Privacy Policy GRCasino – Your Personal Data Protection

GRCasino collects your personal data only for legitimate and necessary purposes in operating a safe and responsible online gaming platform. We adhere to the principle of data minimisation – we only collect what is truly required.

Information you provide directly:

• Full name, date of birth, and gender upon account registration.
• Email address, phone number and residential address.
• Identity documents for the KYC process (MyKad, passport or driving licence).
• Payment method details such as bank account numbers or digital wallet information used.
• Information you share when interacting with our customer support team.

Information collected automatically:

• IP address, device type, operating system and web browser used.
• Platform usage data including pages visited, session duration and in-game actions.
• Approximate location data based on IP address for regional compliance purposes.
• Cookie data and similar tracking technologies (detailed in Section 6).

The personal data we collect is used solely for the purposes stated in this policy. We do not use your data for any purpose inconsistent with its original collection purpose without obtaining your prior consent.

The primary purposes for which your data is used at grcasino are as follows:

• Account Management: To create, verify, and manage your account on the grcasino platform.
• Transaction Processing: To process deposits, withdrawals, and any related financial transactions.
• Legal Compliance: To fulfil KYC, AML (anti-money laundering) obligations and reporting requirements as required by law.
• Platform Security: To detect and prevent fraud, account abuse, and any unlawful activity.
• Service Improvement: To analyse usage patterns and improve the platform, games, and overall user experience.
• Communication: To send important account notices, policy updates, and promotional information (with your consent).
• Responsible Gaming: To monitor gaming patterns and provide support to players who may need assistance related to responsible gaming.

GRCasino processes your personal data on a valid legal basis. Depending on the type of processing, we rely on one of the following bases:

• Contract Performance: Processing required to fulfill the service agreement between you and grcasino, including account management and transaction processing.
• Legal Obligation: Processing required to comply with applicable laws such as AML regulations, KYC requirements, and financial reporting obligations.
• Legitimate Interest: Processing required for the legitimate interests of grcasino such as fraud detection, platform security, and service improvement.
• Consent: For marketing communications and certain cookie usage, we rely on your explicit consent, which can be withdrawn at any time.

GRCasino does not sell, rent or trade your personal data to third parties for their marketing purposes. However, in operating our services, we may need to share your data with the following categories of parties in limited circumstances:

• Service Providers: Companies we use to support our operations — such as payment processors, game software providers, cloud service providers, and analytics companies — are all bound by strict data protection agreements.
• Regulatory Authority: When required by law, court order or a legitimate request from a relevant authority.
• Identity Verification: Third-party KYC service providers that help us verify member identities in accordance with compliance requirements.
• Fraud Detection: Dedicated services that help us detect and prevent fraud and money laundering activities.

The security of your data is our absolute priority. GRCasino implements multiple layers of technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or deletion.

Our technical security measures include:

• 256-bit SSL encryption for all data in transit between your device and our servers.
• Data encryption at rest for sensitive stored information.
• Role-based access control (RBAC) ensuring only authorized personnel can access specific data.
• Continuous security monitoring and intrusion detection systems (IDS).
• Regular data backups and a disaster recovery plan.
• Regular penetration testing by independent security experts.

Data retention period: GRCasino retains your personal data for as long as your account is active or as long as necessary to provide our services. Following account closure, we retain certain records for a minimum period of 5 years to meet legal and anti-money laundering requirements, after which data will be securely deleted.

GRCasino uses cookies and similar tracking technologies to enhance the user experience, analyse platform traffic and ensure the security of your account. The following are the types of cookies we use:

You can manage cookies through your web browser settings. Please note that disabling essential cookies may affect the functionality of the grcasino platform. Optional and marketing cookies can be declined without affecting basic platform use.

In operating the grcasino platform, your personal data may be transferred to and processed in countries outside Malaysia. This may occur when we use cloud services or technology partners operating in other countries.

When your data is transferred outside Malaysia, we ensure adequate protection is in place through:

• Data processing agreements that include strict data protection clauses.
• Selection of partners operating in countries with equivalent data protection laws.
• Regular security assessments of all international service providers we use.

As a grcasino member, you have the following rights regarding your personal data. All requests will be processed within 30 working days and at no charge under normal circumstances:

• Right to Be Informed: You have the right to know how your personal data is processed – that is the purpose of this document.
• Right of Access: You may request a copy of all personal data we hold about you.
• Right to Rectification: You may request the correction of any inaccurate or incomplete data.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data.
• Right to Restriction of Processing: You may request a restriction on how we use your data in specified circumstances.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• Right to Object: You may object to the processing of your data for direct marketing purposes at any time.

To exercise any of these rights, please contact the grcasino customer support team via live chat on the platform or by email. We may require identity verification before processing your request to protect your account security.

The grcasino platform is exclusively for individuals aged 18 and above. We do not knowingly collect or process personal data of individuals under 18.

If we discover that a child's personal data has been collected without proper age verification, we will take immediate steps to delete that data and close the associated account.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, we encourage you to contact us directly. We are committed to resolving any privacy issues promptly and transparently.

You can reach the grcasino privacy team via:

• Privacy Email: [email protected]
• General Support: [email protected]
• Live Chat: Available 24/7 on the grcasino platform (login required)

We aim to respond to all privacy-related inquiries within 5 business days. For more complex requests such as data access or data deletion requests, the processing period is up to 30 business days.

This Privacy Policy may be updated from time to time. Any significant changes will be communicated to you via an in-platform notice or email. Continued use of the grcasino platform after amendments constitutes acceptance of the updated policy. This Policy should be read together with Terms and Conditions and guidelines Responsible Gaming us.