Gcup3 Privacy Policy – Personal Data Protection for Malaysian Players

Gcup3 ("Platform", "We", "gcup3") is an online entertainment platform operating under the domain gcup3.best, catering specifically to users in Malaysia. We understand that privacy matters deeply to Malaysians, and we take our responsibility to protect your personal data very seriously.

This Privacy Policy ("Policy") describes how gcup3 collects, uses, stores, protects, and in certain circumstances shares the personal information you provide to us when registering for and using the gcup3 platform. It also outlines your rights regarding that personal data and how you can contact us to exercise those rights.

Gcup3 fully complies with Malaysia's Personal Data Protection Act 2010 (PDPA), the primary legislation governing the processing of personal data in commercial transactions in Malaysia. All gcup3 staff involved in processing members' personal data have undergone PDPA compliance training and are responsible for ensuring your data is handled correctly and transparently.

Gcup3 collects several categories of personal data from members and users of our platform. This data is gathered through various means as described below:

Data you provide directly to us:

• Full name as stated on your Malaysian identity card (MyKad or passport)
• A valid and active Malaysian phone number
• Account password (stored in encrypted form, unreadable by anyone including gcup3 staff)
• E-wallet or bank account information for deposit and withdrawal purposes (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, FPX bank accounts including Maybank2u and CIMB Clicks)
• Identity document if requested for identity verification (KYC)

Data collected automatically when you use the platform:

• Your device's IP address
• Type and version of web browser or application used
• Your device's operating system
• Date, time, and duration of each login session
• Pages or games visited within the gcup3 platform
• Deposit and withdrawal transaction history
• Game history including game type, bet amounts, and outcomes
• Cookie data and similar tracking technologies

Gcup3 uses the personal data collected solely for the following purposes, all of which are legitimate and necessary for operating the platform:

Gcup3 will not use your personal data for any purpose beyond those stated above without first obtaining your explicit consent. If you do not wish to receive marketing and promotional communications from gcup3, you may opt out at any time through your account settings or by contacting our support team.

Gcup3 does not sell, rent, or disclose member personal data to third parties for their own marketing purposes. However, in the course of platform operations, gcup3 may share your personal data with the following categories of third parties, and only for the stated purposes:

• Payment Service Providers: E-wallet and banking service providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and banks supporting FPX including Maybank2u and CIMB Clicks — solely to process deposits and withdrawals you have requested.
• Game Providers: Gaming companies such as Pragmatic Play, Evolution Gaming, and others — only the data necessary to deliver gameplay and maintain game integrity, typically in the form of session IDs that do not directly identify you personally.
• Malaysian Authorities: Bank Negara Malaysia, the Malaysian Communications and Multimedia Commission (MCMC), or the Royal Malaysia Police (PDRM) — only when required by Malaysian law or a valid court order.
• Technical Service Providers: Companies providing hosting, data analytics, or cybersecurity services to gcup3 — limited to technically necessary data and bound by strict confidentiality agreements with gcup3.

All third parties that receive gcup3 members' personal data are bound by data protection agreements requiring them to safeguard that data to a standard no less stringent than that set by gcup3 and Malaysia's PDPA.

Gcup3 implements a comprehensive range of technical and organisational security measures to protect members' personal data from unauthorised access, disclosure, alteration, or accidental destruction:

• Encryption in transit: All communications between your browser or app and gcup3 servers are protected by 256-bit TLS/SSL encryption, indicated by the padlock icon in your browser's address bar.
• Encryption at rest: Sensitive data such as passwords are stored in hashed form that cannot be decrypted by anyone, including gcup3 staff themselves.
• Strict access controls: Only gcup3 staff with a legitimate operational need are granted access to member personal data, and every such access is recorded in a secure audit log.
• Continuous monitoring: gcup3's systems are monitored continuously 24 hours a day to detect and respond to any suspicious activity or unauthorised access attempts.
• Regular security testing: gcup3 conducts regular penetration testing and security audits to identify and address any vulnerabilities before they can be exploited.
• Staff training: All gcup3 staff receive training on data security and privacy protection as part of their onboarding and ongoing development programmes.

While gcup3 takes all reasonable steps to protect your data, no security system in the world can guarantee 100% protection against every threat. You also play a role in keeping your account secure — by keeping your password confidential, using a strong and unique password, and notifying gcup3 immediately if you suspect any suspicious activity on your account.

