No Data Selling
gcup3 does not sell, rent, or trade your personal data to third-party marketers or data brokers under any circumstances.
256-Bit Encryption
All data in transit between your device and gcup3 servers is protected by TLS 1.3 encryption — the same standard used by major international banks.
Your Rights, Respected
You may request access to, correction of, or deletion of your personal data at any time by contacting the gcup3 support team.
Minimal Data Collection
We collect only the data strictly necessary for account operation, KYC compliance, payment processing, and security — nothing more.
Controlled Third-Party Access
Where data is shared with regulated processors such as payment providers or KYC partners, strict contractual safeguards govern its use.
Defined Retention Periods
gcup3 retains personal data only for as long as required by the specific purpose for which it was collected or as mandated by applicable law.
Introduction
This Privacy Policy ("Policy") explains how gcup3 ("gcup3", "we", "us", "our"), the operator of the online sports betting and casino platform at gcup3.cam, collects, processes, stores, and protects the personal data of individuals ("you", "your", "the Player") who access or use the Platform.
gcup3 is mindful of the trust players extend when sharing personal information. We take our responsibilities seriously and apply robust procedural and technical measures to protect your data throughout its lifecycle on our systems. This Policy is written in plain English to make your rights and our obligations easy to understand, while meeting the standard of a formal privacy notice.
This Policy should be read alongside our Terms & Conditions, which form the broader contractual framework governing your relationship with gcup3.
Malaysian Players: While gcup3 applies internationally recognised data protection principles, Malaysian players should be aware that Malaysia's Personal Data Protection Act 2010 (PDPA) may apply to certain aspects of data processing relevant to you. gcup3 acknowledges this regulatory context and has designed its data practices to be consistent with PDPA principles of transparency, proportionality, and security.
Definitions
The following terms carry the meanings assigned below wherever they appear in this Policy.
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, including name, email address, date of birth, payment details, and device identifiers. |
| Processing | Any operation performed on Personal Data, including collection, recording, storage, alteration, retrieval, use, disclosure, or deletion. |
| Data Controller | gcup3, the entity that determines the purposes and means of processing Personal Data collected through the Platform. |
| Data Processor | A third party that processes Personal Data on behalf of gcup3 under a formal data processing agreement, such as a payment gateway or KYC verification service. |
| Consent | A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a defined purpose. |
| KYC | Know Your Customer — the identity and address verification process required by gcup3 prior to processing withdrawals. |
| Cookie | A small text file placed on your device by the Platform for purposes of session management, preference storage, or usage analytics. |
Data We Collect
gcup3 collects Personal Data across several categories. The specific data collected depends on how you interact with the Platform and which services you use.
3.1 Identity and Registration Data
- Full legal name and preferred display name.
- Date of birth (used for age verification — 21+ requirement).
- Nationality and country of residence.
- Malaysian national identity card (MyKad) number or passport number, where KYC verification requires it.
3.2 Contact Data
- Email address used for account communications and promotions.
- Mobile phone number, if provided for two-factor authentication.
- Residential address, for KYC address verification.
3.3 Financial Data
- Payment method identifiers — e-wallet account references (Touch 'n Go, Boost, GrabPay), bank account numbers partially masked, or cryptocurrency wallet addresses.
- Transaction history including deposit amounts, withdrawal amounts, dates, and processing statuses, all denominated in MYR where applicable.
- Source of funds declarations provided during enhanced due diligence reviews.
3.4 Behavioural and Usage Data
- Betting and gaming activity logs including market selections, stake sizes, game types played, and session duration.
- Responsible gambling tool settings, including active deposit limits and self-exclusion status.
- Pages visited within the Platform, click-path data, and search queries within the Platform.
3.5 Technical Data
- IP address and geolocation data derived from it.
- Device type, operating system, and browser version.
- Session tokens and authentication logs.
- Cookie identifiers as described in Section 8.
3.6 Communications Data
- Content of live chat, email, and support ticket communications with the gcup3 team.
- Complaint and dispute records.
How We Collect Data
gcup3 collects Personal Data through the following channels:
- Direct submission: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a survey.
- Automated collection: Through cookies, session logs, server access records, and device fingerprinting as you interact with the Platform.
- Third-party sources: From licensed KYC verification partners, payment processors (including Malaysian e-wallet providers and banking networks), and fraud prevention services — where you have authorised those parties to share data with us or where disclosure is required by law.
