gdslot Privacy Policy

1. Controller Identity

The data controller responsible for the personal data of gdslot Members and website visitors is the licensed operator of the gdslot platform at gdslot.club (referred to throughout this Policy as "gdslot," "we," "us" or "our"). gdslot operates under an international gaming authority licence. Details of the licensing entity are available upon written request to our support address.

This Policy applies to all personal data processed in connection with:

• Account registration and maintenance;
• Deposits, withdrawals and transaction history;
• Gameplay activity across casino, sportsbook, Plinko and other Platform products;
• Customer support communications;
• Visits to the gdslot website, including browsing without registration.

2. Data We Collect

gdslot collects personal data in the following categories:

Identity Data

• Full legal name, date of birth, nationality;
• Government-issued identification document details (Malaysian identity card number, passport number or driving licence number) provided during KYC verification.

Contact Data

• Email address (required at registration);
• Mobile phone number (where provided for account security notifications).

Financial Data

• Records of deposits, withdrawals, bonuses and wager settlements;
• Payment method type and masked identifier (e.g., last four digits of a bank account number or the registered mobile number associated with a Touch 'n Go or Boost account);
• Transaction timestamps and amounts in MYR.

Technical & Usage Data

• IP address, browser type and version, device type and operating system;
• Session data including pages visited, game titles played, session duration and clickstream data;
• Geolocation data at the jurisdiction level (country/region), derived from IP address.

Communication Data

• Content of support chat transcripts, emails and other communications submitted to gdslot;
• Records of marketing preference selections and opt-in or opt-out status.

3. How We Collect Data

gdslot collects personal data through the following channels:

• Directly from you — when you complete the registration form, submit KYC documents, make a deposit, contact support, or update your account profile;
• Automatically — through cookies, server logs, and analytics tools embedded in the Platform that record technical and usage data as you interact with the website;
• From payment processors — confirmation data (transaction reference numbers, payment status, masked account identifiers) returned by Malaysian payment gateways including DuitNow, Maybank2u, CIMB Clicks, Touch 'n Go eWallet, Boost and FPX providers;
• From identity verification services — where gdslot uses a third-party KYC service to verify the authenticity of identity documents, that provider may return verification status and document metadata to gdslot.

4. Purposes & Legal Basis for Processing

gdslot processes personal data for the following purposes and on the following legal bases:

• Account registration and management — necessary for the performance of the contract between gdslot and the Member.
• Identity verification and KYC compliance — necessary for compliance with anti-money laundering and gaming licence obligations (legal obligation).
• Processing deposits and withdrawals — necessary for the performance of the contract.
• Fraud detection and prevention — legitimate interests of gdslot and its Members in maintaining a secure and fair gaming environment.
• Responsible gaming monitoring — compliance with licensing obligations requiring operators to identify and assist problem gamblers.
• Customer support — performance of the contract and legitimate interests in resolving Member issues.
• Platform analytics and improvement — legitimate interests of gdslot in understanding Platform usage and improving service quality.
• Marketing communications — consent, where you have opted in to receive promotional communications from gdslot. You may withdraw consent at any time by updating your preferences in account settings or by contacting support.
• Regulatory reporting — legal obligation under the terms of gdslot's international gaming licence and applicable AML regulations.

5. Data Sharing

gdslot does not sell or rent personal data. We share data only in the following circumstances:

• Payment processors: Transaction data is shared with Malaysian payment providers (DuitNow, Touch 'n Go, Boost, Maybank2u, CIMB Clicks, FPX) strictly to the extent necessary to process deposits and withdrawals.
• Identity verification providers: Where a third-party KYC service is used, identity document data is transmitted to that provider under a data processing agreement that restricts use to verification purposes only.
• Licensing authority: gdslot is required to provide transaction, account and compliance records to its licensing authority upon request.
• Law enforcement and regulatory bodies: gdslot will disclose personal data where required to do so by a court order, statutory obligation or legitimate regulatory direction. gdslot will, where legally permissible, notify the affected Member of such a disclosure.
• Group entities and service providers: Data may be shared with entities within the gdslot corporate group and with carefully selected third-party service providers (e.g., hosting, analytics, fraud prevention) who process data strictly on gdslot's instructions under data processing agreements.

In all cases, gdslot imposes contractual data protection obligations on recipients of personal data that are at least equivalent to those set out in this Policy.

