gcup3 Privacy Policy

1 Introduction & Scope

gcup3 is committed to protecting the privacy and personal data of all individuals who interact with the platform — registered members, prospective members who browse without registering, and individuals who contact gcup3 support. This Privacy Policy sets out the categories of personal data gcup3 collects, the purposes for which that data is used, the legal bases on which processing is carried out, the third parties with whom data may be shared, and the rights available to data subjects.

gcup3 operates under international gaming licensing standards that impose specific data protection obligations, including requirements around identity verification, anti-money laundering record-keeping, and responsible gaming monitoring. Compliance with these requirements may necessitate the collection and retention of data beyond what might otherwise be required for the day-to-day operation of the platform.

2 Personal Data We Collect

gcup3 collects the following categories of personal data:

• Identity Data: Full legal name, date of birth, nationality, and government-issued identification document details (e.g., MyKad number, passport number) collected during account registration and identity verification.
• Contact Data: Email address, mobile phone number, and any correspondence sent to gcup3 support channels.
• Financial Data: Bank account details, e-wallet identifiers (e.g., Touch 'n Go eWallet, Boost), transaction history including deposits, withdrawals, and wagers, and payment card details where applicable.
• Account Data: Username, encrypted password, account preferences, bonus and promotional usage history, VIP tier status, and session history.
• Technical Data: IP address, browser type and version, device type and operating system, time zone, screen resolution, and referral URL.
• Usage Data: Pages visited on the gcup3 platform, games played, betting patterns, session duration, and interaction logs.
• Communications Data: Records of live chat conversations, email correspondence, and support tickets submitted to gcup3.
• Responsible Gaming Data: Self-imposed deposit limits, cool-off periods, self-exclusion requests, and any responsible gaming assessments carried out by gcup3 in accordance with its licensing obligations.

3 How We Collect Your Data

gcup3 collects personal data through the following methods:

• Direct submission: Data you provide when registering a gcup3 account, completing identity verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically as you navigate the gcup3 platform, including via cookies, web beacons, server logs, and similar tracking technologies.
• Third-party sources: Data received from identity verification providers, payment processors, fraud prevention services, and credit reference agencies as part of our regulatory compliance obligations.
• Publicly available sources: In limited circumstances, gcup3 may verify identity or compliance status against publicly available databases as permitted by applicable law.

4 Purpose & Legal Basis for Processing

gcup3 processes personal data only for specific, defined purposes. The table below summarises the primary purposes and the corresponding legal basis for each:

• Account registration and management — necessary for the performance of the contract between you and gcup3.
• Identity verification and age confirmation — legal obligation under gcup3's gaming licence and anti-money laundering requirements.
• Processing deposits, withdrawals, and bets — necessary for the performance of the contract.
• Fraud prevention and security monitoring — legitimate interests of gcup3 in protecting the platform and its members; legal obligation under AML regulations.
• Customer support — necessary for the performance of the contract; legitimate interest.
• Responsible gaming monitoring and intervention — legal obligation under gcup3's licensing requirements; legitimate interest in member welfare.
• Marketing communications — consent, where separately obtained. You may withdraw consent at any time by updating your gcup3 account communication preferences.
• Platform analytics and improvement — legitimate interest in improving the gcup3 platform.
• Regulatory reporting and compliance — legal obligation.

5 Data Sharing & Disclosure

gcup3 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. gcup3 shares personal data only in the following circumstances:

• Service providers: Third-party entities that process data on gcup3's behalf under binding data processing agreements, including payment processors (Maybank, CIMB, Public Bank, Touch 'n Go eWallet, Boost and their technology intermediaries), identity verification providers, cloud hosting providers, and customer support software vendors.
• Game providers: Licensed game studios and platform aggregators whose games are offered on gcup3 may receive session and wagering data necessary to operate the games and calculate payouts.
• Regulatory and law enforcement authorities: gcup3 will disclose personal data to regulatory bodies, law enforcement agencies, or courts when required to do so by law, court order, or in connection with its gaming licence obligations.
• Fraud prevention agencies: gcup3 may share data with internationally recognised fraud prevention and AML databases to fulfil its legal compliance obligations.
• Corporate transactions: In the event of a merger, acquisition, or sale of substantially all of gcup3's assets, member data may be transferred to the acquiring entity, subject to equivalent privacy protections.

All third parties with whom gcup3 shares personal data are required to process that data in compliance with applicable data protection law and are prohibited from using it for any purpose other than the specific purpose for which it was shared.