Lawful Basis for Processing
gcup3 processes Personal Data only where a valid lawful basis exists. The applicable basis depends on the purpose of the processing, as summarised below.
| Processing Purpose | Lawful Basis |
|---|---|
| Account registration and management | Performance of a contract — necessary to provide the Platform services you have requested. |
| Payment processing and withdrawal verification | Performance of a contract; Legal obligation for AML/KYC compliance. |
| Identity and age verification (KYC) | Legal obligation under applicable licensing and anti-money laundering requirements. |
| Fraud detection and security monitoring | Legitimate interests of gcup3 and its players in maintaining a secure platform. |
| Responsible gambling monitoring and tool delivery | Legal obligation; Legitimate interests in player welfare. |
| Promotional communications (marketing emails) | Consent — you may withdraw consent at any time by using the unsubscribe link in any marketing email. |
| Analytics and Platform improvement | Legitimate interests in improving service quality, measured against minimal impact on privacy. |
How We Use Your Data
gcup3 uses the Personal Data it holds for the following purposes, each of which is tied to a lawful basis identified in Section 5:
- To create, verify, and maintain your Account and associated security credentials.
- To process deposits made via Touch 'n Go eWallet, Boost, GrabPay, Maybank FPX, CIMB, Public Bank, DuitNow, and other accepted methods, and to execute withdrawal requests to verified payment methods.
- To verify your identity and age (21+) through KYC procedures before processing your first withdrawal.
- To assess and manage financial risk, detect fraud, and prevent money laundering or other prohibited activities on the Platform.
- To enforce the Terms & Conditions, resolve disputes, and manage the complaints process.
- To operate the responsible gambling programme, including administering deposit limits, session alerts, cooling-off periods, and self-exclusion requests.
- To send transactional communications including account confirmations, payment receipts, security alerts, and mandatory policy update notifications.
- To send promotional communications where you have given your consent, including bonus offers and upcoming Liga Super Malaysia or EPL event notifications.
- To conduct anonymised analytics that help gcup3 improve Platform performance, navigation, and product offerings for Malaysian players.
- To comply with legal obligations imposed by regulatory authorities, including data disclosure requests from courts or competent authorities.
Marketing Opt-Out: You can withdraw consent for promotional communications at any time without affecting the legality of previous processing. Use the unsubscribe link in any marketing email or contact the support team directly to update your communication preferences.
Data Retention
gcup3 retains Personal Data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law or licensing obligations.
- Account and identity data For the duration of the active Account plus 7 years after closure, to satisfy AML and licensing record-keeping obligations.
- Financial transaction records 7 years from the date of each transaction, as required by anti-money laundering regulations.
- KYC documents 5 years after the conclusion of the business relationship, or longer where required by a competent authority.
- Support and complaint records 3 years from resolution, to enable dispute re-escalation and audit requirements.
- Marketing consent records Until consent is withdrawn, plus 1 year thereafter for evidence-of-consent purposes.
- Analytics data (anonymised) Up to 26 months in aggregated form; no identifiable personal data is retained solely for analytics purposes.
- Session cookies Purged at session end; persistent cookies deleted at expiry as stated in Section 8.
Following the expiry of the applicable retention period, Personal Data will be securely deleted or irreversibly anonymised so that it can no longer be attributed to any identifiable individual.
Security Measures
gcup3 implements a layered set of technical and organisational controls to protect Personal Data against unauthorised access, accidental loss, disclosure, or destruction:
- Encryption in transit: All data exchanged between your browser or mobile device and gcup3 servers is encrypted using TLS 1.3, the current industry standard for secure communications.
- Encryption at rest: Sensitive fields including payment method identifiers, identity document references, and authentication credentials are encrypted in the database using AES-256 encryption.
- Access controls: Internal access to Personal Data is restricted on a need-to-know basis using role-based access controls. Administrative access requires multi-factor authentication.
- Intrusion detection: Automated monitoring systems flag anomalous access patterns, login attempts from unfamiliar locations, and bulk data query activity for immediate review.
- Regular security assessments: gcup3 conducts periodic internal reviews and engages external specialists for penetration testing and vulnerability assessments on a scheduled basis.