6. International Data Transfers

As an internationally licensed gaming operator, gdslot's data infrastructure may involve processing personal data in jurisdictions outside Malaysia. Where personal data is transferred to a country that does not provide a level of data protection equivalent to that applicable in gdslot's licensing jurisdiction, gdslot applies appropriate safeguards, which may include:

• Standard contractual clauses approved by the relevant supervisory authority;
• Binding corporate rules applicable within the gdslot group;
• Transfers to recipients in jurisdictions recognised as providing adequate protection.

Details of the specific safeguards applied to any particular transfer are available upon written request.

7. Data Retention

gdslot retains personal data for the minimum period necessary to fulfil the purposes for which it was collected and to comply with legal and regulatory obligations:

• Account and identity data: Retained for the duration of the Member's account and for a minimum of five (5) years after account closure, consistent with AML record-keeping requirements under gdslot's licensing jurisdiction.
• Transaction data: Retained for a minimum of five (5) years from the date of each transaction.
• Support communications: Retained for three (3) years from the date of the communication or resolution of the relevant matter, whichever is later.
• Technical and usage data (logs): Retained for up to 12 months, unless a longer retention period is required for fraud investigation or legal proceedings.
• Marketing preference records: Retained until you withdraw consent and for a further 12 months as evidence of the consent history.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

8. Cookies and Tracking Technologies

gdslot uses cookies and similar technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function, including maintaining your logged-in session after completing the gdslot Login, storing your language preference, and enabling secure page navigation. These cannot be disabled without affecting Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data on how visitors interact with the Platform — pages visited, session duration, traffic sources. This data is used solely to improve Platform performance and user experience.
• Fraud prevention cookies: Used to identify unusual patterns of Platform access that may indicate automated bot activity, account compromise, or other security threats.

gdslot does not deploy advertising cookies, retargeting pixels or cross-site tracking technologies. You can manage cookie preferences through your browser's privacy settings. Disabling essential cookies will impair your ability to use the Platform.

9. Security

gdslot implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction or alteration. These measures include:

• SSL/TLS encryption for all data in transit between Member devices and gdslot servers;
• Encryption of sensitive data at rest;
• Role-based access controls limiting data access to personnel who require it for their job functions;
• Regular security reviews and vulnerability assessments of Platform infrastructure;
• Incident response procedures for detecting and responding to personal data breaches.

No system is entirely impenetrable. In the event of a data breach affecting your personal data in a manner likely to result in high risk to your rights and freedoms, gdslot will notify you and relevant supervisory authorities as required by applicable regulations.

10. Your Data Rights

Subject to applicable law and the conditions of gdslot's licensing obligations, you have the following rights in relation to your personal data held by gdslot:

• Right of access: You may request confirmation of whether gdslot holds personal data about you and, if so, a copy of that data.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: In certain circumstances, you may request deletion of your personal data. This right is subject to gdslot's legal retention obligations — data required by AML or licensing regulations cannot be deleted prior to the expiry of the mandatory retention period.
• Right to restriction: You may request that gdslot restrict processing of your personal data in certain circumstances, for example while a correction request is pending.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may request a machine-readable copy of your personal data.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to object: You may object to processing based on legitimate interests, including profiling, where you have grounds relating to your particular situation.

To exercise any of these rights, contact gdslot at the address in Section 14. We will respond within 30 calendar days. We may request proof of identity before processing a data rights request.

11. Children and Minors

The gdslot Platform is strictly intended for individuals aged 21 and above. gdslot does not knowingly collect personal data from persons under 21. If we become aware that personal data has been collected from a minor, we will delete that data and close the associated account promptly. If you believe a minor has registered a gdslot account, please contact us immediately at the address in Section 14.

12. Third-Party Links

The gdslot Platform may contain references to third-party services such as payment providers. Clicking on a link to a third-party service will take you to that party's own website or application, which is governed by that party's own privacy policy. gdslot is not responsible for the privacy practices of third-party services and encourages you to review their policies before providing any personal data.

13. Changes to This Privacy Policy

gdslot may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements or Platform services. Material changes will be notified to Members via the registered email address or by a prominent notice on the Platform at least seven (7) days before the revised Policy takes effect.

Continued use of the gdslot Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. We recommend reviewing this page periodically. The "Last updated" date at the top of this Policy indicates when the most recent revision was made.

14. Contact & Data Requests

For any privacy-related enquiry, data rights request or complaint, please contact the gdslot data protection team:

• Email: [email protected]
• Subject line: "Privacy Request – [your registered email address]"
• Response time: Within 30 calendar days of receipt of a complete request.

If you are not satisfied with our response to a privacy complaint, you may escalate the matter to the supervisory authority in gdslot's licensing jurisdiction. Details of the relevant supervisory authority are available upon request.