within 5 business days and to resolve data rights requests within 30 calendar days. Where an extension of this timeframe is required due to the complexity of a request, we will notify you in writing within the initial 30-day period.