Privacy Policy — Gula77

This Privacy Policy ("Policy") describes how Gula77 ("Gula77", "we", "us", "our", "the Company"), the operator of the online gaming and sports betting platform accessible at gula77.lat ("the Platform"), collects, processes, stores, and protects the personal data of its registered players, website visitors, and other users ("you", "your", "the Player").

Gula77 is committed to handling personal data with integrity, transparency, and in accordance with applicable data protection principles. This Policy explains the nature of the personal data we process, the purposes for which we use it, the basis on which processing is lawful, and the rights available to you in respect of your personal data.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, which together form the complete framework governing your use of the Gula77 platform.

By registering an Account, depositing funds, or otherwise using the Gula77 platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following definitions apply:

• Personal Data — Any information that directly or indirectly identifies a natural person, including name, identification number, contact details, financial information, device identifiers, and IP addresses.
• Processing — Any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, and deletion.
• Data Controller — Gula77, as the entity that determines the purposes and means of processing your Personal Data.
• Data Processor — A third party that processes Personal Data on behalf of the Data Controller, such as payment service providers or KYC verification vendors.
• KYC Data — Identity and address verification documents submitted by Players as part of the Know Your Customer process, including MyKad scans, passport copies, proof of address documents, and selfie photographs.
• Cookies — Small text files stored on your device by the Gula77 Platform that record session information, preferences, and usage patterns.
• Account — A registered user profile on the Gula77 platform linked to a Player's verified identity.

Gula77 collects personal data across several categories depending on the nature of your interaction with the Platform. The following table summarises the categories of personal data we collect and the context in which collection occurs:

Gula77 collects personal data through the following channels and mechanisms:

4.1 Direct Collection

You provide personal data directly to Gula77 when you: register an Account; complete KYC verification by uploading identity documents; make a deposit or withdrawal; contact our support team via live chat or email; update your Account profile or communication preferences; or respond to surveys or promotions.

4.2 Automated Collection

Gula77 automatically collects certain technical data each time you access or use the Platform, including IP address, device and browser information, operating system details, session start and end times, pages visited, and game sessions initiated. This data is collected via server logs, cookies, and similar tracking technologies as described in Section 10of this Policy.

4.3 Third-Party Collection

We may receive personal data about you from third parties in the following circumstances: payment service providers (e.g., Touch 'n Go eWallet operator, DuitNow, FPX processing banks) may confirm transaction status or flag suspicious payment activity; KYC verification vendors may provide identity confirmation results; fraud detection partners may provide risk scoring data derived from technical signals.

Gula77 processes your personal data solely for the following defined and lawful purposes:

• Account creation and management — to register, maintain, and administer your Gula77 Account;
• Identity verification (KYC) — to confirm your identity, age, and address in compliance with anti-money laundering and responsible gambling obligations;
• Payment processing — to facilitate deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, cryptocurrency, and other approved methods, and to process withdrawal requests to verified accounts;
• Gaming services delivery — to provide access to casino games, sports betting markets (including Liga Super Malaysia, EPL, and UFC), live dealer tables, and all other Platform features;
• Fraud prevention and security — to detect, investigate, and prevent fraudulent activity, unauthorised Account access, multi-accounting, bonus abuse, and money laundering;
• Responsible gambling — to monitor gaming patterns, apply player-requested limits, administer self-exclusion, and identify indicators of problem gambling behaviour;
• Customer support — to respond to queries, resolve disputes, and process complaints submitted via live chat or email;
• Legal and regulatory compliance — to meet obligations imposed by applicable laws and regulations, including record-keeping and reporting requirements;
• Platform improvement — to analyse usage patterns, optimise the mobile experience, and improve game performance and user interface design;
• Marketing communications — to send promotional offers, bonus notifications, and VIP program updates to Players who have provided explicit marketing consent.

Each instance of personal data processing carried out by Gula77 is underpinned by one or more of the following lawful bases:

• Contractual necessity — processing required to perform our obligations under the Terms & Conditions governing your Account, including Account management, payment processing, and delivery of gaming services;
• Legal obligation — processing required to comply with applicable anti-money laundering regulations, age verification requirements, record-keeping obligations, and fraud prevention duties;
• Legitimate interests — processing carried out in pursuit of Gula77's legitimate business interests in fraud detection, Platform security, responsible gambling monitoring, and service improvement, provided such interests do not override your fundamental rights and freedoms;
• Consent — processing of personal data for marketing communications, where you have provided explicit, freely given, specific, and informed consent; consent may be withdrawn at any time.

