Privacy Policy

GTR888 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all individuals who interact with our online casino and sports betting platform accessible at https://gtr888.cam. This Privacy Policy ("Policy") sets out in clear, transparent terms how GTR888 collects, processes, stores, protects, and in certain limited circumstances shares your personal data.

This Policy applies to all registered Members, prospective Members who browse the GTR888 website without registering, and any individual who contacts GTR888 via live chat, email, or any other communication channel. By accessing or using the GTR888 platform, you acknowledge that you have read and understood this Policy and consent to the data processing activities described herein to the extent that consent is the applicable legal basis.

This Policy should be read in conjunction with GTR888's Terms & Conditions and Responsible Gambling Policy. Where those documents reference the handling of personal data, this Privacy Policy provides the governing framework.

In this Privacy Policy, the following terms carry the meanings assigned below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, phone number, date of birth, financial information, device identifiers, and IP addresses.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, GTR888.
• "Data Processor" means a third party that processes Personal Data on behalf of GTR888 under a contractual data processing agreement.
• "Data Subject" means the individual to whom Personal Data relates — in this context, you, the Member or site visitor.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data for a specified purpose.
• "Sensitive Data" means a subset of Personal Data requiring enhanced protection, including financial account details, identity document numbers, and biometric or health information.

GTR888 acts as the Data Controller in respect of all Personal Data collected through or in connection with the GTR888 platform. As Data Controller, GTR888 is responsible for determining the purposes for which your Personal Data is collected and the manner in which it is processed.

GTR888 operates as an online gaming and sports betting service, primarily serving registered Members located in Malaysia, including major population centres such as Kuala Lumpur, Petaling Jaya, Shah Alam, Johor Bahru, Penang, and other Malaysian states. The Platform may also be accessed by Members in other jurisdictions where use of the Platform is not prohibited by applicable law.

All data protection enquiries, subject access requests, and privacy-related complaints should be directed to the GTR888 Data Protection contact at [email protected] with the subject line "Data Protection Enquiry".

GTR888 collects Personal Data across the following categories, each of which is necessary for one or more of the purposes described in Section 7:

4.1 Registration & Identity Data

• Full legal name as it appears on government-issued identification
• Date of birth (used to verify the 21+ age requirement)
• Registered email address and Malaysian mobile number
• Username and encrypted password credentials
• Nationality and country of residence

4.2 KYC Verification Data

• Copies of government-issued photo ID (Malaysian MyKad / NRIC, Passport, Driver's License)
• Proof of address documentation (utility bills, bank statements dated within 3 months)
• Selfie photograph taken while holding identity document
• Payment method verification documents (e-wallet or bank account screenshots)

4.3 Financial & Transaction Data

• Deposit and withdrawal transaction records including amounts (in MYR), dates, and payment method references
• Payment method identifiers — e.g., partial account numbers, Touch 'n Go eWallet IDs, Maybank or CIMB account references
• Bonus and promotion participation records

4.4 Behavioural & Technical Data

• Gaming activity records: games played, bet amounts, session durations, win/loss history
• Device information: device type, operating system, browser type and version
• IP address and general geolocation data (country/city level)
• Login timestamps, session logs, and platform navigation data

4.5 Communications Data

• Content and metadata of live chat transcripts and email correspondence with GTR888 support
• Feedback and complaint records
• Promotional communication preferences (email/SMS opt-in/opt-out status)

GTR888 collects Personal Data through the following channels and mechanisms:

GTR888 processes your Personal Data only where there is a valid legal basis for doing so. The primary legal bases relied upon are as follows:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a Member — including Account management, payment processing, and providing access to gaming services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, and tax reporting duties.
• Legitimate Interests: Processing carried out in the pursuit of GTR888's legitimate business interests, including fraud prevention, platform security, responsible gambling monitoring, and service improvement — where such interests are not overridden by your rights and interests.
• Consent: Processing for which you have provided specific, informed consent — primarily in relation to direct marketing communications. You may withdraw consent at any time by updating your communication preferences in your Account settings.

