Privacy Policy

1 Introduction

gem368 ("we", "us", "our", "the Platform") operates the website accessible at https://gem368.cam and is committed to protecting the privacy of all users ("you", "your") who access or interact with the Platform. This Privacy Policy sets out the basis on which we collect, process, use, store and disclose personal data in connection with your use of gem368.

This Policy applies to all personal data collected through gem368.cam, including data submitted during account registration, identity verification, payment processing, customer support interactions and general use of the Platform's features.

gem368 is designed for adult users based primarily in Malaysia. The Platform provides English-language information relating to online casino entertainment, sports betting, Malaysian payment methods including Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX, account security guidance and responsible gambling practices. These purposes shape what data we collect and how we use it.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including names, identification numbers, contact details, location data and online identifiers.
• "Data Subject" refers to any identified or identifiable natural person whose Personal Data is processed by gem368.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
• "Controller" means gem368, the entity that determines the purposes and means of processing Personal Data.
• "Processor" means any third party that processes Personal Data on behalf of gem368, under a binding contractual agreement.
• "Cookies" refers to small text files placed on a user's device by a website to store browsing preferences, session state and analytics information.
• "KYC" ("Know Your Customer") refers to identity verification and due-diligence procedures conducted to confirm user identity and comply with anti-money-laundering obligations.
• "Special Category Data" means sensitive personal information including health data, financial details beyond transactional records, and biometric data — categories that attract heightened legal protection.

3 Information We Collect

gem368 may collect the following categories of personal data:

3.1 Identity & Registration Data

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Username and password (stored in encrypted form)
• Nationality and country of residence
• Malaysian MyKad number, passport number or driving licence number (for KYC verification)

3.2 Contact Data

• Email address
• Mobile phone number
• Residential address (for address verification, where required)

3.3 Financial & Payment Data

• Bank account details (name, account number, bank name — e.g., Maybank, CIMB, Public Bank, Hong Leong)
• eWallet identifiers (Touch 'n Go eWallet, Boost, GrabPay registered mobile number)
• DuitNow and FPX transaction references
• Transaction history including deposit amounts, withdrawal requests and MYR values

3.4 Verification Documents

• Scanned or photographed copies of identity documents (MyKad, passport or driving licence)
• Proof of address documents (utility bills or bank statements issued within three months)
• Selfie images taken whilst holding a valid identity document

3.5 Technical & Usage Data

• IP address and approximate geolocation
• Device type, operating system and browser version
• Pages visited, session duration and clickstream data
• Referral source and search terms used to locate the Platform

3.6 Communications Data

• Customer support enquiries submitted by email or live chat
• Feedback, complaints and dispute correspondence

4 How We Collect Data

gem368 collects personal data through the following channels:

• Direct submission: Data you actively provide when registering an account, completing KYC verification, contacting support or submitting feedback.
• Automated technical collection: Data collected automatically as you navigate the Platform, including through cookies, web beacons, server logs and analytics tools.
• Payment processors: Transaction data passed to gem368 from third-party payment providers during deposit and withdrawal processing.
• Identity verification partners: In some cases, identity data may be confirmed through licensed KYC service providers that cross-reference submitted documents against authoritative databases.

5 Purposes of Data Processing

gem368 processes personal data for the purposes listed in the table below. Each purpose is matched to the type of data it requires:

6 Legal Basis for Processing

gem368 relies on the following legal grounds to process personal data:

• Contract performance: Processing is necessary to fulfil the contractual obligations between gem368 and the user, including account management, payment processing and service delivery.
• Legal obligation: Processing is required to comply with applicable laws and regulations, including anti-money-laundering obligations, age verification requirements and financial record-keeping standards.
• Legitimate interests: gem368 processes certain data where it is necessary for legitimate business purposes such as platform security, fraud prevention and analytics, provided these interests do not override the fundamental rights of users.
• Consent: Where gem368 relies on consent — for example, for optional marketing communications — users may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Retention

gem368 retains personal data for no longer than is necessary to fulfil the purposes for which it was collected, subject to any overriding legal, regulatory or dispute-resolution requirements.

General retention guidelines are as follows:

• Account and identity data: Retained for the duration of account activity and for up to five years following account closure, to meet legal obligations.
• KYC verification documents: Retained in accordance with applicable anti-money-laundering regulations, typically for a minimum of five years from the date of verification.
• Transaction and financial records: Retained for a minimum of five years to satisfy financial record-keeping obligations and facilitate dispute resolution.
• Customer support communications: Retained for up to three years from the date of the final communication in a support thread.
• Technical and usage data: Retained in aggregated or anonymised form where possible, or for up to 13 months in identifiable form, subject to legitimate analytics needs.
• Marketing preferences and consent records: Retained for the duration of the relationship and for one year following withdrawal of consent.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with industry-standard data destruction practices.

