Privacy Policy

This Privacy Policy ("Policy") issued by the operator of gtatogel ("Company", "we", "us", "our"), the online gaming and sports betting platform accessible at https://gtatogel.cam. It describes how we collect, use, store, protect, and disclose the personal information of Members and visitors ("you", "your", "User") who access or interact with the gtatogel platform.

This Policy is incorporated by reference into, and must be read alongside, our Terms & Conditions and our Responsible Gambling Policy. By using the gtatogel platform, creating an account, or making deposit, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

We are committed to the responsible handling of personal information in accordance with internationally recognised data protection principles, including those reflected in the General Data Protection Regulation (GDPR) framework, the principles of purpose limitation, data minimisation, storage limitation, and integrity and confidentiality.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, deletion, or destruction.
• "Controller" means the entity that determines the purposes and means of processing Personal Data — in this context, the operator of gtatogel.
• "Processor" means any third party that processes Personal Data on behalf of the Controller under a binding data processing agreement.
• "Data Subject" means the natural person whose Personal Data is being processed — in this context, you, the Member or visitor.
• "Consent" means a freely given, specific, informed, and unambiguous indication by a Data Subject that they agree to the processing of their Personal Data for a specific purpose.
• "KYC" means Know Your Customer — the identity verification process mandated by anti-money laundering obligations and licensing requirements.
• "Cookies" means small text files placed on your device by the Platform to facilitate functionality, security, session management, and anonymised analytics.

gtatogel collects Personal Data across several categories, depending on the nature of your interaction with the Platform. The table below summarises the categories of data collected and the primary purpose for each:

We do not collect sensitive categories of Personal Data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless this is strictly required for regulatory compliance purposes and you have provided explicit consent.

4.1 Directly from You

The majority of Personal Data we hold is provided directly by you during account registration, KYC verification submission, deposit and withdrawal requests, support interactions (live chat, email, WhatsApp), and when you update your account preferences or responsible gambling settings.

4.2 Automatically During Platform Use

When you access the Platform, certain Technical Data is collected automatically by our servers and analytics systems. This includes your IP address (used to detect geographic restrictions and prevent fraud), device and browser information, session timestamps, and click/navigation patterns within the Platform. This data is collected via server logs, session tokens, and first-party cookies.

4.3 From Third-Party Payment Providers

When you transact via Malaysian payment partners — including Maybank2u, CIMB Clicks, Public Bank, Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, or cryptocurrency networks — we receive transaction confirmation data including transaction reference numbers, amounts, timestamps, and the name associated with the sending account. We do not receive your full banking credentials from these providers.

4.4 From Identity Verification Partners

Where gtatogel engages a third-party identity verification service provider to assist with KYC document authentication, that provider will share verification results (pass/fail, document authenticity assessment) with us. The raw document images are processed in accordance with the provider's own privacy policy, and we retain only the verification outcome and reference identifier.

gtatogel processes your Personal Data on the following legal bases, which vary depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between you and gtatogel — including operating your account, processing deposits and withdrawals, and providing gaming services. This is the primary basis for most core Platform functions.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) due diligence, sanctions screening, age verification, and record-keeping requirements imposed by the Company's international gaming licence.
• Legitimate Interests: Processing necessary for the Company's legitimate business interests, where these are not overridden by your fundamental rights and freedoms. This includes fraud detection, platform security, responsible gambling monitoring, and internal analytics to improve service quality.
• Consent: Where you have provided explicit consent for specific processing activities — such as receiving promotional email communications or participation in voluntary research surveys. Consent may be withdrawn at any time by contacting our support team, though withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

We use the Personal Data we hold about you for the following purposes:

