Privacy Policy — ganti8

ganti8 ("we", "us", "our", "the Platform") operates the online casino and sports betting website accessible at ganti8.cam. We act as the data controller in respect of all personal data collected through the Platform and are committed to protecting the privacy and security of our users ("you", "your", "the User").

This Privacy Policy ("Policy") is issued in accordance with applicable data protection principles and describes in clear, accessible terms how ganti8 collects, uses, stores, shares, and protects personal data obtained through your use of the Platform. It applies to all registered users and visitors, including players based across Malaysia — in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the overall agreement between you and ganti8. By registering an account or using the Platform in any capacity, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

For the purposes of this Privacy Policy, the following definitions apply unless the context requires otherwise:

• "Personal Data" — Any information relating to an identified or identifiable natural person, including name, email address, date of birth, national identity number, financial account details, device identifiers, and IP addresses.
• "Processing" — Any operation performed on personal data, including collection, recording, storage, use, disclosure, erasure, or destruction, whether by automated or manual means.
• "Data Controller" — The entity that determines the purposes and means of processing personal data. For this Policy, ganti8 is the data controller.
• "Data Processor" — A third party that processes personal data on behalf of ganti8, under documented instructions and subject to binding contractual obligations.
• "User" / "Data Subject" — A natural person who visits, registers on, or otherwise interacts with the ganti8 Platform.
• "KYC" — Know Your Customer: the identity and age verification process conducted on registered users prior to withdrawal processing.
• "Cookie" — A small text file placed on your device by the Platform to enable certain functionality and to collect usage analytics data.
• "Special Categories of Data" — Particularly sensitive personal data including health information, which ganti8 may process in limited circumstances for responsible gambling purposes as described in Section 5.

ganti8 collects personal data through multiple channels in the ordinary course of providing our services. The categories of data we collect, and the circumstances in which we collect them, are set out below.

3.1 Data Provided Directly by You

When you register an account, complete KYC verification, make deposits or withdrawals, contact support, or participate in promotions, you may provide the following categories of personal data:

3.2 Data Collected Automatically

When you access and use the Platform, certain technical and behavioural data is collected automatically through our systems and through cookies and similar tracking technologies:

• Device and Technical Data: IP address, browser type and version, operating system, device type (mobile/desktop), screen resolution, and time zone setting.
• Usage Data: Pages visited, features accessed, session duration, game history (titles played, bet amounts, game outcomes, session timestamps), sports betting history (markets wagered, stakes, outcomes).
• Transaction Data: Deposit amounts, withdrawal requests, payment method used, transaction timestamps, and processing status records.
• Responsible Gambling Data: Self-imposed limits set by you (deposit limits, loss limits, session time limits), self-exclusion requests and their history, and system-generated alerts triggered by your account activity patterns.

3.3 Data from Third Parties

In limited circumstances, ganti8 may receive personal data about you from third-party sources, including:

• Identity verification service providers used for KYC processing;
• Payment processors and financial institutions (e.g., Maybank, CIMB, Public Bank, FPX network operators) confirming transaction status;
• Fraud prevention and anti-money laundering screening databases;
• Responsible gambling databases where applicable, to honour self-exclusion requests made through recognised programmes.

ganti8 processes your personal data only where a valid legal basis exists for doing so. The legal bases we rely upon for our primary data processing activities are as follows:

• Contractual Necessity: Processing required to perform our obligations under the agreement formed by your acceptance of our Terms & Conditions — including account management, bet settlement, deposit and withdrawal processing, and KYC verification.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, fraud prevention duties, and data retention obligations.
• Legitimate Interests: Processing undertaken for our legitimate business interests, including fraud detection and prevention, platform security monitoring, responsible gambling monitoring, and improving the quality of our services — where such interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — in particular, processing of certain optional data for personalised promotional communications and marketing, where such consent has been explicitly provided and can be withdrawn at any time.

ganti8 uses the personal data we collect for the following specific purposes:

5.1 Account Management & Service Delivery

To create and maintain your registered Account; to authenticate your identity at login; to process deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and cryptocurrency channels; to settle bets and game outcomes; to process withdrawal requests; and to provide responsive customer support via live chat and email.

5.2 Verification & Compliance

To conduct KYC identity and age verification, ensuring that only persons aged 21 and above are permitted to hold active accounts; to fulfil anti-money laundering (AML) obligations, including transaction monitoring and suspicious activity reporting; and to comply with all applicable legal and regulatory requirements in the jurisdictions in which ganti8 operates.

5.3 Responsible Gambling Monitoring

To monitor account activity for indicators of problem gambling behaviour; to honour self-imposed limits including deposit caps, loss limits, and session time controls; to process self-exclusion requests and maintain exclusion records; and to identify players who may benefit from responsible gambling support resources. In this context, ganti8 may process information that falls within special categories of data (specifically, information about behavioural patterns indicative of gambling-related harm) on the basis of substantial public interest in player protection.

5.4 Security & Fraud Prevention

To protect the integrity of the Platform against fraud, collusion, multi-accounting, and automated bot activity; to investigate suspected breaches of our Terms & Conditions; to detect and prevent unauthorised access to user accounts; and to monitor for money laundering activity in accordance with our AML obligations.

5.5 Platform Improvement

To analyse aggregated and anonymised usage data to improve Platform performance, game library curation, payment channel efficiency, and user experience design; to conduct A/B testing of new features and layouts; and to troubleshoot technical issues.

5.6 Marketing Communications

Where you have provided explicit consent, to send you personalised promotional offers, bonus notifications, tournament announcements, and Platform updates via email or in-app notifications. You may withdraw consent for marketing communications at any time by using the unsubscribe link in any marketing email or by contacting our support team directly.

ganti8 does not sell, rent, or trade your personal data to any third party for their own independent use. We disclose personal data only in the following specific and limited circumstances:

6.1 Service Providers and Data Processors

We engage trusted third-party service providers who act as data processors on our behalf, under binding written agreements that restrict their use of personal data to the specific purpose for which it is shared. These include:

• Payment processing partners — including FPX network operators, e-wallet platforms (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), banking partners (Maybank, CIMB, Public Bank, RHB, Hong Leong Bank), and cryptocurrency processing services;
• KYC and identity verification service providers;
• Fraud screening and AML compliance database providers;
• Cloud infrastructure and data hosting service providers;
• Customer support software platforms used to manage live chat and ticketing;
• Analytics service providers used to analyse aggregated, anonymised Platform usage data.

6.2 Legal and Regulatory Authorities

We may disclose personal data to regulatory bodies, law enforcement agencies, courts, or other governmental authorities where we are legally required to do so, or where disclosure is necessary to comply with a valid legal obligation, court order, or to protect the legal rights, property, or safety of ganti8, its users, or the public.

6.3 Business Transfers

In the event that ganti8 undergoes a merger, acquisition, restructuring, or sale of all or substantially all of its assets, personal data held by ganti8 may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections being maintained. Affected users will be notified via registered email address in advance of any such transfer where practicable.

6.4 Responsible Gambling Programmes

Where required or appropriate, ganti8 may share relevant data with recognised responsible gambling organisations or self-exclusion schemes to honour exclusion requests made by users through those programmes.

ganti8 uses cookies and similar tracking technologies to operate essential Platform functionality and to collect usage data that helps us improve the user experience. This section explains the types of cookies we use and how you can manage them.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the Platform to function. These enable core features such as user authentication, session management, and security. They cannot be disabled without preventing you from using the Platform.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and responsible gambling limit configurations between sessions.
• Analytical Cookies: Collect aggregated, anonymised information about how visitors use the Platform — pages visited, time spent, navigation paths — to help us improve performance and content. No individual user is identified through analytical cookies.
• Marketing Cookies: Used, where consent has been provided, to deliver personalised promotional content and to measure the effectiveness of marketing campaigns. These are only activated following explicit consent.

7.2 Managing Cookie Preferences

You may manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, or to receive a notification before a cookie is placed. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing certain features.

ganti8 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or accounting obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with our internal data destruction procedures. Anonymised data that no longer identifies any individual may be retained indefinitely for statistical and analytical purposes.

ganti8 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include but are not limited to:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all Platform interactions including account login, deposits, withdrawals, and support communications.
• Encryption at Rest: Sensitive personal data — including identity documents and financial data — is encrypted at rest in our database infrastructure.
• Password Hashing: Account passwords are stored exclusively as one-way cryptographic hashes. ganti8 employees cannot view or recover your plaintext password under any circumstances.
• Access Controls: Access to personal data within our organisation is restricted on a strict need-to-know basis, with role-based permissions and access logs maintained for audit purposes.
• Penetration Testing: Our Platform undergoes regular independent security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident Response: ganti8 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay.

Subject to applicable data protection law, you hold the following rights in respect of your personal data held by ganti8. To exercise any of these rights, please contact us through the channels set out in Section 15.

• Right of Access: You have the right to request confirmation of whether ganti8 holds personal data about you, and to receive a copy of that data along with information about how it is used.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by ganti8 be corrected or completed without undue delay.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent. This right is subject to legal retention obligations that may prevent immediate deletion of certain data categories.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in specified circumstances, for example while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or on a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request its transmission to another controller where technically feasible.
• Right to Object: You have the right to object to processing of your personal data where such processing is based on legitimate interests, including profiling for responsible gambling monitoring and direct marketing. Where you object to direct marketing, we will cease that specific processing immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time with effect from the date of withdrawal. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

We will respond to verified data subject requests within one calendar month of receipt. In cases of complexity or high volume, this period may be extended by a further two months, of which we will notify you within the initial one-month period.

In the course of providing our services, your personal data may be transferred to, and processed in, countries outside of Malaysia — for example, where our cloud infrastructure providers, KYC service providers, or payment processing partners maintain data processing facilities.

Where personal data is transferred to countries that may not provide an equivalent level of data protection to that available in your home jurisdiction, ganti8 puts in place appropriate safeguards to ensure that your data receives adequate protection. Such safeguards include the use of standard contractual clauses in agreements with international data processors, and conducting due diligence on the data protection practices of all third-party service providers before engagement.

The ganti8 Platform is strictly intended for persons aged 21 years and above. ganti8 does not knowingly collect personal data from individuals under the age of 21. Our account registration process includes mandatory age declaration and date-of-birth capture, and our KYC verification process verifies age using government-issued identity documentation.

If you believe that a minor may have registered an account on ganti8, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.

The ganti8 Platform may contain references to or integrations with third-party payment services — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency network processors. When you interact with these third-party payment services to complete a deposit or withdrawal, you are subject to the privacy policies and data practices of those third-party providers, over which ganti8 has no control.

ganti8 is not responsible for the privacy practices or content of any third-party service provider, and we recommend that you review the privacy policies of any third-party service you interact with in connection with your use of the Platform.

ganti8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The effective date of the current version is displayed at the top of this document.

Where changes to this Policy are material — that is, where they significantly affect how your personal data is processed or your rights as a data subject — ganti8 will provide advance notice via your registered email address or through a prominent notice on the Platform. Your continued use of the Platform following the effective date of any revised Policy constitutes acceptance of those changes.

We recommend reviewing this Policy periodically. The version history is available on request by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or have a concern about how your personal data is being handled, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the live chat widget on the Platform. This is the fastest channel for all privacy-related queries.
• Email: [email protected] — responses to data subject requests within one calendar month as standard.

Please include your registered username and a clear description of your request or concern when contacting us. We may need to verify your identity before processing certain data subject requests to ensure your personal data is not disclosed to an unauthorised party.

If you are not satisfied with the response you receive from ganti8 regarding a data privacy concern, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.