Privacy Policy

01 Introduction

gcup7 ("the Platform", "we", "us", "our") respects the privacy of every individual who registers for, accesses, or interacts with any service provided through the gcup7 website located at gcup7.cam ("the Website"). This Privacy Policy ("Policy") sets out the basis on which we collect, process, store, share, and protect personal data in connection with the operation of the Platform.

By registering an account, depositing funds, placing a wager, or otherwise using the Website, you acknowledge that you have read and understood this Policy and agree to the processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy.

02 Scope & Application

This Policy applies to all personal data collected by gcup7 in the course of operating the Platform, including data collected through:

• The gcup7 Website and any associated mobile-optimised interface.
• The account registration and KYC verification process.
• Deposit and withdrawal transactions processed via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency channels.
• Customer support interactions conducted via live chat, WhatsApp, or email.
• Technical data collected automatically when you access or use the Website (such as IP address, device identifiers, and browser type).
• Promotional or loyalty programme participation.

This Policy does not apply to third-party websites, payment processors, or service providers that operate independently of gcup7, even where a link to or from the Website is present. We encourage you to review the privacy policies of any third-party services you interact with separately.

03 Definitions

For the purposes of this Policy, the following terms are defined as follows:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, payment details, device identifiers, and location data.
• "Processing" — any operation performed on Personal Data, whether or not by automated means, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — gcup7, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" — any third party that processes Personal Data on behalf of gcup7 in accordance with our written instructions.
• "Data Subject" — the individual to whom the Personal Data relates; in the context of this Policy, primarily a registered Player on the Platform.
• "KYC" — Know Your Customer; the identity and age verification process required by gcup7's regulatory obligations.
• "Cookies" — small text files placed on a user's device by the Website to facilitate functionality, analytics, or personalisation.

04 Data We Collect

gcup7 collects Personal Data across several categories, depending on how you interact with the Platform. The following table summarises the main categories of data we collect and the primary method of collection:

We do not knowingly collect special categories of sensitive personal data (such as data concerning racial origin, political opinions, health, biometric data, or criminal convictions) except where strictly required by applicable law or regulatory obligation, in which case such data will be handled with additional protective measures.

05 How We Use Your Data

gcup7 processes your Personal Data for the following specific purposes:

1. Account Management: To create, maintain, and administer your gcup7 account, including authentication, password resets, and account security notifications.
2. Identity & Age Verification (KYC): To verify that you meet the minimum age requirement of 21 years and to confirm your identity in compliance with our licensing obligations and anti-money-laundering (AML) requirements.
3. Payment Processing: To process deposits and withdrawals via your chosen payment channel (Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Boost, GrabPay, BTC/USDT) and to maintain accurate financial records.
4. Platform Delivery: To provide access to games, sports betting markets, live dealer services, and all other features of the Platform.
5. Responsible Gambling: To monitor betting patterns and account activity for indicators of problem gambling behaviour, and to administer self-exclusion, deposit limit, and cool-off period requests in accordance with our Responsible Gambling Policy.
6. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover attempts, and other security threats.
7. Customer Support: To respond to enquiries, complaints, and support requests submitted via live chat, email, or WhatsApp.
8. Legal Compliance: To comply with applicable laws, regulatory requirements, court orders, and the instructions of competent authorities.
9. Service Improvement: To analyse platform usage patterns for the purpose of improving the user experience, correcting technical issues, and developing new features.
10. Marketing Communications: To send you promotional offers, loyalty programme updates, and platform news — where you have given explicit consent or where permitted by applicable law. You may opt out of marketing communications at any time.

06 Legal Basis for Processing

gcup7 processes your Personal Data on the following legal bases, which vary depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between gcup7 and the Player (i.e., the account agreement and these Terms), including account creation, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC verification, AML screening, and the maintenance of financial records.
• Legitimate Interests: Processing carried out for gcup7's legitimate business interests where those interests are not overridden by the Player's fundamental rights, including fraud prevention, platform security, and service improvement analytics.
• Consent: Processing carried out on the basis of the Player's freely given, specific, informed, and unambiguous consent, principally in the context of direct marketing communications. Consent may be withdrawn at any time without prejudice to the lawfulness of processing carried out prior to withdrawal.

07 Data Sharing & Disclosure

gcup7 does not sell, rent, or trade your Personal Data to any third party. We may share your Personal Data in limited circumstances with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment Service Providers: Financial institutions and payment processors (including those facilitating DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency transactions) receive transactional data necessary to process your deposits and withdrawals.
• Identity Verification Partners: KYC and AML service providers receive identity and document data for the purpose of verifying Player identity and age in compliance with our regulatory obligations.
• Game Studios & Content Providers: Licensed third-party game providers receive the minimum technical data necessary to deliver game content and record game outcomes. They do not receive full Personal Data profiles.
• Regulatory & Law Enforcement Authorities: We may disclose Personal Data to competent regulatory authorities, law enforcement agencies, or courts of law where required by applicable law, court order, or regulatory direction.
• Professional Advisers: Legal, accounting, audit, and insurance advisers may access Personal Data to the extent necessary to provide their professional services, subject to strict confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of gcup7's assets, Personal Data may be transferred to the successor entity, subject to equivalent data protection commitments.