6 Cookies & Tracking Technologies

gcup3 uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device when you visit gcup3.net. gcup3 uses the following categories of cookies:

• Strictly necessary cookies: Required for the gcup3 platform to function — session management, authentication, security, and fraud prevention. These cannot be disabled.
• Functional cookies: Used to remember your preferences and personalise your gcup3 experience, such as language settings and your last-used game lobby.
• Analytical cookies: Used to understand how members use the gcup3 platform — pages visited, session duration, navigation paths — to help improve the product. Data is aggregated and anonymised where possible.
• Marketing cookies: Used to measure the effectiveness of gcup3's promotional campaigns. These are only placed where you have provided consent.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the gcup3 platform.

7 Data Retention

gcup3 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, and contractual obligations. Specific retention periods include:

• Account and transaction data: Retained for a minimum of five years following account closure, in accordance with anti-money laundering regulations applicable to licensed gaming operators.
• Identity verification documents: Retained for the period required by gcup3's licensing authority, typically five to seven years post-closure.
• Support communications: Retained for three years following resolution of the relevant support interaction.
• Marketing preference records: Retained until you withdraw consent or request deletion, plus an additional period to evidence compliance.
• Technical and usage logs: Retained for up to 12 months in identifiable form; anonymised analytical data may be retained indefinitely.

Following the expiry of applicable retention periods, gcup3 will securely delete or anonymise personal data in accordance with its data disposal procedures.

8 Data Security

gcup3 implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and gcup3's servers.
• Encryption of sensitive data at rest, including payment credentials and identity document data.
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments by independent security professionals.
• Continuous monitoring of platform infrastructure for anomalous access patterns or potential security incidents.
• Multi-factor authentication for internal systems processing personal data.

In the event of a data breach that poses a risk to member rights and freedoms, gcup3 will notify affected members and the relevant regulatory authority within the timeframes required by applicable law.

9 Your Data Rights

Subject to applicable law and the terms of gcup3's gaming licence, you have the following rights in relation to your personal data held by gcup3:

• Right of access: You may request a copy of the personal data gcup3 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data in certain circumstances — note that gcup3 may be required to retain certain data for regulatory compliance periods even after account closure.
• Right to restrict processing: You may request that gcup3 limit the processing of your personal data in certain circumstances pending a dispute or verification.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request that gcup3 provide your data in a structured, machine-readable format.
• Right to object: You may object to processing based on gcup3's legitimate interests, and you may withdraw consent for marketing communications at any time.

To exercise any of the above rights, contact gcup3 support via live chat or email at [email protected]. gcup3 will respond to data rights requests within 30 days. Requests may be subject to identity verification before processing.

10 Children & Minors

The gcup3 platform is strictly intended for adults aged 21 and above. gcup3 does not knowingly collect personal data from individuals under the age of 21. If gcup3 becomes aware that personal data has been collected from a minor, that data will be deleted immediately and the associated account will be closed.

If you believe that a minor has registered a gcup3 account or that gcup3 holds data relating to a minor, please contact support immediately at [email protected] so that corrective action can be taken without delay.

11 International Data Transfers

As an internationally licensed gaming operator, gcup3 may transfer personal data to third-party processors or group entities located outside Malaysia. Where such transfers occur, gcup3 ensures that appropriate safeguards are in place — such as standard contractual clauses or equivalent data protection frameworks — to ensure that the personal data of Malaysian members receives a level of protection equivalent to that required under applicable Malaysian data protection law.

By using the gcup3 platform, you consent to the transfer of your personal data to jurisdictions outside Malaysia for the purposes described in this Privacy Policy, subject to the safeguards described above.

12 Third-Party Links

The gcup3 platform may contain links to third-party game providers, promotional partners, or informational resources. These third-party sites are not operated by gcup3 and have their own privacy policies. gcup3 is not responsible for the data practices of any third-party site and recommends that you review the privacy policy of any site you visit via a link from gcup3. This Privacy Policy applies solely to data collected and processed by gcup3 in connection with the gcup3.net platform.

13 Amendments to This Policy

gcup3 may update this Privacy Policy from time to time to reflect changes in data protection law, gcup3's data practices, or its licensing obligations. Where a material change is made, gcup3 will notify registered members via the platform or by email to the registered address at least seven days before the change takes effect.

The "Last Updated" date at the top of this document reflects the date of the most recent revision. We encourage you to review this Privacy Policy periodically. Continued use of the gcup3 platform following any amendment constitutes your acceptance of the updated policy.

14 Contact & Complaints

If you have any questions, concerns, or complaints regarding gcup3's data practices or this Privacy Policy, please contact the gcup3 Data Support team:

• Live chat: Available 24/7 directly on the gcup3 platform — the fastest way to reach us.
• Email: [email protected] — please use the subject line "Privacy Enquiry" and include your registered username.

gcup3 will acknowledge privacy enquiries within 48 hours and endeavour to resolve them within 30 calendar days. If you are not satisfied with gcup3's response, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.