Privacy Policy — How Girang4D Protects Your Personal Data

This Privacy Policy ("Policy") is issued by Girang4D ("we", "us", "our", "the Platform") and governs the collection, use, storage, disclosure, and protection of personal data provided by or collected from users ("you", "User", "Player") of the Girang4D website accessible at https://girang4d.cam, including all associated services, features, and content.

Girang4D operates as a Malaysia-focused online casino and sports betting platform, serving players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other regions throughout the country. In the course of providing these services, we collect and process personal data as described in this Policy.

By registering an account, depositing funds, or using any part of the Girang4D platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data in the manner described herein. This Policy should be read in conjunction with our Terms & Conditions, which form part of the overall agreement governing your use of the Platform.

The following terms carry specific meanings throughout this Policy:

• "Personal Data" — any information that directly or indirectly identifies a natural person, including name, email address, identification number, IP address, payment details, and transaction records.
• "Processing" — any operation performed on personal data, including collection, recording, storage, alteration, retrieval, use, disclosure, and deletion.
• "Data Controller" — Girang4D, which determines the purposes and means of processing personal data.
• "Data Processor" — any third party that processes personal data on behalf of Girang4D, such as KYC verification providers or payment processors.
• "Consent" — freely given, specific, informed agreement to the processing of personal data for stated purposes.
• "KYC" — Know Your Customer; the identity verification process required under anti-money laundering obligations.
• "Cookie" — a small text file stored on your device by a website, used to remember your preferences and session information.
• "MYR" — Malaysian Ringgit; the primary currency used on the Platform.

Girang4D collects personal data through several channels: directly from you when you register or interact with the Platform, automatically through your use of the Platform, and from trusted third-party sources where required to verify your identity or comply with legal obligations.

3.1 Data You Provide Directly

• Full name, date of birth, and nationality
• Email address, username, and account password (stored in encrypted form)
• Malaysian National Identity Card (MyKad) number or passport number (for KYC purposes)
• Residential address and proof of address documentation
• Payment method details, including bank account identifiers associated with Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX transactions
• Cryptocurrency wallet addresses where crypto deposits (BTC, ETH, USDT TRC20, BNB) are used
• Communications submitted through customer support, live chat, and email

3.2 Data Collected Automatically

• IP address, device identifiers, and browser type
• Operating system and device model information
• Geolocation data (country/region level) derived from IP address
• Session duration, pages visited, and in-platform navigation patterns
• Game history, betting records, deposit and withdrawal transaction logs
• Login timestamps and authentication events

3.3 Data from Third Parties

• Identity verification results from accredited KYC service providers
• Fraud screening and anti-money laundering (AML) alerts from compliance partners
• Payment confirmation data from Malaysian banking partners and e-wallet providers

Girang4D uses personal data strictly for the purposes outlined below. We do not use your data for purposes beyond those stated without your explicit consent.

Girang4D processes your personal data on the following legal bases:

• Contractual Necessity: Processing is required to fulfil our obligations to you under the Terms & Conditions, including account management, payment processing, and service delivery.
• Legal Obligation: Certain data processing — particularly KYC verification and AML transaction monitoring — is required to comply with applicable anti-money laundering and financial crime prevention obligations.
• Legitimate Interest: We process certain data (such as fraud detection signals and platform analytics) on the basis of our legitimate interest in maintaining platform security, improving service quality, and preventing financial crime.
• Consent: For non-essential processing such as marketing communications and personalised promotional offers, we rely on your explicit consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

Girang4D does not sell, rent, or otherwise commercially disclose your personal data to third parties. However, we may share personal data with the categories of recipients listed below, strictly for the purposes described and subject to appropriate data protection safeguards.

• KYC and Identity Verification Providers: Accredited third-party services engaged to verify identity documents and conduct age verification checks, as required by our compliance obligations.
• Payment Processing Partners: Malaysian financial institutions, e-wallet providers (including those operating Touch 'n Go, Boost, GrabPay, DuitNow, FPX), and cryptocurrency network infrastructure, to the extent necessary to process your transactions.
• Fraud Prevention and AML Services: Specialist compliance and screening providers that help us detect and prevent fraudulent activity, money laundering, and other financial crimes.
• Technology and Infrastructure Providers: Hosting, cloud services, and cybersecurity vendors who process data on our behalf under contractual data processing agreements.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, valid court order, or regulatory directive, Girang4D may disclose personal data to competent authorities. We will notify affected users where legally permissible to do so.

Girang4D retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required to comply with applicable legal, regulatory, and compliance obligations.