Gula77 does not sell your personal data. We disclose personal data to third parties only in the following defined circumstances, and only to the minimum extent necessary for the stated purpose:

7.1 Service Providers (Data Processors)

Gula77 engages trusted third-party service providers who process personal data on our behalf under contractual data processing agreements. These include: payment gateway operators (facilitating transactions with Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and cryptocurrency networks); KYC identity verification vendors; fraud detection and risk scoring service providers; cloud hosting and data storage infrastructure providers; and customer support technology platforms.

7.2 Game Providers

Third-party game studios whose titles are hosted on the Gula77 Platform may receive limited technical data (such as session tokens and game identifiers) necessary to deliver their games. Game providers do not receive players' identity documents, financial data, or contact details.

7.3 Legal and Regulatory Disclosure

Gula77 may disclose personal data to law enforcement authorities, regulatory bodies, financial intelligence units, or courts where we are legally required or compelled to do so, or where disclosure is necessary to prevent or detect crime, protect against legal liability, or enforce our Terms & Conditions.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Gula77's business, personal data held by us may be transferred to the successor entity as part of the transaction, subject to equivalent privacy protections being maintained.

Gula77 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to applicable legal retention obligations. The following retention periods apply:

• Account Data (identity, contact, registration information) — retained for the duration of the active Account relationship and for a minimum of five (5) years following Account closure, in accordance with anti-money laundering record-keeping requirements;
• KYC Documents — retained for a minimum of five (5) years following the date of the last transaction or Account closure, whichever is later;
• Financial Transaction Records — retained for a minimum of seven (7) years to satisfy applicable financial record-keeping obligations;
• Gaming Activity Logs — retained for a minimum of three (3) years following Account closure, to support dispute resolution and responsible gambling obligations;
• Support Communications — retained for two (2) years following the resolution of the relevant matter;
• Marketing Consent Records — retained for the duration of the consent period and for three (3) years thereafter as evidence of consent;
• Technical/Log Data — typically retained for twelve (12) months for security monitoring purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures.

Gula77 implements a layered approach to data security, applying technical and organisational measures comensurate with the risk profile of the personal data we hold. Our security framework includes:

• Encryption in transit: All data transmitted between your device and Gula77 servers is encrypted using TLS 1.2 or higher (256-bit encryption), preventing interception of data during transmission;
• Encryption at rest: Sensitive personal data — including KYC documents and financial records — is encrypted when stored on our servers using AES-256 encryption;
• Access controls: Access to personal data is restricted to Gula77 employees and contractors who require it to perform their job functions, enforced through role-based access control and multi-factor authentication;
• Network security: Gula77's infrastructure is protected by firewalls, intrusion detection systems, and continuous security monitoring;
• Vulnerability management: Regular security assessments and penetration testing are conducted to identify and remediate vulnerabilities;
• Incident response: Gula77 maintains a data breach response procedure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected Players without undue delay.

The Gula77 Platform uses cookies and similar technologies to deliver a functional and personalised experience. A cookie is a small text file stored on your device when you visit a website. Cookies do not contain executable code and cannot install software on your device.

10.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged into your Account during a visit. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, display preferences, and previously visited game sections. These improve your experience but are not required for core functionality.
• Analytics Cookies: Used to collect aggregate, anonymised data on how Players navigate and use the Platform, enabling us to identify areas for improvement. Analytics data does not identify you individually.
• Security Cookies: Used to detect and prevent fraudulent activity, unusual login patterns, and automated bot access to the Platform.

10.2 Managing Cookies

You may manage or disable non-essential cookies through your browser settings or device privacy controls. Please note that disabling certain cookies may affect the functionality of the Gula77 Platform, including the ability to stay logged in or use certain features. Gula77 does not use cookies to track your activity on websites other than gula77.lat.

As a registered Player on the Gula77 Platform, you hold the following rights in relation to your personal data. These rights may be subject to certain exceptions and limitations in accordance with applicable law, but Gula77 will process all rights requests in good faith and respond within30 calendar days of receipt of a verified request.