Privacy Policy

This Privacy Policy ("Policy") describes how Garuda678 ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and protects the personal data of individuals ("Users", "Players", "you") who access or use the services available at garuda678.cam.

Garuda678 is committed to handling all personal data responsibly and in compliance with applicable data protection legislation. As a platform serving players primarily across Malaysia — including those in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — we are mindful of our obligations under Malaysian law and applicable international data protection standards.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling policy, all of which together form the full agreement governing your relationship with Garuda678.

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed to them below:

• "Personal Data" — Any information that identifies or could reasonably be used to identify a natural person, directly or indirectly. This includes names, identification numbers, contact details, financial information, and online identifiers such as IP addresses.
• "Processing" — Any operation performed on Personal Data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — Garuda678, which determines the purposes and means of processing your Personal Data.
• "Data Processor" — A third party that processes Personal Data on behalf of Garuda678, under Garuda678's instructions and subject to data processing agreements.
• "KYC Data" — Identity verification documentation submitted by a User as part of the Know Your Customer process, including government-issued identification documents and proof of address.
• "Cookies" — Small text files placed on your device by the Platform to facilitate functionality, session management, analytics, and personalisation.
• "Sensitive Data" — A sub-category of Personal Data that warrants heightened protection, including financial account details, government-issued identification numbers, and documentation submitted during KYC.

Garuda678 collects Personal Data through multiple touchpoints across the lifecycle of a player's engagement with the Platform. The categories of data collected are outlined below:

Garuda678 does not collect Personal Data beyond what is necessary for the purposes described in this Policy. You are under no obligation to provide data marked as optional; however, failure to provide data required for KYC or account verification may limit your ability to withdraw funds or access certain Platform features.

Garuda678 processes your Personal Data for the following specific purposes. Processing is carried out only where a valid legal basis exists, as described in Section 5 of this Policy.

• Account Management: To create, verify, maintain, and where necessary close your Garuda678 player account, including processing changes to account details and credentials.
• Identity Verification (KYC): To verify that you satisfy the eligibility criteria for use of the Platform, including confirmation of age (21+), identity, and residential address, as required by anti-money laundering and responsible gambling obligations.
• Transaction Processing: To facilitate deposits, withdrawals, bonus disbursements, and refunds in Malaysian Ringgit (MYR) via the payment methods you select, including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, and FPX.
• Regulatory Compliance: To meet our obligations under applicable anti-money laundering (AML) legislation, counter-financing of terrorism (CFT) requirements, and responsible gambling frameworks.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, account abuse, multiple account creation, and other prohibited conduct as defined in our Terms & Conditions.
• Customer Support: To respond to enquiries, resolve complaints, and provide ongoing technical and account support through our 24/7 live chat service.
• Responsible Gambling: To monitor player behaviour for indicators of problematic gambling activity and to administer self-exclusion, deposit limit, and session limit tools where requested.
• Platform Improvement: To analyse usage patterns, game performance, and user experience data in aggregate form to improve the functionality and content offering of the Platform.
• Marketing Communications: To send promotional communications, bonus offers, and Platform updates to players who have opted in to receive such communications. Players may withdraw consent at any time through their account settings.

Garuda678 processes your Personal Data only where a legitimate legal basis applies. The legal grounds on which we rely are as follows:

• Contractual Necessity: Processing that is necessary to perform the contract between you and Garuda678 — including account creation, identity verification, transaction processing, and customer support — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing carried out to comply with applicable anti-money laundering, counter-terrorism financing, and data retention laws is conducted on the basis of legal obligation.
• Legitimate Interests: Processing for the purposes of fraud detection, platform security, responsible gambling monitoring, and aggregate analytics is conducted on the basis of our legitimate interests, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for marketing communications is conducted only where you have provided freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time by updating your communication preferences in your account settings.

Garuda678 does not sell your Personal Data to third parties. We do not share your data for the commercial benefit of unrelated third parties. Sharing of data is limited to the following categories of recipients, each engaged under appropriate data processing agreements or legal obligations:

• Payment Service Providers: Data necessary to process your deposit or withdrawal is shared with your selected payment provider (such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, or FPX). These providers process your financial data under their own applicable privacy policies and are bound by financial services regulations.
• Identity Verification Partners: KYC data, including identification documents, may be shared with third-party verification service providers who assist in confirming identity and age eligibility. Such providers are engaged under strict data processing agreements and are prohibited from using your data for any purpose beyond verification.
• Technology & Infrastructure Providers: Providers of hosting, cloud infrastructure, fraud detection, customer support tools, and analytics platforms may have access to technical and behavioural data to the extent necessary to provide their services.
• Game Content Providers: Game studios and software providers may receive limited technical data (such as session tokens and game round identifiers) necessary to deliver and audit game outcomes. These providers do not receive personally identifiable information beyond what is technically required.
• Regulatory Authorities: Garuda678 may disclose Personal Data to competent financial intelligence units, law enforcement bodies, or regulatory authorities where required by applicable law, a court order, or a legal obligation. We will, where legally permissible, notify you of such disclosure.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or a portion of Garuda678's business assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

