gcup5 Privacy Policy — How We Collect, Use & Protect Your Data

1. Introduction

gcup5 ("we", "us", "our") operates the online gaming platform accessible at gcup5.win and related sub-domains. We are committed to protecting the privacy and personal data of all individuals who interact with our platform, including registered players, prospective players and website visitors.

This Privacy Policy describes how gcup5 collects, processes, stores, shares and protects personal information in connection with the operation of its online casino and sportsbook services. It applies to all data processing activities conducted by gcup5, whether you access our services from Kuala Lumpur, Penang, Johor Bahru, Kota Kinabalu or anywhere else.

By registering a gcup5 account, making a deposit, or continuing to use the platform after this policy has been published, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, please discontinue use of gcup5 and contact us to request account closure.

2. Data Controller

For the purposes of applicable data protection legislation, gcup5 acts as the data controller in respect of personal data collected through gcup5.win. As data controller, gcup5 determines the purposes and means of processing personal data held on registered players and platform users.

Where gcup5 engages third-party service providers to process personal data on its behalf (for example, payment processors, KYC verification services and fraud detection providers), those parties act as data processors and are contractually bound to process personal data only in accordance with gcup5's written instructions and applicable data protection law.

3. Personal Data We Collect

gcup5 collects personal data in the following categories:

• Identity Data: Full legal name, date of birth, nationality, MyKad or passport number, and a copy of your identity document as submitted for KYC verification.
• Contact Data: Email address, mobile phone number, and correspondence address.
• Financial Data: Bank account details, Touch n Go eWallet account reference, Boost account reference, transaction history, deposit amounts, withdrawal amounts, and bonus utilisation records.
• Account Data: Username, encrypted password hash, account settings, responsible gaming preferences, self-exclusion records, and marketing preferences.
• Gaming Activity Data: Bet history, game session logs, win/loss records, sportsbook selections, and casino game participation records.
• Technical Data: IP address, browser type and version, device type and operating system, screen resolution, session timestamps, and cookie identifiers.
• Communication Data: Records of live chat transcripts, support tickets, email correspondence, and any feedback or dispute submissions made to gcup5.

gcup5 does not collect sensitive personal data (such as biometric data, health information or racial or ethnic origin) other than what may be incidentally contained within identity documents submitted for KYC purposes.

4. How We Collect Your Data

gcup5 collects personal data through the following methods:

1. Direct submission: When you complete the registration form, submit KYC documents, contact customer support, respond to a survey or participate in a promotion.
2. Automated technical collection: Via cookies, web beacons, server logs and similar tracking technologies as you browse and interact with gcup5.win.
3. Third-party sources: From payment processors (such as Touch n Go eWallet and Boost) confirming transaction details, from fraud detection services confirming identity or device risk signals, and from KYC verification partners who cross-check submitted identity documents against authoritative data sources.
4. Regulatory sources: From self-exclusion registers or responsible gaming databases where gcup5 is obligated to check registrations under its gaming licence obligations.

5. Legal Basis for Processing

gcup5 processes personal data on the following legal bases:

• Contractual necessity: Processing required to open and manage your account, process deposits and withdrawals, and provide the gaming services you have requested.
• Legal obligation: Processing required to comply with anti-money laundering (AML) obligations, KYC regulatory requirements, age verification duties under gcup5's gaming licence, and any reporting obligations to regulatory or law enforcement authorities.
• Legitimate interests: Processing for fraud prevention, platform security, abuse detection, responsible gaming monitoring, and improving the quality of our services — provided such interests are not overridden by your rights and interests.
• Consent: Processing for direct marketing communications (email newsletters, promotional offers) where you have opted in. You may withdraw marketing consent at any time from your account settings.

6. How gcup5 Uses Your Personal Data

gcup5 uses the personal data we collect for the following purposes:

• To create, verify, manage and maintain your gcup5 player account;
• To process deposits, withdrawals and bonus credits in MYR;
• To fulfil KYC identity and age verification requirements as required under our gaming licence;
• To detect and prevent fraud, money laundering, collusion, multi-accounting and other prohibited activities;
• To monitor for responsible gaming indicators and provide appropriate interventions or support;
• To respond to support queries, complaints and dispute resolution requests;
• To send transactional communications (account confirmations, deposit receipts, withdrawal notifications, security alerts);
• To send promotional communications where you have provided marketing consent;
• To personalise your experience on gcup5, including recommending games or sports markets relevant to your activity;
• To conduct internal analytics that improve platform performance and product quality;
• To comply with regulatory reporting requirements and respond to lawful requests from authorities.

