Privacy Policy — gcup4

1. Introduction

This Privacy Policy (the "Policy") is issued by gcup4 (the "Company", "we", "us", or "our"), the operator of the online casino and sports betting platform accessible at https://gcup4.cam (the "Platform").

This Policy describes the types of personal data we collect from individuals who register an account, access the Platform, or interact with our services (collectively, "Players", "Users", or "you"). It also explains the purposes for which that data is used, the legal bases on which we rely, the parties with whom we may share it, and the rights you hold with respect to your personal information.

By using the gcup4 Platform — including creating an account, making a deposit, placing a bet, or contacting our support team — you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy, both of which are incorporated by reference.

2. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, directly or indirectly.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, gcup4.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates — in this context, you, the Player or User.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data.
• "KYC" means Know Your Customer identity and eligibility verification processes required under applicable compliance obligations.
• "Third Party" means any natural or legal person other than you and gcup4, including service providers, payment processors, and regulatory authorities.

3. Data We Collect

gcup4 collects Personal Data through a variety of means — directly from you during registration and account use, automatically through your interaction with the Platform, and in limited circumstances from authorised third parties such as payment service providers and identity verification agencies.

3.1 Registration & Account Data

When you create an account, we collect the following information:

• Full legal name
• Date of birth (to verify you are aged 21 or above)
• Residential address (including city, state, and postcode)
• Email address
• Mobile phone number
• Username and hashed password
• Preferred currency (MYR)

3.2 KYC & Identity Verification Data

To comply with our regulatory obligations, we may collect:

• Copies of government-issued photo identification (Malaysian NRIC, Passport, or Driver's Licence)
• Proof of residential address (utility bill or bank statement dated within three months)
• Selfie photographs holding identification documents
• Source of funds documentation where required

3.3 Financial & Transaction Data

We collect and retain records of:

• Deposit and withdrawal transactions (amounts, dates, payment methods)
• Payment method identifiers (e.g., masked bank account numbers, e-wallet account references for DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong)
• Transaction reference numbers and processing status

3.4 Gameplay & Betting Data

• Betting history, game session logs, and wagering records
• Bonus and promotion usage history
• Game preferences and session durations

3.5 Technical & Usage Data

Collected automatically when you access the Platform:

3.6 Communications Data

Records of your communications with gcup4 support — including live chat transcripts, email correspondence, and support ticket histories — are retained for operational, compliance, and quality assurance purposes.

4. How We Process Your Data

gcup4 processes Personal Data for the following purposes:

• Account creation and management — registering your account, authenticating your identity, and maintaining your account in good standing;
• Transaction processing — facilitating deposits and withdrawals via Malaysian payment methods including DuitNow, FPX, and all accepted e-wallets and bank transfers;
• KYC and compliance — verifying your identity and age (21+), meeting anti-money laundering obligations, and conducting ongoing compliance monitoring;
• Platform security — detecting and preventing fraud, unauthorised access, money laundering, and other prohibited conduct;
• Responsible gambling — monitoring gambling patterns, facilitating self-exclusion, deposit limits, and other responsible gambling tools;
• Customer support — responding to queries, resolving disputes, and providing account assistance via live chat and email;
• Legal and regulatory obligations — complying with applicable laws, responding to lawful requests from regulatory and law enforcement authorities, and maintaining required records;
• Platform improvement — analysing aggregated usage data to improve the performance, functionality, and user experience of the gcup4 Platform;
• Marketing communications — where you have provided consent, sending you relevant promotional offers and platform updates (you may withdraw consent at any time).

5. Legal Basis for Processing

gcup4 relies on the following legal bases when processing your Personal Data:

• Contractual necessity — processing required to perform our obligations under the Terms & Conditions to which you are a party (e.g., account management, payment processing);
• Legal obligation — processing necessary to comply with applicable laws and regulatory requirements, including KYC, anti-money laundering, and responsible gambling obligations;
• Legitimate interests — processing necessary for gcup4's legitimate interests in platform security, fraud prevention, and business operations, where these interests are not overridden by your rights;
• Consent — where you have given explicit consent to specific processing activities, such as receiving direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6. Data Sharing & Disclosure

gcup4 does not sell, rent, or otherwise transfer your Personal Data to third parties for their own marketing purposes. We may share your data in the following limited circumstances:

6.1 Service Providers

We engage trusted third-party service providers to assist with specific operational functions, including payment processing (DuitNow, FPX, e-wallet operators), identity verification, fraud detection, cloud hosting, and customer support technology. These providers are bound by data processing agreements and may only use your data for the specific purpose for which they were engaged.

