Goal 365 Privacy Policy — Malaysia Personal Data Protection

1Introduction & Scope of Privacy Policy

Goal 365 ("we", "platform") takes our responsibility to protect the privacy of every member and user in Malaysia seriously. This Privacy Policy applies to all services provided through goal365.my, the Goal 365 mobile app, and all our official communication channels.

As an online casino and Sports Betting platform operating in Malaysia, Goal 365 is subject to the Personal Data Protection Act 2010 (PDPA). We comply with all data protection principles prescribed under the PDPA, including the General Principle, Notice & Choice Principle, Disclosure Principle, Security Principle, Retention Principle, Data Integrity Principle, Access Principle, and Data Transfer Principle.

2Types of Personal Data Collected

Goal 365 collects only the minimum personal data necessary to provide you with the best possible service. The following are the categories of data we collect:

Goal 365 does not collect sensitive data such as your health information, religious beliefs, or political views unless you voluntarily share such information when contacting us.

3How We Collect Data

Goal 365 collects your personal data through the following methods:

• Account Registration: Information you provide when completing the Goal 365 registration form, including name, email, phone number, and date of birth.
• KYC Process: Identity verification documents you upload during the Know Your Customer (KYC) process, such as your Malaysian identification card or passport.
• Financial Transactions: Data generated when you make deposits or withdrawals using Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX (Maybank2u, CIMB Clicks).
• Platform Usage: Technical data collected automatically when you access Goal 365, including IP address, device type, and usage patterns.
• Support Interactions: Information you provide when contacting the Goal 365 customer support team via Live Chat, email, or other channels.
• Cookie Technology: Data collected through cookies, tracking pixels, and similar technologies while you browse the Goal 365 platform.

4Purpose of Personal Data Processing

Goal 365 only processes your personal data for legitimate, clearly stated purposes. Below are the purposes for which we process your data:

• Account Management: Creating, verifying, and managing your Goal 365 member account, including secure login processes.
• Payment Processing: Processing deposits and withdrawals via Goal 365's supported local Malaysian payment methods.
• Legal Compliance: Fulfilling legal obligations including KYC requirements, anti-money laundering (AML) compliance, and reporting to the relevant authorities in Malaysia.
• Fraud Prevention: Detecting and preventing fraudulent activity, multi-account usage, and misuse of the Goal 365 platform.
• Service Improvement: Analysing usage patterns to improve the gaming experience and the Goal 365 platform interface.
• Service Communications: Sending important notifications regarding your account, transactions, security updates, and changes to Goal 365's terms.
• Marketing (With Consent): Sending promotional content, bonus offers, and Goal 365 product updates to members who have given their consent.
• Responsible Gambling: Monitoring gambling behaviour to identify signs of problem gambling and provide appropriate support to members.

5Data Sharing & Disclosure

Goal 365 does not sell your personal data. We only share data with specific parties under limited and controlled circumstances:

• Payment Providers: Payment service providers such as Touch 'n Go, GrabPay, DuitNow, and local Malaysian banks that process your transactions. Data shared is limited to what is strictly necessary to complete the transaction.
• Game Providers: Third-party game providers that supply slots, Live Casino (Baccarat, Roulette), and Sports Betting platforms on Goal 365. They are bound by strict data protection agreements.
• IT Service Providers: Companies that support Goal 365's technical infrastructure — such as cloud services, fraud detection, and analytics — act as data processors operating under Goal 365's instruction.
• Authorities: Law enforcement agencies, courts, or regulatory authorities in Malaysia when required by law or court order.
• Legal Professionals: Lawyers and legal advisors in the context of legal proceedings or disputes involving Goal 365, subject to professional confidentiality.

