Privacy Policy gcup8 — Personal Data Protection for Malaysian Members

Gcup8 takes every aspect of member privacy and personal data security seriously. This Privacy Policy ("Policy") explains in detail how gcup8 collects, processes, stores, protects, and discloses the personal information you provide to us when using the gcup8 platform — including the official website, mobile app, and all related services.

By registering a gcup8 account, accessing our platform, or using any of the services we provide, you agree to the practices described in this Privacy Policy. If you do not agree with any provision herein, please discontinue use of the gcup8 platform and contact us to close your account.

Gcup8 collects several categories of personal information depending on how you interact with our platform. The following outlines the types of data we collect, with specific examples and how they are gathered:

Gcup8 does not collect sensitive data such as health information, religious beliefs, political views, or sexual orientation unless you voluntarily share such information while communicating with our team.

Gcup8 processes your personal data only for legitimate and transparent purposes. The following are the primary purposes for data collection along with their legal basis:

• Account Management: Creating, verifying and managing your member account, including the KYC process required by law.
• Transaction Processing: Processing deposits, withdrawals and all financial transactions accurately and securely.
• Platform Security: Detecting and preventing fraud, money laundering, unauthorised access and other suspicious activities.
• Customer Support: Providing technical support and effectively resolving your complaints or enquiries.
• Legal Compliance: Meeting AML (Anti-Money Laundering), CTF (Counter-Terrorism Financing) and other related regulatory reporting requirements.
• Service Improvement: Analysing platform usage patterns to improve the user experience and develop new features.
• Marketing Communications: Sending promotional information, bonus offers and platform updates — only with your consent, and you may unsubscribe at any time.

Gcup8 continually invests in sophisticated cybersecurity infrastructure to ensure every member's personal data is always protected against unauthorized access, loss, destruction, or accidental disclosure.

Technical security measures implemented by gcup8 include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and gcup8 servers.
• AES-256 encryption for data stored in gcup8 databases.
• Server infrastructure protected by multi-layered firewalls and a real-time intrusion detection system (IDS).
• Two-factor authentication (2FA) is available for all member accounts as an additional layer of security.
• Regular security vulnerability scans and penetration testing by independent security experts.
• Strict internal access controls — only authorised staff with a legitimate job requirement are permitted to access member data.
• Automatic daily data backups at geographically separate data centers.

While gcup8 takes all reasonable steps to protect your data, no security system can guarantee 100% protection against every cyber threat. In the event of a data security breach affecting your personal information, gcup8 will notify you and the relevant authorities within the timeframe prescribed by law.

Gcup8 does not sell, rent, or disclose member personal data to third parties for marketing or commercial purposes. However, in the course of platform operations, gcup8 may need to share certain data with selected and trusted third parties in the following situations:

• Payment Providers: Payment gateways, banks, and e-wallet providers receive the transaction information required to securely process your deposits and withdrawals.
• KYC Service Providers: Third-party identity verification providers that assist gcup8 in carrying out the KYC process required by law.
• Game Providers: Third-party game studios receive anonymous game identifiers required to run game sessions. They do not receive your personal data directly.
• Legal Authorities: gcup8 will disclose required data to authorities such as Bank Negara Malaysia, the police, or courts when legally mandated.
• Cloud Services & Infrastructure: Cloud service providers that store and process data on behalf of gcup8 are subject to strict data processing agreements.

All third parties receiving data from gcup8 are bound by strict data confidentiality agreements and are only permitted to use such information for agreed purposes. gcup8 conducts due diligence on all third-party providers before sharing any member data.

Gcup8 uses cookies and similar tracking technologies to enhance the user experience, analyze platform usage patterns, and deliver relevant content. Cookies are small text files stored on your device when you visit the gcup8 website.

The types of cookies used by gcup8 are as follows:

• Necessary Cookies: These cookies are required for core platform functions such as login session authentication, security and language preferences. They cannot be disabled without affecting platform functionality.
• Analytics Cookies: Helping gcup8 understand how members use the platform — most visited pages, time spent and navigation paths. This data is used for platform improvement.
• Functional Cookies: Remembering your preferences such as display settings, game preferences and language choices to deliver a more personalised experience.
• Marketing Cookies: Used to display relevant promotions to you based on your interests and activity on the platform. You may disable these cookies without affecting the platform's core functionality.

You can manage or disable cookies through your web browser settings. However, disabling certain cookies may affect the functionality and your experience when using the gcup8 platform.

As a data subject under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by gcup8:

• Right of Access: You have the right to request a copy of the personal data gcup8 holds about you. Requests will be processed within 14 working days.
• Right to Correction: If your personal data is inaccurate or outdated, you have the right to request gcup8 to update it promptly.
• Right to Withdraw Consent: You may withdraw consent to the processing of your personal data at any time, unless the processing is required for legal or contractual compliance.
• Right to Restrict Processing: In certain circumstances, you may request gcup8 to restrict how we process your data while any dispute is being resolved.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes or certain profiling activities.
• Right to Complain: If you believe that gcup8 has violated your privacy rights, you are entitled to lodge a complaint with the Malaysia Personal Data Protection Commissioner.

To exercise any of the above rights, please contact the gcup8 privacy team through the available customer support channels. gcup8 will process your request promptly and notify you of the outcome within a reasonable timeframe.

Gcup8 retains member personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable laws and regulations. The following are general guidelines for gcup8 data retention periods:

Once the retention period expires, gcup8 will securely delete or anonymize the data using methods that ensure it cannot be recovered or re-identified.

In the course of operating the platform, your personal data may be transferred to and stored on servers located outside Malaysia. gcup8 ensures that any such cross-border data transfers are carried out with adequate safeguards in accordance with the requirements of PDPA 2010.

Protective measures gcup8 takes for international data transfers include:

• Ensuring that recipient countries maintain a level of data protection equivalent to or higher than Malaysia.
• Using Data Processing Agreements with all overseas providers that receive gcup8 member data.
• Ensuring that transferred data is encrypted both in transit and at rest.
• Restricting access to transferred data to authorised personnel only (need-to-know basis).

The gcup8 platform is intended exclusively for individuals aged 18 and above. gcup8 does not knowingly collect or process personal data of children under the age of 18. Should gcup8 discover that a child's data has been collected without our knowledge, immediate action will be taken to delete that data and close the associated account.

If you are a parent or guardian who believes your child has registered a gcup8 account without your consent, please contact the gcup8 customer support team immediately. gcup8 will take prompt action to resolve the matter.

Gcup8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Any material changes will be communicated to members via registered email or a prominent notice on the gcup8 platform at least 14 days before the changes take effect.

The "Updated" date at the top of this page indicates when this Privacy Policy was last revised. Your continued use of the gcup8 platform after any changes take effect constitutes your acceptance of the updated Privacy Policy.

Gcup8 recommends that you review this Privacy Policy periodically to stay informed about how we manage and protect your personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by gcup8, please contact us through the following channels: