gcup7 Privacy Policy

1. Introduction & Scope

This Privacy Policy ("Policy") applies to all personal data processed by gcup7 in connection with your use of the gcup7 platform, including the website at gcup7.app, any mobile-optimised interface, and all associated account and gaming services (collectively, the "Platform").

By registering a gcup7 account or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please do not use the Platform.

This Policy is to be read alongside the gcup7 Terms & Conditions, which govern your use of the Platform generally.

2. Data Controller

The data controller responsible for the personal data of gcup7 members is the operator of gcup7, which holds an international gaming authority licence. For all data-related enquiries, please contact: support@gcup7.app.

3. Personal Data We Collect

gcup7 collects the following categories of personal data from members and prospective members:

• Identity Data: Full legal name, date of birth, nationality, and government-issued identity document number and copy.
• Contact Data: Email address and, where provided, mobile telephone number.
• Address Data: Residential address and, where required for KYC purposes, proof of address documentation.
• Account Data: Username, hashed password, account preferences, and communication preferences.
• Financial Data: Payment method details (stored tokenised where applicable), deposit and withdrawal transaction records, and account balance history.
• Transaction Data: Records of all wagers placed, games played, bonus activity, and account credits and debits.
• Technical Data: IP address, browser type and version, device identifiers, operating system, and session timestamps.
• Usage Data: Information about how you navigate and interact with the gcup7 Platform, including pages visited and features used.
• Communications Data: Records of communications between you and gcup7 support, including live chat transcripts and email correspondence.

4. How We Collect Your Data

gcup7 collects personal data through the following means:

• Direct submission: Data you provide when registering, completing KYC, making a deposit, contacting support, or otherwise interacting with the Platform.
• Automated technologies: Technical and usage data collected automatically via cookies, log files, and similar tracking technologies when you access the Platform.
• Third-party sources: Identity verification and fraud prevention data received from licensed third-party KYC and AML service providers.
• Payment processors: Transaction confirmation data received from payment intermediaries when processing deposits or withdrawals via Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, or other supported channels.

5. Legal Bases for Processing

gcup7 processes your personal data under the following legal bases:

• Performance of a contract: Processing necessary to operate your gcup7 account, execute your bets, process deposits and withdrawals, and provide member support.
• Legal obligation: Processing required to comply with anti-money laundering (AML) legislation, Know Your Customer (KYC) requirements, and conditions of gcup7's international gaming authority licence.
• Legitimate interests: Processing carried out to detect fraud, prevent prohibited conduct, ensure platform security, and improve gcup7 services — where such interests are not overridden by your fundamental rights.
• Consent: Processing for optional marketing communications, where you have explicitly opted in. You may withdraw consent at any time by contacting support.

6. How We Use Your Data

gcup7 uses your personal data for the following purposes:

• To create, maintain, and administer your gcup7 account.
• To verify your identity and age (21+) in accordance with KYC obligations.
• To process deposits and withdrawals in MYR via your selected payment methods.
• To detect and prevent fraud, money laundering, and other prohibited conduct on the Platform.
• To provide customer support and respond to your enquiries.
• To enforce the gcup7 Terms & Conditions and this Privacy Policy.
• To provide responsible gaming tools, including monitoring for indicators of problem gambling and implementing self-exclusion where requested.
• To send transactional communications such as deposit confirmations, withdrawal notifications, and security alerts.
• To send promotional communications, where you have consented to receive them.
• To comply with reporting obligations to gcup7's licensing authority and other competent regulatory bodies.
• To improve the gcup7 Platform through aggregated, anonymised usage analysis.

7. Disclosure to Third Parties

7.1 gcup7 does not sell, rent, or trade your personal data to any third party. gcup7 may share your personal data with the following categories of third parties on a need-to-know basis:

• KYC and identity verification providers: Licensed services used to verify identity documents and assess AML risk, solely for regulatory compliance purposes.
• Payment processors: Payment intermediaries such as e-wallet operators and banking partners, solely for the purpose of processing your transactions.
• Game software providers: Certified third-party game studios whose products are hosted on the gcup7 Platform, to the extent necessary to operate game sessions and record outcomes.
• IT and security service providers: Cloud infrastructure and cybersecurity vendors engaged by gcup7 under strict data processing agreements.
• Regulatory and law enforcement authorities: gcup7 will disclose personal data to competent authorities where required to do so by law, court order, or under the conditions of its gaming licence.

