Privacy Policy gfl2 – Personal Data Protection for Malaysian Members

Gfl2 ("we", "platform", "Company") takes our responsibility for the privacy of all members and users of our platform in Malaysia seriously. This Privacy Policy is designed to give you a clear and comprehensive understanding of our data management practices – what information we collect, why we need it, how we use it, and the security measures we take to protect it.

This Privacy Policy applies to all information collected by gfl2 through our website at gfl2.my, our mobile application, customer service channels, and any other means of communication between you and gfl2. By registering an account or using the gfl2 platform, you agree to the practices described in this Privacy Policy.

The gfl2 Privacy Policy is drawn up in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA) and relevant international data protection principles. We are committed to ensuring that all personal data processing is carried out lawfully, fairly, and transparently for all our members across Malaysia.

Gfl2 collects various types of personal information from our members to enable the platform to operate effectively and securely. The following are the categories of data we may collect:

Gfl2 does not collect sensitive personal data such as health information, biometric data, or details related to religious beliefs unless required for specific identity verification purposes mandated by law.

Gfl2 collects your personal information through several different channels in the course of your use of our platform:

• During Account Registration: When you register a new gfl2 account, you will be required to complete a registration form containing basic details such as your name, phone number, and email address.
• KYC Verification Process: To comply with anti-money laundering legal requirements, gfl2 may request identity verification documents such as a copy of your national ID or passport.
• Financial Transactions: When you make a deposit or withdrawal via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, transaction information is collected for record-keeping and security purposes.
• Platform Usage: gfl2 automatically collects usage data while you use the platform — including games played, session duration, and betting patterns. This data is used to enhance the user experience and maintain platform security.
• Customer Support Communications: When you contact the gfl2 customer support team via live chat or email, those conversations may be recorded for training and service improvement purposes.
• Cookies & Tracking Technologies: gfl2 uses cookies and other tracking technologies to collect technical data as you browse our platform. Further details on cookie usage are explained in Section 7.

Gfl2 uses the personal data we collect for a range of legitimate and necessary purposes in operating our platform. We do not use your data for any purpose not stated here without first obtaining your consent:

• Account Management: To create, verify, maintain, and secure your gfl2 account.
• Transaction Processing: To securely and accurately process deposits via Touch 'n Go eWallet, GrabPay, Boost, DuitNow, or FPX, and to facilitate withdrawal of winnings to your Malaysian bank account or eWallet.
• Legal Compliance: To fulfil gfl2's legal obligations, including compliance with Malaysia's PDPA, anti-money laundering legislation, and applicable regulatory reporting requirements.
• Security & Fraud Detection: To identify, investigate, and prevent fraudulent activity, money laundering, or security breaches that could affect other gfl2 members.
• Service Improvement: To analyse platform usage patterns for the purpose of improving the gaming experience, enhancing the interface, and developing better new features for all gfl2 members.
• Service Communications: To send you important notifications regarding your account, transactions, terms updates, and security information that you need to be aware of as a gfl2 member.
• Marketing (with consent): To send you promotional information, bonus offers, and updates on new gfl2 games — but only where you have agreed to receive such marketing communications.

Gfl2 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes under any circumstances. However, in the course of operating our platform, gfl2 may need to share certain information with the following parties on a limited and controlled basis:

• Payment Service Providers: Transaction information that must be shared with payment processors, including Touch 'n Go eWallet, GrabPay, Boost, DuitNow service providers, and banks handling your FPX transactions. Such sharing is strictly limited to the information needed to complete the transaction.
• Game Providers: Third-party game providers such as Pragmatic Play, JILI, and KA Gaming may receive the minimum technical data necessary to run games on the gfl2 platform.
• Regulatory Authority: gfl2 may disclose information to government authorities, law enforcement bodies, or regulators where required by Malaysian law or a valid court order.
• Professional Advisors: Lawyers, accountants, auditors, or other consultants bound by strict professional confidentiality obligations may be granted limited access to specific data where necessary to provide professional advice to gfl2.

In all of the data sharing cases described above, gfl2 ensures that the receiving parties are bound by confidentiality agreements or legal obligations that protect your information to a standard equal to or higher than our own.