8 Cookies & Tracking Technologies

gem368 uses cookies and similar tracking technologies to enhance Platform performance, maintain session state and gather usage analytics. Cookies are small text files stored on your device when you visit the Platform.

gem368 uses the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly. These enable core features such as user authentication, session management and security controls. They cannot be disabled without impacting Platform functionality.
• Analytics cookies: Used to collect aggregated data about how users navigate the Platform, including pages visited, session duration and referral sources. This data helps gem368 identify and improve underperforming areas of the site.
• Preference cookies: Store user settings such as language preferences and display options to provide a more consistent browsing experience across sessions.
• Marketing cookies: Where applicable and only with your prior consent, used to track interactions with Platform content and measure the effectiveness of promotional communications.

9 Data Sharing & Disclosure

gem368 does not sell, rent or trade personal data to third parties for commercial purposes. However, we may share personal data in the following limited and controlled circumstances:

• Payment service providers: Data necessary to process MYR deposits and withdrawals is shared with licensed payment processors supporting methods such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow and FPX. These providers are contractually bound to process data only for the specified payment purpose.
• KYC and identity verification partners: Identity documents and related data may be shared with licensed verification service providers to confirm user age and identity in compliance with our due-diligence obligations.
• Technology and infrastructure providers: Third-party hosting, security and analytics providers who process data on behalf of gem368 under binding data processing agreements.
• Legal and regulatory authorities: Personal data may be disclosed to competent authorities, law enforcement agencies or regulators where required by applicable law, court order or legitimate regulatory demand.
• Business transfers: In the event of a merger, acquisition or asset sale, personal data held by gem368 may be transferred to the relevant successor entity, subject to the same privacy protections described in this Policy.

10 International Data Transfers

gem368 operates with infrastructure that may involve the transfer and storage of personal data outside of Malaysia. Where such transfers occur, gem368 takes reasonable steps to ensure that the receiving entity maintains data protection standards that are substantially equivalent to those applied within the Platform.

Transfers to third-party processors located outside Malaysia are governed by contractual protections including standard contractual clauses or equivalent binding transfer mechanisms. Users who have concerns about international data transfers are encouraged to contact the gem368 support team for further detail.

11 Data Security

gem368 implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration or disclosure. These measures include:

• HTTPS encryption for all data transmitted between user devices and the Platform.
• Encrypted storage of passwords and sensitive authentication credentials.
• Role-based access controls limiting employee access to personal data on a need-to-know basis.
• Regular security assessments and vulnerability reviews of Platform infrastructure.
• Secure data destruction procedures for personal data that has reached its retention limit.

In the event of a personal data breach that poses a risk to the rights and freedoms of affected users, gem368 will notify relevant parties in accordance with applicable legal obligations.

12 Your Rights

Subject to applicable data protection laws, you have the following rights with respect to your personal data held by gem368:

• Right of access: You may request a copy of the personal data gem368 holds about you, together with information about how it is being processed.
• Right to rectification: You may request the correction of inaccurate or incomplete personal data held about you.
• Right to erasure: In certain circumstances, you may request the deletion of your personal data. This right is subject to exceptions, including where retention is required for legal compliance or ongoing transaction records.
• Right to restrict processing: You may request that gem368 restrict the processing of your personal data while an accuracy dispute or objection is under review.
• Right to data portability: Where processing is based on consent or contract, you may request that your data be provided to you in a structured, machine-readable format.
• Right to object: You may object to the processing of your data for direct marketing purposes or where processing is based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact gem368 support at [email protected]. We will acknowledge your request within five business days and respond substantively within 30 days, or notify you if additional time is required for complex requests.

13 Children & Minors

gem368 is strictly intended for users who are aged 21 years and above. We do not knowingly collect personal data from persons under 21. Age verification is a mandatory step in the account registration and KYC process.

Parents and guardians are encouraged to use available parental-control software to restrict access to gambling-related websites on devices used by minors.

14 Third-Party Links

The gem368 Platform may contain references to or links leading to third-party websites, payment portals or service platforms (such as banking portals for Maybank, CIMB or Public Bank online banking). This Privacy Policy applies exclusively to data collected and processed by gem368 and does not extend to any third-party website or service.

gem368 is not responsible for the privacy practices, data collection methods or content of third-party platforms. Users are encouraged to review the privacy policies of any external platform they visit independently of gem368.

15 Updates to This Policy

gem368 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, legal requirements or Platform features. The revised Policy will be published on this page with an updated "Last updated" date.

Where material changes are made — particularly those that affect the basis on which we process personal data — gem368 will take reasonable steps to notify registered users, for example by sending an email to the address on file or displaying a prominent notification on the Platform.

Your continued use of gem368 following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with a material change, please discontinue use of the Platform and contact support to request account closure.

16 Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or the handling of your personal data by gem368, please contact our support team using the details below. We are committed to addressing privacy enquiries promptly and transparently.

For matters relating to Platform usage rules, please refer to the gem368 Terms & Conditions. For responsible gambling support, please visit the Responsible Gambling page.