- Incident response: A documented data breach response procedure is maintained. In the event of a breach affecting your data, gcup3 will notify you within a reasonable timeframe consistent with applicable regulatory requirements.
Your Responsibility: The security of your account also depends on you maintaining a strong, unique password and keeping your login credentials confidential. gcup3 recommends enabling two-factor authentication from your Account Security settings.
Your Rights
Subject to applicable law and certain limited exemptions, you hold the following rights in relation to your Personal Data held by gcup3. To exercise any right, contact the support team using the details in Section 15.
Right of Access
Request a copy of the Personal Data gcup3 holds about you, including the purposes for which it is processed and how long it will be retained.
Right to Rectification
Request correction of any inaccurate or incomplete Personal Data. For registered account details, updates can also be made directly through account settings.
Right to Erasure
Request deletion of your Personal Data where it is no longer required for the purpose it was collected, subject to our legal retention obligations which may prevent complete deletion.
Right to Restrict Processing
Request that gcup3 restrict processing of your data in certain circumstances — for example, while a dispute about its accuracy is being resolved.
Right to Data Portability
Request a structured, machine-readable copy of the Personal Data you provided to gcup3, where processing was based on consent or contract performance.
Right to Object
Object to processing based on legitimate interests grounds, including direct marketing. Objections to marketing will be honoured unconditionally and without delay.
gcup3 will respond to all data rights requests within 30 days of receipt. Where a request is complex or high in volume, an extension of up to a further 60 days may apply, in which case you will be notified of the extension within the initial 30-day period.
We reserve the right to request proof of identity before processing a data rights request, to ensure we do not disclose or amend your data in response to a fraudulent or unauthorised request.
Minors & Age Policy
gcup3 strictly prohibits use of the Platform by any person under the age of 21. The Platform does not knowingly collect Personal Data from individuals below this age. If it comes to gcup3's attention that Personal Data has been collected from a person under 21, that data will be deleted promptly, the Account will be closed, and any deposits will be returned to the extent they can be verified as belonging to the minor or their guardian.
Parents and guardians who believe a minor may have accessed gcup3 should contact the support team immediately using the details in Section 15.
21+ Only: By registering and using gcup3, you confirm that you are at least 21 years of age. gcup3 conducts mandatory age verification as part of the KYC process prior to processing any withdrawal.
International Data Transfers
gcup3 operates infrastructure that may involve the transfer of Personal Data across international borders, including to jurisdictions outside Malaysia. Where such transfers occur, gcup3 takes appropriate steps to ensure that your Personal Data receives a level of protection consistent with the principles set out in this Policy.
Safeguards applied to international transfers include the use of standard contractual clauses with data processors, restricting transfers to jurisdictions with adequacy determinations or equivalent protections, and conducting transfer impact assessments where required.
Payment processing for Malaysian players — including transactions via Touch 'n Go eWallet, Boost, GrabPay, and Malaysian banking networks — is handled by processors operating infrastructure within and outside Malaysia, subject to these transfer safeguards.
Amendments to This Policy
gcup3 may update this Privacy Policy periodically to reflect changes in data practices, legal requirements, or Platform functionality. The effective date at the top of the Policy will be updated whenever a revision is made.
Material changes — those that affect the type of data collected, the purposes of processing, or your rights — will be communicated by email to all registered account holders at least seven days before the changes take effect. Minor clarifications or formatting updates may be published without prior individual notice but will always be reflected in the effective date.
Continued use of the Platform following the effective date of any amended Policy constitutes your acceptance of the revised terms. Where you do not accept the changes, you may close your Account and request return of your verified balance in accordance with the Terms & Conditions.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise a data rights request, or need to report a privacy concern, please contact gcup3 through any of the following channels:
- Live Chat: Available 24/7 directly through the Platform. Typical response time is under 3 minutes. Suitable for general queries.
- Email: [email protected] — for formal data rights requests, complaints, and document submissions. Include "DATA PRIVACY REQUEST" in the subject line together with your registered Account ID for fastest routing. Responses within 24–48 hours.
- VIP Support Line: Available Mon – Sun, 9:00 AM – 11:00 PM (MYT, UTC+8) for Silver and Gold loyalty tier members needing escalated assistance.
Data Rights Requests: When submitting a formal data rights request, please include your full name as registered on the Account, your registered email address, and the specific right you wish to exercise. We may ask you to verify your identity before processing the request.