• To create, maintain, and administer your gtatogel account;
• To verify your identity and age (21+ enforcement) in accordance with KYC and AML obligations;
• To process deposits and withdrawals via Malaysian payment methods (Maybank2u, CIMB Clicks, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, BTC, USDT);
• To deliver the gaming, sports betting, and live casino services you have requested;
• To detect and prevent fraud, money laundering, collusion, bonus abuse, and other prohibited conduct;
• To monitor and enforce responsible gambling obligations, including applying self-imposed limits and self-exclusion requests;
• To provide customer support via live chat, email, and WhatsApp in English, Bahasa Melayu, and Mandarin;
• To send you transactional communications (deposit confirmations, withdrawal status updates, security alerts) — these are service communications and cannot be opted out of while your account is active;
• To send you promotional communications (bonus offers, tournament notifications) where you have provided consent — these can be opted out of at any time;
• To comply with legal and regulatory reporting obligations imposed by the Company's international gaming licence;
• To conduct internal analytics for platform improvement, game portfolio optimisation, and responsible gambling programme effectiveness;
• To resolve disputes and enforce our Terms & Conditions.

gtatogel does not sell your Personal Data. We share your data only in the circumstances described below, and only to the extent strictly necessary for the stated purpose:

7.1 Payment Processors

Transaction data is shared with Malaysian payment service providers (including but not limited to Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, and FPX operators) solely to execute deposit and withdrawal instructions. Each provider operates under its own privacy policy and relevant Malaysian financial regulation.

7.2 Identity Verification Providers

KYC documentation may be processed by a contracted third-party identity verification specialist operating under a binding data processing agreement with gtatogel. These providers are prohibited from using your data for any purpose other than identity verification on our behalf.

7.3 Regulatory and Law Enforcement Authorities

We may disclose Personal Data to regulatory bodies, law enforcement agencies, tax authorities, or courts where we are legally required to do so, or where we reasonably believe such disclosure is necessary to prevent fraud, money laundering, or other serious criminal activity. We will notify you of such disclosure where legally permitted to do so.

7.4 IT and Infrastructure Providers

Technical service providers (including cloud hosting, cybersecurity, and data analytics vendors) may access certain data as part of their contracted service delivery. All such providers operate under data processing agreements that restrict use of your data to the contracted purpose and prohibit onward transfer.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, Personal Data held by gtatogel may be transferred to the successor entity. You will be notified of any such transfer and the successor entity's privacy practices prior to the transfer taking effect, with a minimum notice period of 30 days.

As an internationally operated platform, gtatogel may transfer your Personal Data to servers and service providers located outside of Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data in transit and at destination, including:

• Data processing agreements incorporating standard contractual clauses based on internationally recognised templates;
• Transfer only to jurisdictions that maintain data protection standards broadly equivalent to those described in this Policy;
• Technical safeguards including end-to-end encryption for data in transit and encryption at rest on destination servers.

By using the gtatogel platform, you acknowledge and consent to the transfer of your Personal Data to the Company's international hosting infrastructure, subject to the safeguards described above.

gtatogel retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. Specific retention periods are as follows:

• Account and Identity Data: Retained for the duration of your active account membership, plus a minimum of 5 years following account closure, as required by AML record-keeping obligations.
• KYC Documents: Retained for a minimum of 5 years from the date of submission, or longer if required by specific regulatory instructions.
• Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in compliance with financial record-keeping requirements under the Company's gaming licence.
• Communications Data (live chat, email): Retained for 2 years from the date of the communication for quality assurance and dispute resolution purposes, then securely deleted.
• Technical / Log Data: Retained for a maximum of 12 months for security monitoring and fraud detection purposes, unless a specific incident requires extended retention.
• Marketing Consent Records: Retained for the duration of your active membership plus 3 years, as evidence of consent where required by applicable law.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised (so that it can no longer be linked to any identifiable individual) in accordance with our internal data destruction procedures.

10.1 What Are Cookies

Cookies are small text files placed on your device (computer, smartphone, or tablet) by websites you visit. They allow the website to recognise your device on subsequent visits and perform functions that make the platform operate correctly and securely.