GTR888 processes your Personal Data for the following specific purposes:

7.1 Account Management & Service Delivery

To create, maintain, and manage your GTR888 Account; process deposits and withdrawals via payment partners including Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, and FPX; provide access to gaming services including sports betting (Liga Super Malaysia, EPL, UFC) and casino games; and communicate essential Account notifications.

7.2 Identity Verification & Compliance

To perform KYC verification in compliance with applicable AML and CTF regulations; to verify that all Members are aged 21 years or above; to screen Members against applicable sanctions lists; and to meet any reporting obligations imposed by regulatory authorities.

7.3 Fraud Prevention & Platform Security

To detect, investigate, and prevent fraudulent activity, bonus abuse, multi-accounting, and other prohibited conduct as defined in the GTR888 Terms & Conditions; to monitor platform security and respond to security incidents; and to protect the financial integrity of GTR888 and its Members.

7.4 Responsible Gambling

To monitor gaming activity patterns that may indicate problem gambling behaviour; to enforce deposit limits, cooling-off periods, and self-exclusion requests; and to comply with responsible gambling obligations as set out in the GTR888 Responsible Gambling Policy.

7.5 Platform Improvement & Analytics

To analyse aggregated, anonymised usage data for the purposes of improving platform performance, user experience, and game catalogue curation. GTR888 does not use individually identifiable data for analytics purposes beyond what is necessary for Account management and security.

7.6 Direct Marketing (with consent)

To send you promotional communications about GTR888 bonuses, special offers, and new game releases — strictly where you have provided consent to receive such communications. You may opt out at any time via your Account settings or by contacting support.

GTR888 does not sell, rent, or trade your Personal Data to third parties for their own marketing or commercial purposes under any circumstances. Personal Data is shared with external parties only in the following limited and controlled circumstances:

• Payment Service Providers: Personal Data necessary to process deposits and withdrawals is shared with contracted payment processors (e.g., Touch 'n Go, DuitNow, FPX gateway operators, Maybank, CIMB) under contractual data processing agreements that prohibit secondary use of your data.
• Identity Verification Partners: KYC documentation may be processed by contracted third-party identity verification service providers acting as Data Processors under GTR888's instructions.
• Game Content Providers: Pseudonymised gaming session data may be shared with certified game providers for the purposes of game integrity monitoring and technical support. No directly identifying Personal Data is shared.
• Regulatory & Law Enforcement Authorities: GTR888 will disclose Personal Data to competent authorities where required to do so by applicable law, court order, or regulatory directive. GTR888 will, where legally permissible, notify affected Members of such disclosures.
• Professional Advisors: Lawyers, auditors, and accountants engaged by GTR888 may have limited access to Personal Data where strictly necessary for the provision of professional services, subject to confidentiality obligations.

GTR888 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or for such longer period as is required by applicable law or regulation. The following indicative retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual. Where anonymisation is not technically practicable, data is archived with access restrictions until deletion is performed.

GTR888 uses cookies and similar tracking technologies on the Platform to ensure essential functionality, improve user experience, and where applicable with your consent, deliver relevant content. A cookie is a small data file placed on your device when you visit a website.

You may manage your cookie preferences at any time through your browser settings. Please note that disabling certain cookie categories may affect platform functionality. GTR888 does not use third-party advertising networks or cross-site tracking technologies.