Gcup3 uses cookies and similar tracking technologies to enhance the user experience, analyse platform usage, and deliver more relevant content. The following are the types of cookies used by gcup3:

• Essential Cookies: Required for the core functions of the gcup3 platform, including login authentication, session security, and language preferences. These cookies cannot be disabled as they are fundamental to the platform's operation.
• Performance Cookies: Helps gcup3 understand how users interact with the platform — which pages are visited most frequently, how much time is spent, and where users encounter difficulties. This information is used in aggregated and anonymised form to improve the platform.
• Functional Cookies: Remembers your preferences such as display language and other settings to give you a more personalised experience on gcup3.
• Analytics Cookies: Helps gcup3 analyse overall usage patterns to plan better platform improvements. This data is collected in aggregate form and does not contain any information that could identify you as an individual.

You can manage or delete cookies at any time through your web browser settings. Please note, however, that disabling essential cookies may affect the functionality of the gcup3 platform and your overall experience. For guidance on managing cookies in your specific browser, refer to your browser's help documentation.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by gcup3:

To exercise any of the above rights, you may contact the gcup3 support team via live chat on the platform or by emailing support@gcup3.best. gcup3 will respond within the timeframe stipulated by Malaysia's PDPA. In some cases, gcup3 may need to verify your identity before processing the request to ensure the security of your account.

Gcup3 retains members' personal data only for as long as necessary to fulfil the original purpose of collection or to comply with Malaysian legal requirements. The following is a general guide to data retention periods:

• Active Account Data: Retained for as long as your gcup3 account remains active and in use. If an account has been inactive for 3 consecutive years, gcup3 reserves the right to archive or delete that account's data after providing reasonable notice.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date, in accordance with Malaysian legal requirements relating to anti-money laundering and financial record-keeping.
• Security and Audit Logs: Retained for a minimum of 2 years to assist with security investigations and compliance requirements if needed.
• Customer Support Communications: Retained for 2 years from the date of the last interaction for service quality and support continuity purposes.
• Marketing Data: Retained until you withdraw your consent to receive marketing communications from gcup3.

Once the retention period has lapsed and there is no legal requirement to retain the data further, gcup3 will delete or destroy it in a secure manner to ensure it cannot be recovered by any party.

Gcup3 pays particular attention to the protection of members' financial information given its sensitivity. The following outlines how gcup3 handles your financial data:

• Gcup3 does not store your full credit card, debit card, or bank account details on our servers. All financial transactions are processed directly through payment providers approved by Bank Negara Malaysia.
• For deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u, CIMB Clicks), gcup3 only receives transaction confirmations from those providers and does not directly store your payment account details.
• Gcup3 stores the e-wallet account ID or bank account number you use for deposits solely to process withdrawals back to the same account — this is a standard fraud prevention measure required by law.
• Your deposit and withdrawal transaction history is retained as a valid financial record and can be reviewed at any time within your gcup3 account.

All financial transactions on gcup3 are conducted in Malaysian Ringgit (RM) only. gcup3 does not process or store any information relating to foreign currencies.

The gcup3 platform is intended for users aged 18 and above only. gcup3 does not knowingly collect personal data from individuals under the age of 18, and takes its responsibility to prevent access by minors seriously.

Should gcup3 discover or be notified that personal data belonging to an individual under the age of 18 has been collected without our knowledge, we will take immediate steps to delete that data and close the account in question. Parents or guardians who suspect their child has registered a gcup3 account by providing false information about their age are advised to contact the gcup3 support team at support@gcup3.best without delay.

If you have any questions, concerns, or complaints regarding gcup3's Privacy Policy or the way we handle your personal data, please contact us through the following channels:

• Email: support@gcup3.best — for written enquiries requiring documentation or further reference
• Live Chat: Available on the gcup3 platform 24 hours a day, 7 days a week — for the fastest response in Bahasa Melayu

Gcup3 is committed to responding to privacy-related enquiries within a reasonable timeframe. For requests relating to data rights under Malaysia's PDPA, gcup3 will respond within the period stipulated by that legislation. In cases where identity verification is required, the process may take slightly longer, but gcup3 will keep you updated on the progress of your request throughout.

Gcup3 may also be overseen by Malaysia's Personal Data Protection Department (PDPD). If you are not satisfied with gcup3's response to your privacy complaint, you have the right to lodge a complaint with the PDPD through their official channels.