Garuda678 uses cookies and similar tracking technologies to operate and improve the Platform, maintain session integrity, and analyse usage patterns. The following categories of cookies are used on the Platform:

• Strictly Necessary Cookies: Essential for core Platform functionality, including session authentication, security verification, and load balancing. These cookies cannot be disabled without impairing Platform operation.
• Functional Cookies: Used to remember your preferences, such as language settings, preferred game categories, and display configurations, to provide a personalised experience across sessions.
• Performance & Analytics Cookies: Collect anonymised data about how players interact with the Platform — including pages visited, session duration, and navigation paths — to improve functionality and user experience. Data collected is aggregated and does not identify individual users.
• Security Cookies: Used to detect and prevent fraudulent activity, multiple account creation, and suspicious access patterns. These cookies support the integrity of the Platform and protection of all players.

You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the Platform. Strictly necessary and security cookies cannot be disabled by browser settings alone without disrupting Platform access.

Garuda678 does not use third-party advertising or retargeting cookies for the purpose of displaying advertisements for our Platform on external websites.

Garuda678 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Personal Data associated with an active player account is retained for the duration of the account's existence on the Platform.
• Closed Account Data: Following the closure of a player account, Personal Data is retained for a minimum period of five (5) years to comply with applicable anti-money laundering, counter-terrorism financing, and financial record-keeping obligations.
• KYC Documentation: Identity verification documents are retained in accordance with the retention periods prescribed by applicable regulatory frameworks, typically not less than five (5) years from the date of verification.
• Transaction Records: Financial transaction records, including deposit and withdrawal histories in Malaysian Ringgit (MYR), are retained for a minimum of five (5) years from the date of the relevant transaction.
• Support Communications: Customer support records, including live chat logs and email correspondence, are retained for a period of three (3) years from the date of the interaction.
• Marketing Data: Where processing is based on consent for marketing purposes, data is retained until consent is withdrawn or the account is closed, whichever is earlier.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents any possibility of re-identification.

Garuda678 implements robust technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and the Garuda678 servers is encrypted using industry-standard Transport Layer Security (TLS) protocols — the same level of protection employed by major Malaysian financial institutions.
• Encrypted Storage: Personal Data and KYC documentation stored on Garuda678 systems is encrypted at rest using AES-256 or equivalent encryption standards.
• Access Controls: Access to Personal Data is restricted on a strict need-to-know basis. Employees and contractors who access Personal Data are subject to confidentiality obligations and undergo appropriate data security training.
• Two-Factor Authentication: Player accounts are protected by two-factor authentication mechanisms to prevent unauthorised access even in the event of credential compromise.
• Fraud Monitoring: Automated systems monitor transaction activity and login behaviour continuously for anomalies indicative of account compromise or fraudulent activity.
• Incident Response: Garuda678 maintains a documented data breach response procedure. In the event of a data breach likely to result in risk to your rights and freedoms, we will notify affected users and relevant authorities in accordance with applicable regulatory requirements.

Subject to applicable data protection legislation and the limitations imposed by our legal and regulatory obligations, you hold the following rights in relation to your Personal Data held by Garuda678. You may exercise these rights at any time by contacting our support team:

Requests to exercise any of the above rights will be processed within a reasonable timeframe and in any event within thirty (30) days of receipt. We may request proof of identity before processing a data rights request to prevent unauthorised disclosure.

Please note that certain rights are subject to limitations where processing is required to comply with a legal obligation or to defend against legal claims.

The Garuda678 Platform is strictly intended for use by individuals who are 21 years of age or older. We do not knowingly collect, process, or retain Personal Data from individuals under the age of 21.

Age verification is a mandatory component of the KYC process. Any account found to belong to a person under 21 will be immediately suspended, all associated funds frozen pending investigation, and the relevant Personal Data isolated from active processing systems.

Garuda678 actively employs technical controls and document verification to prevent underage access. These include mandatory age fields during registration, document-based age verification during KYC, and behavioural monitoring for age-inconsistent activity patterns.

Garuda678 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our internal data handling practices. When material changes are made, we will update the "Last Updated" date displayed on this page and, where practicable, notify registered users via email or an in-Platform notification.

Continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to remain informed of how we protect your data.

Where a change to this Policy requires your active consent — for example, a new category of processing based on consent — we will seek that consent explicitly before commencing such processing.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the Garuda678 Data Protection team through the following channels:

For matters relating to responsible gambling, self-exclusion, and player protection tools, please visit our dedicated Responsible Gambling page.