10.2 Cookies We Use

• Performance Cookies: Anonymised analytics cookies that help us understand how Members navigate the Platform — which pages are visited most, where technical errors occur, and how long sessions last. Data collected by these cookies cannot be used to identify individual users.
• Performance Cookies: Anonymised analytics cookies that help us understand how Members navigate the Platform — which pages are visited most, where technical errors occur, and how long sessions last. Data collected by these cookies cannot be used to identify individual users.
• Functional Cookies: Remember your preferences (such as interface language, notification settings, and responsible gambling limit reminders) to provide a more consistent experience across sessions.

gtatogel does not use third-party behavioural advertising cookies, social media tracking pixels, or cross-site tracking technologies on its platform.

10.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to view, block, or delete cookies via the privacy or security settings menu. Please be aware that disabling strictly necessary cookies will impair Platform functionality, including the ability to remain logged in and to process transactions securely.

Subject to applicable legal limitations and our regulatory obligations (particularly AML and licensing record-keeping requirements), you have the following rights in relation to your Personal Data:

To exercise any of the above rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 3 business days and fulfil it within 30 calendar days. Where fulfilment requires additional time (in complex cases), we will notify you of the extension and the reason within the initial 30-day window.

gtatogel employs a multi-layered security architecture to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security programme includes:

• Transport Security: TLS 1.3 encryption for all data in transit between your device and our servers. Connections via outdated protocols (TLS 1.0, TLS 1.1) are rejected.
• Data at Rest: Sensitive Personal Data and financial records stored on our servers are encrypted using AES-256 symmetric encryption.
• Access Controls: Personal Data is accessible only to authorised gtatogel employees and contractors who require it for their specific role. Access is governed by role-based permissions, with detailed audit logs maintained for all access events.
• Two-Factor Authentication: Available and strongly recommended for all Member accounts. Administrative access to backend systems requires mandatory MFA.
• Penetration Testing: Regular independent security assessments are conducted to identify and remediate vulnerabilities in our platform infrastructure.
• Incident Response: A documented data breach response procedure is maintained. In the event of a breach posing material risk to your rights, you will be notified within 72 hours of detection.
• Staff Training: All employees who handle Personal Data receive regular data protection and security awareness training.

While gtatogel employs industry-standard security measures, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us immediately if you suspect unauthorised access.

The gtatogel platform is strictly intended for adults aged21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. Account registration requires confirmation that the applicant is aged 21 or over, and all accounts are subject to mandatory KYC identity verification that includes date of birth validation.

If we become aware that Personal Data has been collected from a person under the age of 21, we will immediately suspend the associated account, delete all collected data, and return any deposited funds to the originating payment method. If you are a parent or guardian and believe that a minor in your care has registered on the Platform, please contact us immediately at [email protected].

For tools assist in preventing underage access to online gambling platforms, we recommend using parental control software such as Gamban, Net Nanny, or your internet service provider's family filtering features.

gtatogel reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory requirements, or business operations. When material changes are made — those that substantively affect your rights or how your data is used — we will notify you by:

• Email notification to your registered address at least 14 days prior to the changes taking effect;
• A prominent notice displayed on the Platform for a minimum of 30 days following the change.

For non-material changes (such as typographical corrections, clarifications, or updates to contact details), the updated Policy will be published on this page with a revised "Last Reviewed" date, without prior individual notification. We encourage you to review this Policy periodically.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of and agreement to the updated Policy. If you do not agree to the amended Policy, you may request account closure in accordance with our Terms & Conditions.

15.1 Privacy Enquiries

For any enquiries, requests, or complaints relating to this Privacy Policy or our handling of your Personal Data, please contact our support team through any of the following channels:

• Email: [email protected] — use the subject line "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 on the Platform — average response time 3–5 minutes
• WhatsApp: Available 24/7 — number provided upon account login

15.2 Formal Complaints

If you are dissatisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. For Malaysian users, enquiries regarding the Personal Data Protection Act 2010 may be directed to the Department of Personal Data Protection Malaysia (JPDP).

We will always endeavour to resolve privacy complaints internally before escalation is required. Our Data Protection team responds to formal written complaints within 10 business days.