GTR888 implements a comprehensive, layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• AES-256 Encryption at Rest: All stored Personal Data, including KYC documents, financial records, and Account credentials, is encrypted using AES-256 — the same standard used by financial institutions globally.
• TLS 1.3 Encryption in Transit: All data transmitted between your device and the GTR888 platform is protected by Transport Layer Security (TLS 1.3), indicated by the HTTPS padlock in your browser.
• Role-Based Access Controls: Personal Data is accessible only to GTR888 staff with a documented operational need. Access is governed by role-based permissions and subject to audit logging.
• Two-Factor Authentication (2FA): 2FA is available and strongly recommended for all Member Accounts to prevent unauthorised access even in the event of credential compromise.
• Continuous Security Monitoring: GTR888's infrastructure is subject to continuous security monitoring, regular vulnerability assessments, and periodic penetration testing by qualified security professionals.
• Data Breach Response: In the event of a personal data breach that poses a risk to your rights, GTR888 will notify affected individuals and relevant regulatory authorities in accordance with applicable law.

As a Data Subject, you hold the following rights in respect of your Personal Data held by GTR888. GTR888 is committed to facilitating the exercise of these rights in a timely and transparent manner, subject to applicable legal limitations.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Rights Request". GTR888 will acknowledge your request within 5 business days and respond substantively within 30 days. In complex cases, this period may be extended by up to 60 days, with notification provided.

Please note that certain rights are subject to limitations where GTR888 has a legal obligation to retain data (e.g., AML retention requirements) or where exercising a right would adversely affect GTR888's ability to detect and prevent fraud.

The GTR888 platform is strictly intended for individuals aged 21 years and above. GTR888 does not knowingly collect or process Personal Data relating to persons under the age of 21. Access by minors is explicitly prohibited and actively prevented through the KYC age verification process applied to all registered Accounts.

If GTR888 becomes aware that Personal Data has been collected from an individual who was under the age of 21 at the time of collection, that Account will be immediately suspended and the relevant Personal Data will be deleted, subject to any legal retention obligations. All funds in such an Account will be handled in accordance with applicable regulatory requirements.

If you are a parent or guardian and believe that your child may have accessed the GTR888 platform, please contact us immediately at [email protected] so that appropriate action can be taken.

GTR888 may transfer your Personal Data to, or process it in, countries outside Malaysia in connection with contracted third-party service providers — including cloud infrastructure providers, identity verification partners, and payment processors. Such transfers occur where necessary to deliver GTR888 services and fulfil our legal obligations.

Where Personal Data is transferred internationally, GTR888 takes appropriate safeguards to ensure that your data receives a level of protection consistent with applicable data protection standards. These safeguards include contractual obligations (standard contractual clauses) imposed on all Data Processors receiving your data outside Malaysia, ensuring that data is processed only for the purposes specified by GTR888 and with equivalent security standards.

GTR888 does not transfer your Personal Data to jurisdictions that are known to have inadequate data protection frameworks without implementing additional contractual or technical safeguards.

GTR888 reviews this Privacy Policy periodically to ensure it accurately reflects our data processing practices and remains aligned with applicable legal and regulatory requirements. This Policy was last updated on 1 January 2026 (Version 3.2).

When material changes are made to this Policy — for example, changes to the categories of data collected, the purposes for which data is processed, or the rights available to you — GTR888 will notify registered Members via the email address associated with their Account no less than 14 days prior to the changes taking effect. For non-material updates (such as typographical corrections or minor clarifications), the updated Policy will be published on this page with the revised "Last Updated" date.

Your continued use of the GTR888 platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the changes. If you do not accept the revised Policy, you must cease using the Platform and may request Account closure in accordance with the Terms & Conditions.

For all data protection enquiries, Subject Access Requests, rights exercise requests, and privacy-related complaints, please contact the GTR888 data protection team through the following channels:

• Email: [email protected] — Subject line: "Data Protection Enquiry". Responses within 5 business days.
• Live Chat: Available 24/7 on the GTR888 platform. For data protection matters, your query will be escalated to the relevant team within 1 business day.
• Subject Access Request Response Time: GTR888 acknowledges Subject Access Requests within 5 business days and responds substantively within 30 calendar days.

GTR888 is committed to resolving all privacy concerns promptly and fairly. If you are not satisfied with our response to a privacy complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction.