Garuda138 takes your privacy seriously. This document explains precisely what data we collect, how it is used, who can access it, and your rights as the data owner under Malaysian law.
The data protection framework we apply for every member across Malaysia.
Garuda138 only collects data that is strictly necessary to operate our services, process MYR transactions, and meet Malaysia's legal requirements. We do not collect excessive or irrelevant data beyond the scope of our services.
Garuda138 members' personal data is never sold, rented, or shared with any third party for marketing or commercial purposes without your explicit consent. This is an absolute, non-negotiable commitment.
All data transmitted between your device and Garuda138's servers is encrypted using 256-bit SSL — the same standard used by Maybank, CIMB, and Malaysia's leading financial institutions. Your payment information is not stored directly on our servers.
You have full rights to access, correct, download, and request deletion of your personal data at Garuda138 at any time. All such requests will be processed within the timeframe stipulated by Malaysia's PDPA at no charge.
All of Garuda138's data processing practices are designed to comply with Malaysia's Personal Data Protection Act (PDPA) 2010. We conduct periodic internal compliance reviews and update this policy whenever relevant legislative changes occur.
You may opt in or out of marketing communications from Garuda138 at any time through your account settings. Your preference will take effect within 48 hours and will not affect your access to Garuda138's services.
This Privacy Policy is issued by Garuda138 and applies to all individuals using the Garuda138 online gaming platform at garuda138.im, including registered members, website visitors, and anyone who interacts with any Garuda138 service or product. By accessing or using the Garuda138 platform, you agree to the collection and processing of your personal data as described in this document.
Legal Basis: This policy is prepared in accordance with Malaysia's Personal Data Protection Act (PDPA) 2010. Garuda138 acts as a responsible Data Processor under this Act and is committed to complying with all prescribed data protection principles.
This policy covers all channels of interaction with Garuda138, including our website, mobile application (where applicable), email communications, customer support services, and all financial transactions processed through our platform — including deposits and withdrawals in Malaysian Ringgit (MYR).
Garuda138 collects personal data only when necessary and through lawful means. Below are the categories of data we collect, along with their purposes and legal basis:
| Data Category | Example | Purpose | Type |
|---|---|---|---|
| Personal Identity | Full name, IC number, date of birth | Identity verification (KYC), fraud prevention | MANDATORY |
| Contact Information | Email, Malaysian phone number, address | Account communications, 2FA verification | MANDATORY |
| Financial Data | MYR transaction records, payment methods (TNG, DuitNow, FPX) | Deposit/withdrawal processing, AML compliance | MANDATORY |
| Gaming Data | Betting records, game history, wins/losses | Account management, abuse detection, responsible gaming | AUTO |
| Technical Data | IP address, device type, web browser, access logs | Platform security, fraud detection, technical optimisation | AUTO |
| Marketing Preferences | Promotional preferences, favourite game types | Personalised marketing communications | OPTIONAL |
Garuda138 not collect credit or debit card details directly. All payments via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u, CIMB Clicks) are processed through PCI-DSS compliant payment gateways, and your payment details never pass through or are stored on Garuda138's servers.
Garuda138 processes your personal data on one or more valid legal bases — whether because it is necessary to perform a contract with you, to comply with a legal obligation, or based on our legitimate interests that do not override your privacy rights. The specific purposes for which data is used are set out below:
Automated Processing: Garuda138 uses automated systems to detect fraudulent activity and assess account risk. Automated decisions that materially affect you (such as account suspension) can be challenged through human review — please contact our customer support team.
Garuda138 does not sell members' personal data to any party. However, in certain limited and lawful circumstances, data may be shared with the following parties:
Our Commitment: Your personal data will never be shared with advertising companies, data brokers, or any commercial parties not directly involved in delivering Garuda138's services to you.
Garuda138 implements multiple layers of technical and organisational security measures to protect your personal data against unauthorised access, loss, damage, or disclosure:
Garuda138 does not retain your personal data for longer than necessary. Retention periods are determined by the purpose of collection and applicable legal requirements:
Garuda138 uses cookies and similar tracking technologies to ensure the platform functions properly, enhance the user experience, and analyse how the platform is used. The following are the types of cookies in use:
You can manage your cookie settings through your web browser settings. However, disabling essential cookies will affect the functionality of the Garuda138 platform and may prevent you from logging in or using certain services.
Under Malaysia's Personal Data Protection Act (PDPA) 2010, you have several important rights regarding your personal data at Garuda138. We are committed to respecting and facilitating the exercise of these rights:
You have the right to obtain a copy of the personal data Garuda138 holds about you, along with details on how it is processed. Submit your request via email or live chat and we will respond within 21 working days.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request a correction. You can update much of your profile information directly through your account settings.
Under certain circumstances, you may request that Garuda138 delete your personal data. Please note that this right is subject to our legal obligations to retain certain records (such as financial records) for the period prescribed under Malaysian law.
You may object to the processing of your data for direct marketing purposes at any time through the communications settings in your account. You may also object to other processing based on our legitimate interests in certain circumstances.
You have the right to receive a copy of the personal data you have provided to Garuda138 in a machine-readable format, and under certain circumstances, to request that we transfer it to another data processor.
In certain circumstances (such as when you are disputing the accuracy of your data), you may request that we restrict the processing of your data — meaning we will retain it but not use it until the dispute is resolved.
To exercise any of the above rights, contact Garuda138's Privacy Officer via support@garuda138.im with the subject line "Privacy Rights Request", or via the in-platform 24/7 live chat. We will verify your identity before processing the request and will respond within the timeframe stipulated by Malaysia's PDPA.
Garuda138 strictly prohibits participation by individuals under the age of 18. Our platform is not designed for minors, and we do not knowingly collect personal data from them.
To Parents & Guardians: If you believe your child under 18 has registered an account with Garuda138 or has provided us with their personal data, please contact us immediately at support@garuda138.im. We will take immediate action to close the account in question and delete all associated data.
Garuda138 employs multiple mechanisms to prevent underage registration, including date-of-birth verification at sign-up, a KYC process requiring valid Malaysian identification documents, and active monitoring for usage patterns that may indicate an underage user.
Garuda138 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, or developments to our platform.
If you have any questions, concerns, or complaints regarding how Garuda138 handles your personal data, please contact our Privacy Officer through the following channels:
If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Personal Data Protection Commissioner or the relevant regulatory body in Malaysia.
In today's digital world, personal data has become an incredibly valuable commodity. Far too many companies treat their users' data as a secondary revenue stream — selling it to advertisers, sharing it with "strategic partners", or using it for purposes users are never aware of or have not consented to. At Garuda138, we take a different and firmer stance.
We believe your personal data — your name, your phone number, your MYR transaction records, your gaming history — belongs to you, not to Garuda138. Our role is that of a trusted custodian processing that data on your behalf, and we take that responsibility seriously.
Malaysia's Personal Data Protection Act (PDPA) 2010 establishes the legal framework for personal data protection in commercial transactions. Garuda138 does not treat PDPA compliance as a mere legal obligation — we view it as a minimum baseline, not the ceiling. In many respects, our privacy practices go beyond the basic requirements of the PDPA.
For instance, the PDPA does not specifically require companies to provide easy access to online privacy management tools. Nevertheless, Garuda138 provides a privacy control panel within your account, allowing you to view, manage, and request deletion of your data in just a few clicks — no formal letters required, no weeks of waiting.
When you make a deposit via Touch 'n Go eWallet, GrabPay, DuitNow, or FPX into your Garuda138 account, the transaction passes through multiple layers of security. First, the connection between your device and the Garuda138 platform is encrypted with 256-bit SSL. Second, your payment details are processed by a PCI-DSS compliant third-party payment gateway — meaning your card number, bank account details, or e-wallet token are never stored on Garuda138's servers. Third, every transaction is verified through multi-factor authentication provided by your own e-wallet provider or bank.
This multi-layered security approach ensures that even in the highly unlikely event of a security breach at Garuda138, your payment information remains protected — because it is never stored in our systems in the first place. This is the "privacy by design" principle we uphold: building privacy and security into the system architecture from the ground up, not bolted on as an afterthought.
One aspect of data use that players may not immediately consider is the use of gameplay data for responsible gambling purposes. Garuda138 analyses member betting patterns — both in aggregate and individually — to identify early signs of problem gambling, such as sudden spikes in betting frequency or amounts, abnormal play patterns, or repeated attempts to exceed self-imposed limits.
When such patterns are detected, Garuda138's system triggers an appropriate intervention — ranging from a gentle reminder notification to automatic account limits or a suggestion to reach out to support resources. This is one of the ways Garuda138 uses data not for corporate gain, but for the genuine wellbeing of our members. You can learn more about our commitment to player wellbeing on the Responsible Gaming.
Garuda138 does not believe in privacy policies deliberately written in dense legal language to confuse readers. This Privacy Policy is written in clear, accessible English because we believe every member has the right to know exactly how their data is handled — not just those with a legal background. If any part of this document is unclear or you would like a deeper explanation, we encourage you to reach out to our support team, available in Bahasa Melayu 24/7.
Garuda138 is committed to processing your personal data in a manner that is fair, transparent, and consistent with Malaysian law. We will not use your data for purposes you have not consented to. We will not sell or rent your data to third parties. And we will always make it easy for you to access, correct, or request deletion of your data whenever you need to.
Your trust in Garuda138 has been built over many years. We do not take that trust lightly. Your privacy is not merely a legal obligation for us — it is a core value that guides every decision we make about how this platform is built and operated.
Read Full Terms & Conditions →The most frequently asked questions from Malaysian members about their data privacy at Garuda138.
Garuda138 protects your personal data with 256-bit SSL encryption and full compliance with Malaysia's PDPA. Register today and enjoy a secure gaming experience in MYR.