6Security & Data Protection

Goal 365 implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, loss, destruction or disclosure:

• Data Encryption: All personal data is stored using AES-256 encryption, and all communication between your browser and the Goal 365 platform is secured by TLS 1.3 protocol.
• Access Controls: Access to member data is restricted to Goal 365 staff with a legitimate business need only, using a role-based access control (RBAC) system.
• Security Auditing: Goal 365 conducts regular penetration testing and security audits carried out by accredited independent parties.
• Two-Factor Authentication: Goal 365 members are encouraged to enable two-factor authentication (2FA) to add an extra layer of security to their accounts.
• 24/7 Monitoring: Security monitoring systems operate around the clock to detect and respond to any threats or suspicious activity.

7Data Retention Period

Goal 365 retains your personal data only for as long as necessary to fulfil the purpose of collection or to meet applicable legal requirements:

• Active Account Data: Retained for the duration your Goal 365 account is active, and for 7 years after account closure for legal compliance and audit purposes.
• Financial Transaction Records: Retained for a minimum of 7 years in accordance with Malaysia's financial and tax legislation.
• KYC Documents: Retained for 7 years after the business relationship ends, in accordance with Malaysia's Anti-Money Laundering Act.
• Technical Log Data: Retained for 12 months for security purposes and technical troubleshooting.
• Support Communication Records: Retained for 3 years to allow Goal 365 to address any subsequent enquiries or complaints.

Upon expiry of the retention period, your personal data will be securely deleted or anonymised so that it can no longer be linked to you.

8Your Rights as a Data Subject

Under Malaysia's PDPA, you have the following rights regarding the personal data held by Goal 365:

To exercise any of the rights above, please submit a written request to privacy@goal365.my or through the "Privacy Settings" section in your Goal 365 account. Goal 365 will process your request within 21 business days.

9Cookies & Tracking Technologies

Goal 365 uses cookies and similar technologies to enhance your experience on our platform. Below are the types of cookies we use:

• Essential Cookies: Required for core Goal 365 platform functions such as login sessions, security, and language preferences. These cookies cannot be disabled.
• Performance Cookies: Collects information on how you use Goal 365 to help us improve overall platform performance and user experience.
• Functional Cookies: Storing your personal preferences on Goal 365, such as display settings, game preferences, and limits you have set.
• Analytics Cookies: Helps Goal 365 understand usage patterns to improve our platform's services and content.

You can manage or disable cookies (except essential cookies) through your web browser settings. However, disabling certain cookies may affect the functionality of the Goal 365 platform.

10Children's Data Protection

Goal 365 is a platform designed exclusively for adults aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18.

If we determine that we have collected data from an individual under the age of 18, we will take immediate action to delete that data and close the relevant account.

11Cross-Border Data Transfers

In the course of its operations, Goal 365 may need to transfer your personal data to servers or processing facilities located outside Malaysia. Any such transfer will be carried out with the following safeguards in place:

• Transfers are only made to countries or territories that provide data protection equivalent to or greater than that of Malaysia
• Legally binding data transfer agreements are in place with all recipients of data outside Malaysia.
• Additional security measures are in place during cross-border data transfers
• Goal 365 takes full responsibility for ensuring your data remains protected even when it is transferred outside Malaysia.

12Privacy Policy Amendments

Goal 365 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in law, technology, or our business practices. You will be notified of any material amendments through:

• Notification email sent to the address registered to your Goal 365 account
• A notice displayed on the Goal 365 platform homepage at least 14 days before the amendments take effect
• Pop-up notification upon logging in to your Goal 365 account

Continued use of the Goal 365 platform after the effective date of any amendment constitutes your acceptance of the updated Privacy Policy. The "Updated" date at the top of this document will always reflect the latest version in force.

13Contact the Data Protection Officer

Goal 365 has appointed a Data Protection Officer (DPO) responsible for ensuring compliance with this Privacy Policy. If you have any questions, concerns, or complaints regarding privacy, please contact:

• DPO Email: privacy@goal365.my
• General Support Email: support@goal365.my
• Live Chat: Available 24/7 on the Goal 365 platform
• FAQs: Visit the FAQ us for answers to general enquiries

Goal 365 is committed to responding to all privacy-related enquiries within 5 business days. For complaints requiring further investigation, we will keep you informed of progress within 21 business days.