6.2 Regulatory & Law Enforcement Authorities

gcup4 will disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, valid legal process, or where disclosure is necessary to prevent fraud, money laundering, or other serious criminal conduct.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a material portion of our business assets, your Personal Data may be transferred as part of that transaction. We will notify you in advance if such a transfer is to occur and your data is materially affected.

6.4 Responsible Gambling Partners

Where required by law or responsible gambling obligations, we may share relevant data with approved problem gambling support organisations or self-exclusion registers operating in Malaysia.

7. Data Retention

gcup4 retains Personal Data for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law.

General retention guidelines are as follows:

• Account data — retained for the duration of your account and for a minimum of 5 years following account closure, in accordance with anti-money laundering record-keeping requirements;
• KYC and identity documents — retained for a minimum of 5 years from the date of submission or account closure, whichever is later;
• Transaction records — retained for a minimum of 5 years to comply with applicable financial record-keeping obligations;
• Support communications — retained for 2 years from the date of the last interaction, or longer where a legal dispute remains unresolved;
• Technical and session data — retained for up to 12 months, subject to security and fraud investigation requirements;
• Marketing consent records — retained until consent is withdrawn and for a reasonable period thereafter to evidence that communication was lawfully sent.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction.

8. Cookies & Tracking Technologies

gcup4 uses cookies and similar technologies (collectively, "cookies") to operate and improve the Platform. Cookies are small data files placed on your device when you visit the Site.

8.1 Types of Cookies We Use

• Strictly necessary cookies — essential for the Platform to function. These include session authentication cookies and security tokens. They cannot be disabled.
• Functional cookies — remember your preferences (e.g., language, preferred game categories) to enhance your experience on return visits.
• Analytics cookies — collect aggregated, anonymised data about how the Platform is used to help us identify areas for improvement. No individual user is identifiable from this data.
• Responsible gambling cookies — store session duration data and activity indicators to support the operation of responsible gambling tools such as session time reminders.

gcup4 does not use third-party advertising or behavioural tracking cookies. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will affect the functionality of the Platform.

9. Data Security

gcup4 implements a range of technical and organisational measures to protect your Personal Data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform;
• Encryption of sensitive data at rest, including passwords (stored as salted hashes) and financial data;
• Role-based access controls limiting internal access to Personal Data to authorised personnel only;
• Regular third-party security audits and penetration testing;
• Multi-factor authentication options for Player accounts;
• Automated fraud detection and anomaly monitoring systems;
• Incident response procedures to detect, investigate, and notify affected parties in the event of a data breach.

Whilst gcup4 takes every reasonable precaution to protect your data, no method of internet transmission or electronic storage is entirely infallible. You are responsible for maintaining the confidentiality of your own account credentials and for immediately notifying us of any suspected unauthorised access to your account.

10. Your Rights

Subject to applicable law, you have the following rights with respect to your Personal Data held by gcup4. To exercise any of these rights, please contact us using the details in Section 14.

We will respond to verified requests within 30 calendar days of receipt. Where a request is particularly complex, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it. We reserve the right to request proof of identity before processing any data subject request.

11. Protection of Minors

The gcup4 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. If you are under 21, you must not create an account or use the Platform in any way.

Where gcup4 discovers or is notified that Personal Data has been collected from an individual under the age of 21, we will promptly close the associated Account, delete all associated Personal Data (subject to any legal retention obligation arising from the detection of underage access), and refund any deposited real-money funds to the originating payment method.

If you are a parent or guardian and believe that a minor has registered an account or provided us with Personal Data, please contact our support team immediately via live chat or email so that we can take appropriate action.

12. International Data Transfers

Your Personal Data may be processed by gcup4 or its authorised service providers in jurisdictions outside of Malaysia. Where such transfers occur, gcup4 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that which would apply within Malaysia.

Safeguards may include: contractual clauses approved by competent data protection authorities; processing only by service providers in jurisdictions recognised as providing an adequate level of data protection; or the implementation of binding corporate rules or other recognised transfer mechanisms.

13. Policy Amendments

gcup4 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Where material changes are made, we will provide notice to registered Players via email or a prominent notice on the Platform at least 7 days before the changes take effect.

The "Last Updated" date at the top of this page reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the Platform following the effective date of any revision constitutes your acknowledgement of the revised Policy.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by gcup4, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly through the Platform — the fastest way to reach our support and compliance team.
• Email: [email protected] (plain text only — not a clickable link)

When contacting us to exercise a data subject right (e.g., access, erasure, portability), please provide sufficient information to enable us to verify your identity and locate the relevant records. We aim to acknowledge receipt of all written requests within 5 business days and to provide a substantive response within 30 calendar days.