Privacy Policy GTR33 – Your Data Protection

1

Introduction and Scope of This Policy

Gtr33 takes the responsibility of protecting your privacy very seriously. This Privacy Policy ("Policy") explains in detail how we collect, use, disclose, and protect your personal data when you use the gtr33 platform, including our website, mobile app, and all related services.

This policy applies to all users of the gtr33 platform, whether you are a registered member or simply browsing our website as a visitor. "Personal data" in this context refers to any information that can be used to identify you directly or indirectly, including your name, email address, phone number, financial information, and platform usage data.

We process your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and applicable international standards. If you have any questions regarding this policy, do not hesitate to contact our Privacy Officer using the details provided at the end of this document.

2

Types of Personal Data We Collect

We collect various types of personal data depending on your interactions with the gtr33 platform. Generally, the data we collect falls into three main categories:

Data You Provide Directly:

• Full name, date of birth, and gender upon account registration.
• Email address and mobile phone number for communication and verification.
• Payment method details including bank account or e-wallet information.
• Identity documents such as a national ID card or passport for the KYC process.
• Any information you share when contacting our customer support.

Automatically Collected Data:

• Your IP address, web browser type, and device operating system.
• Session data including pages visited, time spent, and actions taken.
• Complete transaction records including deposits, withdrawals, and wagering history.
• Approximate location data based on IP address for geographic compliance purposes.
• Error logs and diagnostic data for technical service improvement.

Data From Third-Party Sources:

• Verification information from trusted KYC service providers.
• AML watchlist screening data from recognised regulatory databases.
• Information you share via social media if you register using a social media account.

3

How We Use Your Data

The personal data we collect is used solely for legitimate and necessary purposes in operating the gtr33 platform. We never use your data beyond what is stated here without first obtaining your additional consent.

The primary purposes for which your data is used are as follows:

• Account Management: Creating and maintaining your account, processing registrations, and managing your member profile.
• Transaction Processing: Processing your deposits and withdrawals quickly and securely through integrated payment systems.
• Identity Verification (KYC): Verifying your identity as required by anti-money laundering (AML) and know-your-customer (KYC) regulations.
• Customer Support: Handling your enquiries, complaints, and support requests efficiently.
• Platform Security: Detecting and preventing fraud, multi-account usage, hacking, and activities that violate our Terms of Service.
• Marketing Communications: Sending relevant promotional information and exclusive offers — only when you have consented to receive them.
• Service Improvement: Analysing usage patterns to improve platform design, performance, and overall user experience.
• Legal Compliance: Fulfilling reporting and compliance obligations to the relevant regulatory authorities.

4

Data Sharing and Disclosure

Gtr33 does not sell, rent, or trade your personal data to any party for commercial purposes. However, in the course of operating the platform, we may need to share your data with certain parties under limited and controlled circumstances:

• Payment Service Providers: Required transaction information is shared with payment processors and banks integrated with the gtr33 platform to facilitate deposits and withdrawals.
• KYC & AML Providers: Identity data is shared with trusted third-party identity verification services to meet legal compliance requirements.
• Regulatory Authority: We may be required to disclose certain information to government or regulatory authorities when mandated by law or court order.
• Technology Service Providers: Cloud infrastructure providers, analytics services, and technical support partners may access data to perform their functions, subject to strict confidentiality agreements.
• Business Transfer: If gtr33 is involved in a merger, acquisition, or asset sale, user data may be transferred as part of the business assets, with advance notice provided to you.

Every third party with whom we share data is bound by a legally binding data protection agreement, ensuring they handle your information to a standard of security consistent with our own.

5

Data Storage and Security

Your data security is gtr33's top priority. We employ multiple layers of technical and organisational security controls to protect your personal data from any unauthorised access, modification, disclosure, or destruction.

Key security measures we implement include:

• Data encryption in transit using TLS 1.3 and 256-bit SSL protocols.
• At-rest encryption for all sensitive information.
• Role-based access control (RBAC) ensuring only authorised personnel can access specific data.
• Two-factor authentication (2FA) is mandatory for all internal access to systems containing user data.
• Regular security audits and penetration testing by independent security experts.
• Intrusion detection system (IDS) operating 24 hours a day, 7 days a week.
• Regular data backups and tested disaster recovery procedures.

6

Your Rights as a Data Subject

Under Malaysia's PDPA and the data protection principles we uphold, you have important rights regarding your personal data. gtr33 fully respects these rights and we have put in place a straightforward process for you to exercise them.

7

Cookies and Tracking Technologies

Gtr33 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. They allow the platform to remember your preferences, maintain your login session, and understand how you interact with our content.

There are several types of cookies we use:

• Essential Cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled as they are critical to platform operation.
• Performance Cookies: Collecting anonymised data on how users interact with our platform, helping us identify areas for improvement.
• Functional Cookies: Remembering your preferences such as language, display settings, and login details for your convenience.
• Marketing Cookies: Used with your consent to deliver more relevant promotional content. You may decline these cookies without affecting your use of the platform.

You can manage or delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of some gtr33 platform features.

8

International Data Transfers

As an online platform operating internationally, your personal data may be transferred to and processed in countries other than Malaysia. Such transfers are carried out as necessary to deliver our services, for example when using cloud infrastructure providers or international payment services.

Gtr33 ensures that all cross-border data transfers are safeguarded by appropriate protection mechanisms, including:

• Data processing agreements compliant with international data protection standards.
• Assessment of adequate data protection standards in the recipient country prior to any transfer.
• Standard contractual clauses binding foreign vendors to a level of protection equivalent to Malaysia's PDPA.

You can obtain more information about the safeguards used for specific data transfers by contacting our Privacy Officer.

9

Children's Privacy

The gtr33 platform is restricted to individuals aged 18 and above. We do not knowingly collect or process personal data from children or minors. If you believe that someone under the age of 18 has registered an account on our platform, please contact our support team immediately.

If we determine that personal data of a child has been collected without proper age verification, we will take immediate steps to delete that information and close the relevant account.

10

Changes to This Privacy Policy

Gtr33 reserves the right to update or modify this Privacy Policy from time to time to reflect changes in our operational practices, legal requirements, or improvements in the way we protect your data. Any material changes will be communicated to you through appropriate channels.

When we make changes to this policy, we will:

• Updating the "Last Updated" date at the top of this document.
• Sending email notifications to all registered members for significant changes.
• Displaying a clear notice on the gtr33 platform's home page for a minimum of 30 days.
• Obtaining your consent where such changes require data processing for a new and different purpose.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal information. Continued use of the gtr33 platform following notification of any policy changes will be deemed acceptance of the latest version.

11

Contact Our Privacy Officer

If you have any questions, concerns, or wish to exercise any of your rights regarding your personal data, you may contact the gtr33 Privacy Officer through the following channels:

• Email: [email protected]
• Response Time: Within 3–5 working days for general inquiries; up to 30 days for formal data access requests.
• Language: Bahasa Melayu and English are accepted.

When submitting a personal data request, please include your full name, account username, and specific details of your request to help speed up the review process. We may need to verify your identity before processing any request to ensure the security of your data.