Privacy Policy

This Privacy Policy is issued by Garuda303 ("we", "us", "our", "the Platform"), the operator of the online casino and sports betting platform accessible at garuda303.cam. It applies to all individuals ("User", "you", "your") who visit, register on, or otherwise interact with the Garuda303 Platform.

Garuda303 provides online gaming and sports betting services — including live casino, slots, sports wagering, live football betting, lottery, and arcade games — to registered players across Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations throughout the country.

The protection of your personal data is critically important to us. We process personal data only for lawful, specified, and legitimate purposes. We do not sell your personal data to third parties for commercial gain. We maintain appropriate technical and organisational measures to safeguard the personal data we hold.

By accessing the Garuda303 Platform, registering an account, or submitting any personal data to us through any channel, you acknowledge that you have read, understood, and agree to this Privacy Policy. This Privacy Policy should be read alongside our Terms & Conditions, which govern your use of the Platform overall.

For the purposes of this Privacy Policy, the following definitions apply:

Garuda303 is the Data Controller in respect of all personal data collected through and in connection with the Platform. As Data Controller, Garuda303 determines the purposes for which and the manner in which personal data is processed.

Garuda303 operates under an international gaming licence framework and complies with applicable data protection obligations relevant to its operating jurisdiction. Users in Malaysia are protected by the rights and obligations set out in this Privacy Policy and applicable international data protection standards.

Where Garuda303 engages third-party service providers to process personal data on its behalf — including payment processors such as Maybank, CIMB, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency network processors — those parties act as Data Processors under binding data processing agreements that mandate compliance with Garuda303's data protection standards.

Garuda303 collects the following categories of personal data from Users, as necessary for the purposes described in Section 6 of this Policy:

Garuda303 collects personal data through the following means:

• Direct Submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated Technical Collection: Data collected automatically when you access the Platform, including IP address, device identifiers, browser data, and session logs, via server logs, cookies, and similar tracking technologies.
• Payment Processors: Transaction confirmation data received from payment providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency network processors, necessary to verify and reconcile deposits and withdrawals.
• Third-Party Game Providers: Game session data including wager amounts, game outcomes, and session duration provided by our third-party live casino and slot game providers, for account management and dispute resolution purposes.
• Identity Verification Providers: Where Garuda303 uses a third-party KYC verification service to authenticate identity documents, the provider may return verification status data to Garuda303.

Garuda303 processes your personal data for the following purposes:

• Account Management: To create, maintain, authenticate, and manage your Garuda303 account, including enforcing the 21+ age restriction and single-account policy.
• Service Delivery: To provide you with access to gaming, betting, live casino, and sports wagering services on the Platform.
• Payment Processing: To facilitate deposits and withdrawals via your chosen Malaysian payment methods (Touch 'n Go eWallet, Boost, DuitNow, FPX, Maybank2u, CIMB Clicks, and others), including reconciliation and fraud checks.
• KYC & Compliance: To verify your identity and age in compliance with applicable anti-money laundering (AML) and responsible gambling obligations.
• Customer Support: To respond to your enquiries, resolve disputes, and manage your support interactions via live chat or email.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover, and abuse of the Platform.
• Responsible Gambling: To implement and manage responsible gambling tools including deposit limits, session reminders, self-exclusion, and problem gambling monitoring obligations.
• Marketing Communications: To send you promotional materials about Garuda303 offers, bonuses, and new features, where you have consented to receive such communications. You may opt out at any time.
• Analytics & Platform Improvement: To analyse usage patterns and improve the performance, security, and user experience of the Platform.
• Legal Obligations: To comply with applicable laws, regulatory requirements, court orders, and law enforcement requests.

Garuda303 processes personal data on one or more of the following legal bases, as applicable to each processing activity:

• Contractual Necessity: Processing that is necessary to perform our contract with you — i.e., to provide the gaming and betting services you have registered to use.
• Legal Obligation: Processing that is required to comply with applicable legal and regulatory obligations, including KYC, AML, and responsible gambling requirements.
• Legitimate Interests: Processing that is necessary for the legitimate interests of Garuda303 or a third party, including fraud prevention, security monitoring, and Platform analytics, where such interests are not overridden by your rights and freedoms.
• Consent: Processing for optional purposes (such as marketing communications) that is conditional on your freely given, specific, and informed consent. You may withdraw consent at any time without detriment to your account.

Garuda303 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your personal data with third parties strictly in the following circumstances:

• Payment Service Providers: We share transactional data with payment processors — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB Clicks, Public Bank, Hong Leong, and cryptocurrency network processors — as strictly necessary to process your deposits and withdrawals.
• KYC and Identity Verification Providers: We may share your identity documents and personal details with regulated third-party KYC providers for age and identity verification purposes.
• Game Providers: Garuda303 works with licensed third-party game studios for live casino, slot, and sports betting products. These providers may receive session and wagering data necessary to operate their games on our Platform.
• IT and Infrastructure Providers: Service providers who host and maintain the Platform's technical infrastructure under binding data processing agreements.
• Legal and Regulatory Authorities: We may disclose your personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or regulatory direction.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of Garuda303's business, personal data may be transferred to the successor entity, subject to equivalent data protection obligations.