• Active Accounts: Personal data is retained for the duration of your account membership on the Platform.
• Closed Accounts: Following account closure, we retain transaction records and identity documentation for a minimum of five (5) years to fulfil anti-money laundering and financial record-keeping obligations.
• Support Communications: Customer support records are retained for a period of three (3) years from the date of the last interaction.
• Marketing Data: Email addresses and marketing preferences held on the basis of consent are deleted promptly upon withdrawal of consent.
• Analytics Data: Anonymised and aggregated analytics data may be retained indefinitely as it cannot be used to identify individual users.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data destruction procedures.

Girang4D implements a multi-layered approach to data security, incorporating both technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure.

• Encryption in Transit: All data transmitted between your device and the Girang4D platform is encrypted using industry-standard 256-bit SSL/TLS encryption.
• Encryption at Rest: Sensitive data stored on our servers, including identity documents and payment information, is encrypted at rest using AES-256 standards.
• Access Controls: Access to personal data is restricted on a need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular security training.
• Two-Factor Authentication: 2FA is available for all user accounts and is strongly recommended. Internal system access by Girang4D staff requires multi-factor authentication.
• Continuous Monitoring: Our security operations team monitors the platform continuously for suspicious activity, intrusion attempts, and anomalous access patterns.
• Incident Response: In the event of a personal data breach, Girang4D will take prompt remedial action and notify affected users in accordance with applicable notification obligations.

Whilst we take all reasonable technical precautions, no method of data transmission or storage is entirely infallible. You play an important role in protecting your own data by maintaining a strong, unique password for your Girang4D account and enabling two-factor authentication.

Girang4D uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. Cookies do not contain viruses and cannot access other files on your device.

Types of cookies we use:

• Strictly Necessary Cookies: Essential for platform functionality, including maintaining your login session, securing your account, and enabling the cashier. These cannot be disabled without affecting core platform features.
• Functional Cookies: Store your preferences such as language settings, game history display, and notification options to provide a personalised experience.
• Analytics Cookies: Aggregate anonymised data on how users navigate the Platform, helping us understand usage patterns and identify areas for improvement. Individual users are not identified.
• Security Cookies: Used for fraud detection and prevention, including recognition of unusual login patterns or suspicious device activity.

Subject to applicable laws and the legitimate interests of Girang4D (including our regulatory and legal obligations), you hold the following rights with respect to your personal data. To exercise any of these rights, please contact us at the details provided in Section 15.

We will respond to all verified data rights requests within a reasonable timeframe, typically within 30 days of receipt. We may request proof of identity before fulfilling a request to protect your data from unauthorised access.

The Girang4D platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory component of the account registration and KYC process.

In the event that we discover or are made aware that an account has been registered by a person under the required minimum age, we will immediately suspend the account, delete all associated personal data in accordance with our data protection obligations, and return any deposits made — with any winnings generated forfeited.

The Girang4D platform may contain references to third-party payment services, banking institutions (such as Maybank, CIMB, Public Bank, Hong Leong Bank), and e-wallet providers (such as Touch 'n Go, Boost, and GrabPay). These references are for informational purposes and to enable legitimate payment transactions.

Where interactions with third-party payment interfaces occur as part of your deposit or withdrawal process, those interactions are governed by the respective privacy policies of the third-party providers. Girang4D is not responsible for the privacy practices of third-party services, and we encourage you to review the relevant privacy policies of any payment provider you use.

In the course of operating the Girang4D platform, personal data may be processed on servers or by service providers located outside of Malaysia. Where such international transfers occur, Girang4D takes all reasonable steps to ensure that your personal data is protected to a standard that is equivalent to or higher than the protections afforded under Malaysian data protection principles.

Transfers are conducted under appropriate safeguards, including contractual data processing agreements that bind recipient parties to equivalent privacy and security obligations. Girang4D will not transfer personal data to jurisdictions that do not provide an adequate level of data protection without your explicit consent or without implementing appropriate contractual safeguards.

Girang4D reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable laws, or the services we offer. When material changes are made, we will notify registered users by email or by posting a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date displayed at the top of this page will be revised to reflect the date of the most recent changes. Your continued use of the Girang4D platform following the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you should discontinue use of the Platform and request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the Girang4D Data Protection team through the following channels. We aim to acknowledge all privacy-related enquiries within 3 business days and to resolve them within 30 days.

When submitting a data rights request, please include sufficient information to verify your identity, such as the registered email address and username associated with your Girang4D account. This is necessary to prevent unauthorised access to another person's personal data.

For responsible gambling concerns or self-exclusion requests, please visit our dedicated Responsible Gambling page, where you will find full information on the tools and support resources available to you.