7.2 All third-party processors engaged by gcup7 are required to implement appropriate technical and organisational security measures and to process personal data only in accordance with gcup7's documented instructions.

8. International Transfers

gcup7 may transfer your personal data to processors or authorities located outside Malaysia where necessary for the purposes described in this Policy. Such transfers are conducted using appropriate safeguards including contractual data transfer clauses. Where data is transferred to a jurisdiction that does not provide an equivalent level of data protection, gcup7 will implement compensating measures as required.

9. Data Security

gcup7 implements the following technical and organisational measures to protect your personal data:

• TLS 1.3 encryption for all data in transit between your browser or device and gcup7 servers.
• Encrypted storage for sensitive data at rest on gcup7 infrastructure.
• Industry-standard password hashing — no plain-text passwords are stored anywhere in the gcup7 system.
• Two-factor authentication (2FA) available to all members and mandatory for administrative accounts.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments conducted by independent third parties.
• Incident response procedures for the detection, containment, and notification of personal data breaches.

No system of security is completely impenetrable. In the event of a data breach that is likely to result in a high risk to your rights, gcup7 will notify affected members without undue delay in accordance with applicable regulatory obligations.

10. Data Retention

gcup7 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following indicative retention periods apply:

• Account and identity data: Retained for the duration of your active gcup7 account and for a minimum of five (5) years following account closure, in compliance with AML regulations.
• Financial transaction records: Retained for a minimum of seven (7) years in compliance with applicable financial recordkeeping requirements.
• Communications data: Retained for up to three (3) years from the date of the communication, unless a longer period is required for the resolution of a dispute.
• Technical and usage data: Retained in identifiable form for up to twenty-four (24) months and thereafter in anonymised, aggregated form only.

11. Cookies & Tracking Technologies

gcup7 uses the following categories of cookies on the Platform:

• Essential cookies: Required for core Platform functionality including maintaining your login session, remembering your language preference, and securing your account. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used in anonymised, aggregated form to understand how members navigate the gcup7 Platform and to identify performance issues. No individual member behaviour is profiled for commercial purposes via analytics cookies.

gcup7 does not deploy third-party advertising or retargeting cookies. You may manage cookie preferences through your browser settings; however, disabling essential cookies may affect your ability to use certain Platform features, including gcup7 login functionality.

12. Your Rights

Subject to applicable law and regulatory retention obligations, gcup7 members have the following rights regarding their personal data:

• Right of access: You may request a copy of the personal data gcup7 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to gcup7's legal retention obligations.
• Right to restriction: You may request that gcup7 restricts the processing of your personal data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to object: You may object to processing based on gcup7's legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact gcup7 support at support@gcup7.app. gcup7 targets response to data subject requests within thirty (30) calendar days. We may request proof of identity before processing any request.

13. Children & Minors

The gcup7 Platform is strictly for individuals aged 21 and above. gcup7 does not knowingly collect personal data from individuals under the age of 21. If gcup7 becomes aware that personal data has been collected from a person under 21, that data will be deleted and the associated account closed immediately. If you believe a minor has registered a gcup7 account, please contact support at support@gcup7.app immediately.

14. Changes to This Policy

gcup7 reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered members via on-platform notification or email to your registered address. Continued use of the Platform following the effective date of any amendment constitutes acceptance of the revised Policy. Please review this page periodically to remain informed of how gcup7 handles your personal data.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by gcup7, please contact our support team:

• Live Chat: Available 24/7 directly on the gcup7 Platform.
• Email: support@gcup7.app — responses within 2–4 hours.

For responsible gaming enquiries, please visit our Responsible Gaming page.