Protecting members' personal data is gfl2's highest priority. We have implemented multiple layers of comprehensive technical and administrative security measures to safeguard your information against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL Encryption: All communications between your web browser or application and gfl2's servers are protected by industry-standard Transport Layer Security (TLS) encryption. This means that all information you send to gfl2 — including login credentials and transaction details — cannot be read by any third party.
• Encrypted Data Storage: Sensitive personal data stored in gfl2's databases is encrypted using modern encryption algorithms. Even if an unauthorised party were to gain access to the database, the data would be unreadable without the decryption key.
• Two-Factor Authentication (2FA): gfl2 offers two-factor authentication for additional account protection. We encourage all members to enable this feature for an extra layer of security.
• Internal Access Controls: Access to gfl2 members' personal data among our staff is strictly limited on a need-to-know basis. Only personnel who require access to that data to perform their job duties are granted authorisation.
• 24/7 Secure Monitoring: gfl2's systems are continuously monitored to detect any suspicious activity or intrusion attempts. Our security team responds immediately whenever a threat is identified.
• Regular Security Audits: gfl2 conducts regular security audits and penetration testing to identify and address any vulnerabilities within our security infrastructure.

While no system can guarantee absolute security, gfl2 consistently strives to apply the best available technology and practices to ensure your personal data is protected to the highest possible standard at all times.

Gfl2 uses cookies and similar technologies to enhance your experience on our platform and ensure smooth technical operation. The types of cookies we use are as follows:

• Essential Cookies: These cookies are essential for the basic functioning of the gfl2 platform — including maintaining your login session, remembering your language preference, and ensuring session security. Without these cookies, the gfl2 platform cannot function properly.
• Performance Cookies: These cookies help gfl2 understand how members use our platform — which pages are visited most often, how long gaming sessions last, and where users encounter difficulties. This information is used solely to improve platform performance and the overall user experience at gfl2.
• Functional Cookies: These cookies allow gfl2 to remember your preferences — such as display settings, favourite games, and language selection — so you don't have to reconfigure them each time you log in.
• Analytics Cookies: gfl2 uses analytics tools to understand platform usage patterns in an aggregated and anonymised form. This data helps us make better-informed decisions in platform development.

You can manage cookie settings through your web browser's preferences. However, disabling certain cookies may affect the functionality of the gfl2 platform and your overall experience. For more information on managing cookies, please refer to the privacy settings guide for your browser.

As a gfl2 member and data subject, you hold certain rights under Malaysia's Personal Data Protection Act 2010 (PDPA) regarding your personal data held by gfl2. gfl2 is committed to respecting and facilitating the exercise of these rights:

Gfl2 does not retain your personal data for longer than is necessary for the purposes set out in this Privacy Policy or to fulfil our legal obligations. In general, the retention periods are as follows:

• Active Account Data: For as long as your gfl2 account remains active and a contractual relationship exists between you and gfl2.
• Data Following Account Closure: Personal data and transaction records are retained for a minimum of 7 years following account closure to meet Malaysian legal requirements, including the Companies Act and anti-money laundering regulations.
• Communication Data: Customer support conversation records are retained for 2 years for reference purposes and to support ongoing gfl2 service quality improvement.
• Technical Log Data: Technical logs and platform activity data are retained for 12 months for security and fraud detection purposes.

Once the retention period has elapsed and there is no legal requirement to continue storing the data, gfl2 will securely delete or anonymise your personal data using appropriate methods.

In the course of operating the gfl2 platform, your personal data may be transferred to and processed outside Malaysia — primarily in connection with cloud infrastructure services and international game providers that gfl2 works with.

Nonetheless, gfl2 ensures that all cross-border data transfers are carried out with adequate safeguards in place:

• Applies only to countries or entities that provide a level of data protection equivalent to or higher than that of Malaysia.
• Protected by data processing agreements that include standard protection clauses requiring recipients to adhere to strict data protection principles.
• Limited to the minimum information necessary for a specific technical or operational purpose.

Gfl2 does not transfer Malaysian members' personal data to countries or entities that lack an adequate data protection framework without first obtaining your explicit consent.

Gfl2 strictly prohibits individuals under the age of 18 from registering for or using our platform under any circumstances. The gfl2 platform is intended for adults only.

Gfl2 does not knowingly collect personal data from minors. Should we discover that a minor's personal data has been collected without our knowledge, we will take immediate steps to delete that information and close the associated account.

If you have reason to believe that a minor has registered an account with gfl2, please contact our customer support team at [email protected] immediately so that we can take the appropriate action.

Gfl2 has appointed a Data Protection Officer responsible for ensuring compliance with all relevant data protection laws and for handling any privacy-related enquiries or complaints from members.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way gfl2 handles your personal data, please reach out to us through the following channels:

If you are dissatisfied with gfl2's response to your privacy complaint, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection under the Ministry of Communications and Digital, which oversees PDPA compliance in Malaysia.

This Privacy Policy is governed by the laws of Malaysia. Any dispute relating to this Privacy Policy shall be resolved through the courts of competent jurisdiction in Malaysia.