08 Data Retention

gcup7 retains Personal Data for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention guidelines apply:

• Account and KYC Data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in compliance with AML and financial record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of seven (7) years in accordance with applicable financial regulation requirements.
• Customer Support Records: Retained for two (2) years following the resolution of the relevant support interaction, unless a longer period is required by law or ongoing dispute.
• Marketing Consent Records: Retained for the duration of the applicable consent period and for one (1) year thereafter as evidence of consent.
• Technical and Log Data: Typically retained for thirteen (13) months for security monitoring and platform improvement purposes, then deleted or anonymised.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. Where anonymisation is not technically practicable, data is pseudonymised and access restricted.

09 Security Measures

gcup7 implements a comprehensive range of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit TLS/SSL encryption for all data transmitted between your device and gcup7 servers.
• Encryption at rest for sensitive data categories including identity document data and payment credentials.
• Role-based access controls limiting staff access to Personal Data to those with a legitimate operational need.
• Multi-factor authentication requirements for all Platform administrative systems.
• Regular security vulnerability assessments, penetration testing, and third-party security audits.
• Incident response procedures providing for prompt notification to affected Data Subjects and relevant authorities in the event of a data breach, in accordance with applicable law.
• Staff training on data protection obligations and secure data handling practices.

10 Cookies & Tracking Technologies

gcup7 uses cookies and similar tracking technologies on the Website to support platform functionality, remember your preferences, and analyse how players use our services. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Required for the Website to function correctly. These include session cookies that maintain your login state and security cookies that protect against cross-site request forgery. These cannot be disabled without impairing core functionality.
• Functional Cookies: Used to remember your preferences such as language settings, preferred payment method, and display options. Disabling these may reduce the personalisation of your experience.
• Analytics Cookies: Used to collect anonymised or pseudonymised data about how players navigate and use the Website, enabling us to identify and resolve technical issues and improve the user experience. Analytics data is aggregated and does not identify you personally.
• Performance Cookies: Used to monitor Platform performance, load times, and server response metrics to ensure a stable and responsive experience.

gcup7 does not use third-party advertising cookies or cross-site tracking cookies. You may manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the availability or performance of some Platform features.

11 Your Data Protection Rights

As a Data Subject, you hold the following rights in relation to your Personal Data held by gcup7. Requests to exercise any of these rights should be submitted to our support team. We will respond within thirty (30) days of receiving a verified request.

To exercise any of the above rights, please contact our Data Protection Officer as described in Section 15. We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests; however, we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

12 Minors & Age Restriction

The gcup7 Platform is strictly for individuals aged 21 years and above. We do not knowingly collect or process Personal Data from persons under the age of 21. Age verification is a mandatory component of our KYC process, and registration by minors is explicitly prohibited under our Terms & Conditions.

If you are a parent or guardian and believe your child may have registered on gcup7, please contact our support team immediately at the address provided in Section 15. We will treat all such reports with the utmost urgency and confidentiality.

13 International Data Transfers

In the course of operating the Platform and engaging third-party service providers (including payment processors, KYC providers, and cloud infrastructure services), your Personal Data may be transferred to and processed in jurisdictions outside of Malaysia. gcup7 takes the following steps to ensure that all international transfers of Personal Data are conducted with appropriate safeguards:

• Transferring data only to jurisdictions that provide an adequate level of data protection as recognised by applicable international standards.
• Implementing Standard Contractual Clauses or equivalent contractual data protection obligations with all third-party Data Processors located in jurisdictions without an adequacy determination.
• Conducting due diligence on the data security practices of all third-party recipients prior to transfer.

By using gcup7, you acknowledge that your data may be transferred internationally and consent to such transfers being conducted in accordance with the safeguards described in this section.

14 Amendments to This Policy

gcup7 reserves the right to update or modify this Privacy Policy at any time. Where changes are material, we will endeavour to notify registered Players by posting a prominent notice on the Website or by sending a communication to the email address associated with your Account. The date of the most recent revision is displayed at the top of this page.

Continued use of the Platform following the posting of any revised Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically. If you do not accept a change to this Policy, you should cease using the Platform and may request account closure in accordance with our Terms & Conditions.

15 Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by gcup7, please contact our Data Protection Officer (DPO) or our general support team through the following channels. Our support team is available 24 hours a day, 7 days a week.

We will respond to all data protection requests within thirty (30) days of receipt of a verified request. In cases of complexity or high volume, we may extend this period by a further two months, in which case we will notify you within the initial thirty-day period.