7. Data Sharing & Third Parties

gcup5 does not sell, rent or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances:

• Payment processors: Touch n Go eWallet, Boost, Maybank, CIMB and Public Bank — solely to process your financial transactions.
• KYC and identity verification providers: Third-party services used to verify identity documents and confirm age. These providers are contractually bound to process data only for the specified verification purpose.
• Fraud and risk management providers: Services that assess device fingerprints, IP reputation and transaction patterns to protect against fraud and money laundering.
• Game software providers: Certified gaming studios whose games are accessible on gcup5 may receive anonymised session identifiers for the purpose of game functionality and dispute resolution. These providers do not receive your full identity data.
• Regulatory and law enforcement bodies: Where required by gcup5's gaming licence, applicable law, court order or regulatory directive. gcup5 will notify you of any such disclosure where legally permitted to do so.
• Corporate restructuring: In the event of a merger, acquisition, or sale of all or substantially all of gcup5's assets, personal data may be transferred to the acquiring entity subject to equivalent privacy protections.

8. Cookies & Tracking Technologies

gcup5 uses cookies and similar technologies to operate and improve the platform. The following categories of cookies are used:

• Essential cookies: Required for the platform to function. These include session authentication cookies that keep you logged in to your gcup5 account during your visit.
• Functional cookies: Remember your preferences such as language setting, display preferences and responsible gaming tool configurations.
• Analytics cookies: Collect anonymised data about how players navigate the platform, which pages are most visited, and where technical errors occur. This data is used exclusively for platform improvement.
• Security cookies: Assist in detecting fraudulent login attempts, bot activity and other security threats.

You may manage cookie preferences through your browser settings. Disabling essential cookies will impair the functionality of your gcup5 account. gcup5 does not use third-party advertising cookies.

9. Data Retention

gcup5 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for a minimum of five (5) years from the date of account closure, as required by anti-money laundering legislation.
• Transaction and gaming activity records: Retained for a minimum of five (5) years from the date of the transaction or gaming session.
• Communication records: Support correspondence is retained for three (3) years from the date of the communication.
• Marketing consent records: Retained for the duration of the consent plus three (3) years after withdrawal of consent.

After the applicable retention period expires, personal data is securely deleted or irreversibly anonymised.

10. Your Privacy Rights

Subject to applicable law and gcup5's legitimate interests and legal obligations, you have the following rights in respect of your personal data:

• Right of access: Request a copy of the personal data gcup5 holds about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data where gcup5 no longer has a lawful basis to retain it. Note that AML and regulatory obligations may prevent deletion of certain records.
• Right to restriction: Request that gcup5 restrict processing of your data while a dispute or accuracy query is being resolved.
• Right to data portability: Receive a copy of your personal data in a structured, machine-readable format where processing was based on your consent or contract.
• Right to object: Object to processing based on gcup5's legitimate interests, including profiling for responsible gaming purposes.
• Right to withdraw consent: Withdraw marketing consent at any time via your gcup5 account settings, without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact gcup5 customer support via live chat or email. We will respond to verified requests within thirty (30) days.

11. Data Security

gcup5 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and gcup5's servers;
• Encrypted storage of all passwords (one-way hashing — gcup5 staff cannot view your password in plain text);
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Regular penetration testing and security audits of the gcup5 platform;
• Segregation of player fund balances from operational finances.

Despite these measures, no online platform can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights, gcup5 will notify affected players without undue delay and in accordance with applicable regulatory requirements.

12. Children's Privacy

gcup5 does not knowingly collect personal data from persons under the age of 21. The platform is strictly restricted to adults aged 21 and above. If gcup5 becomes aware that personal data has been collected from a person under 21, the account will be immediately closed and all associated personal data deleted, except where retention is required by law. Parents or guardians who believe their child has registered with gcup5 should contact us immediately via live chat.

13. International Data Transfers

gcup5 operates under an international gaming authority licence and may process or store personal data on servers located outside Malaysia. Where personal data is transferred to recipients in jurisdictions that do not provide an equivalent level of data protection to that available in Malaysia, gcup5 will implement appropriate safeguards — such as standard contractual clauses approved by relevant data protection authorities — to ensure that your personal data receives an adequate level of protection during and after the transfer.

14. Changes to This Privacy Policy

gcup5 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will update the "Last Updated" date at the top of this page. Where the changes materially affect your rights or the way we use your personal data, we will notify registered players by email or in-platform notification. Your continued use of gcup5 following the effective date of any revision constitutes your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to raise a privacy concern, please contact gcup5 through the following channels:

• Email: support gcup5.win (plain text — not a clickable link)
• Live Chat: Available 24/7 on the gcup5 platform. Support is provided in English and Bahasa Malaysia.

We aim to respond to all privacy-related queries within five (5) business days and to formal data subject requests within thirty (30) days of receipt of a verified request.