Garuda303 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or accounting obligations. The following general retention principles apply:

• Active Account Data: Personal data associated with an active account is retained for the duration of the account's existence.
• Transaction and Financial Data: Financial transaction records, including deposits, withdrawals, and betting history, are retained for a minimum of five (5) years from the date of the transaction, in compliance with anti-money laundering record-keeping obligations.
• KYC Documentation: Identity verification documents are retained for a minimum of five (5) years following account closure or the completion of the last transaction, as required by applicable AML regulations.
• Support and Communications Data: Customer support records are retained for a minimum of three (3) years from the date of the last communication, for dispute resolution purposes.
• Closed Account Data: Upon voluntary account closure, personal data is retained for the minimum period required by law, after which it is securely deleted or anonymised.

When personal data is no longer required, Garuda303 will securely erase, destroy, or anonymise it in a manner that prevents recovery or reconstruction.

Garuda303 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the Garuda303 Platform is encrypted using industry-standard SSL/TLS protocols, ensuring that data in transit cannot be intercepted or read by unauthorised parties.
• Encrypted Data Storage: Sensitive personal data, including identity information and financial records, is stored in encrypted form within our secure server infrastructure.
• Segregated Player Funds: Player funds are held in accounts segregated from Garuda303's operational accounts, providing an additional layer of financial protection.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. All personnel with access to personal data are subject to confidentiality obligations and regular security training.
• Fraud Detection Systems: Automated systems monitor transactional and login activity to detect and flag suspicious patterns indicative of fraud, account takeover, or money laundering.
• Regular Security Audits: Garuda303 conducts regular internal and third-party security assessments to identify and remediate vulnerabilities in our systems.

Notwithstanding the measures above, no system of data transmission or storage is completely immune from risk. Users are responsible for maintaining the security of their own account credentials and should contact Garuda303 immediately if they suspect unauthorised access to their account.

The Garuda303 Platform uses cookies and similar tracking technologies to deliver, maintain, and improve our services. Cookies are small text files stored on your device by your browser when you visit the Platform.

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the Platform. These include session authentication cookies and security tokens. These cookies cannot be disabled without impairing Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised information about how visitors interact with the Platform — including pages visited, session duration, and error reports. This data helps us improve Platform performance.
• Functional Cookies: Used to remember your preferences, such as language settings, display preferences, and previously entered form data, to improve your experience across sessions.
• Marketing and Targeting Cookies: Used, with your consent, to deliver relevant promotional content and offers based on your Platform usage patterns.

You may configure your browser to block or delete cookies at any time. Please note that disabling certain cookies may affect the functionality of the Platform. Where consent is required for non-essential cookies, we will request it via a cookie consent interface on your first visit.

As a registered User of Garuda303, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact our support team via the 24/7 live chat or email at [email protected].

Garuda303 will respond to all verified data rights requests within 30 calendar days. In complex cases, we may extend this period by a further 30 days, in which case you will be notified of the extension and the reasons for it.

The Garuda303 Platform is strictly intended for individuals aged 21 and above. We do not knowingly collect or process personal data from individuals under the age of 21. Age verification is a mandatory step in our account registration and KYC process.

If Garuda303 becomes aware that personal data has been collected from a person under the age of 21 without appropriate verification, the affected account will be immediately suspended, all associated data will be securely deleted in accordance with our retention obligations, and any wallet balance will be subject to forfeiture in accordance with our Terms & Conditions.

If you are a parent or guardian and believe that your child may have registered on the Garuda303 Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

Garuda303 operates within an international infrastructure. Some of the personal data we collect may be stored or processed in jurisdictions outside of Malaysia. Where personal data is transferred internationally, Garuda303 ensures that appropriate safeguards are in place to protect your data in accordance with applicable data protection standards, including:

• Binding contractual clauses with international Data Processors requiring them to maintain data protection standards equivalent to those described in this Policy.
• Transfers only to jurisdictions or recipients that provide an adequate level of data protection as recognised by applicable regulatory frameworks.
• Implementation of supplementary technical and organisational measures where required to ensure the protection of transferred data.

Garuda303 reserves the right to update or amend this Privacy Policy at any time. Changes may be made to reflect updates to our services, changes in applicable law or regulation, or improvements to our data protection practices. The "Last Updated" date at the top of this document will reflect the most recent revision.

Where changes are material, Garuda303 will notify registered Users via email or by displaying a prominent notice on the Platform. Your continued use of the Platform following notification of a material change constitutes your acceptance of the updated Policy.

We encourage you to review this Privacy Policy periodically to remain informed about how Garuda303 protects your personal data.

For any queries, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the Garuda303 Data Protection team through the following channels:

When contacting us regarding a data protection matter, please include your registered account username and a clear description of your request or concern to enable us to respond efficiently.

This Privacy Policy was last reviewed and updated on 1 January 2026. Garuda303 reserves all rights not expressly granted herein.