GemBets Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by GemBets ("GemBets", "we", "us", "our"), the operator of the online betting and casino platform accessible at gembets.cam. This Policy describes how we collect, use, store, disclose, and otherwise process personal data relating to individuals ("Players", "Users", "you") who register for, access, or interact with the gembets platform.

GemBets operates as a Malaysian-market online entertainment platform offering sports betting, live casino, slots, lottery, arcade, and esports wagering services denominated in Malaysian Ringgit (MYR/RM). Our player base is predominantly located across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam, and our data handling practices are designed with the needs and legal context of Malaysian players in mind.

By registering an account or using the gembets platform, you acknowledge that you have read this Privacy Policy and consent to the processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which form part of our overall agreement with you.

2 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, email address, date of birth, identification number, IP address, payment details, and behavioural data — that can be used directly or indirectly to identify that person.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, modification, deletion, or transfer.
• "Data Controller" means GemBets, being the entity that determines the purposes and means of processing personal data collected through the gembets platform.
• "Data Processor" means any third-party entity that processes personal data on behalf of GemBets, subject to a written data processing agreement.
• "Cookies" means small data files placed on your device by the gembets platform to enable functionality, remember preferences, and collect analytics data.
• "KYC" means Know Your Customer — the identity and age verification process conducted by gembets.
• "AML" means Anti-Money Laundering — legal and regulatory obligations that require gembets to monitor transactions and report suspicious activity.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

3 Data We Collect

GemBets collects the following categories of personal data, depending on how you interact with our platform:

4 How We Collect Personal Data

GemBets collects personal data through the following means:

4.1 Direct Collection

You provide personal data directly to us when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account settings. This is the primary source of identity and contact data held by gembets.

4.2 Automated Collection

When you access or use the gembets platform, we automatically collect technical and behavioural data through server logs, cookies, pixel tags, and similar technologies. This data is collected every time you browse the platform and helps us ensure platform stability, detect fraud, and improve user experience for Malaysian players.

4.3 Third-Party Sources

We may receive personal data from third parties in limited circumstances, including:

• Identity verification and KYC service providers, who confirm the authenticity of documents submitted during registration.
• Payment processors and financial institutions, who confirm transaction status and in some cases flag suspicious payment activity for AML purposes.
• Fraud prevention databases and industry risk-sharing platforms, where your information may be cross-referenced to detect suspicious account behaviour.
• Publicly available sources, such as sanctions lists or regulatory watch-lists, which we are legally required to screen against.

5 Purposes of Data Processing

GemBets processes your personal data for the following purposes, each of which is described in full below:

• Account Creation and Management: To register your account, maintain accurate records, and enable you to log in and use all platform features.
• Identity Verification and KYC: To verify your identity, confirm your age (minimum 21 years), and comply with our obligations under applicable anti-money laundering and fraud prevention regulations.
• Transaction Processing: To process deposits and withdrawals via your chosen payment method — including Touch 'n Go eWallet, Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX, Boost, GrabPay, and cryptocurrency — and to maintain accurate financial records.
• Customer Support: To respond to your queries, resolve disputes, investigate complaints, and deliver account management services through our 24/7 English-language support team.
• Fraud Detection and Platform Security: To monitor for and prevent fraudulent activity, bonus abuse, money laundering, multiple account registrations, and other forms of prohibited conduct as defined in our Terms & Conditions.
• Regulatory Compliance: To comply with applicable legal obligations including AML reporting, responsible gambling compliance, data retention requirements, and responses to regulatory or law enforcement requests.
• Platform Improvement and Analytics: To analyse how players use the gembets platform, identify areas for improvement, test new features, and optimise the user experience — particularly for mobile users on Malaysian networks.
• Marketing Communications (with consent): To send you promotional offers, loyalty programme updates, and product announcements where you have opted in to receive such communications. You may withdraw this consent at any time.
• Responsible Gambling: To monitor behavioural data for indicators of problem gambling and, where appropriate, apply account limits, initiate welfare checks, or action self-exclusion requests in line with our Responsible Gambling commitments.

6 Legal Basis for Processing

GemBets processes personal data only where a valid legal basis exists under applicable data protection law. The legal bases on which we rely are as follows:

• Contractual Necessity: Processing is necessary to perform our contract with you — i.e., to provide the gembets betting and casino service as described in our Terms & Conditions. This covers account management, transaction processing, and customer support.
• Legal Obligation: Processing is required for compliance with applicable law, including KYC/AML obligations, regulatory reporting, age verification, and retention of financial records. We have no discretion to refuse this processing.
• Legitimate Interests: Processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights. This includes fraud prevention, platform security, analytics, and responsible gambling monitoring. We conduct balancing tests to ensure our legitimate interests do not disproportionately impact your rights.
• Consent: For processing activities that go beyond contractual necessity or legal obligation — specifically, marketing communications and non-essential cookies — we rely on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

GemBets does not sell, rent, or exchange personal data with unaffiliated third parties for their own commercial gain. We share personal data only in the circumstances described below and only to the extent necessary for the stated purpose.

7.1 Operational Service Providers

We share data with carefully selected third-party service providers who assist us in operating the gembets platform, including KYC verification providers, payment processors (covering local Malaysian methods such as DuitNow, FPX, and Touch 'n Go eWallet, as well as international cryptocurrency processors), IT infrastructure providers, fraud detection services, and customer support software providers. All such providers are bound by data processing agreements that restrict them from using your data for any purpose other than providing services to gembets.

7.2 Regulatory and Law Enforcement Authorities

We may disclose personal data to regulatory bodies, law enforcement agencies, and financial intelligence units where we are legally required to do so — for example, in connection with AML reporting obligations, investigations into suspected financial crime, or in response to a court order. We will notify you of any such disclosure where we are legally permitted to do so.

7.3 Fraud Prevention and Risk Databases

GemBets participates in industry-standard fraud prevention initiatives. Personal data may be cross-referenced with shared risk databases maintained by the gaming industry for the purpose of detecting and preventing fraud, bonus abuse, and multiple account registrations across operators.

7.4 Corporate Transactions

In the event of a merger, acquisition, sale of assets, or restructuring of the gembets business, personal data held by gembets may be transferred to the relevant acquiring or successor entity. You will be notified of any such transfer and the new entity will be required to honour this Privacy Policy or provide you with a materially equivalent level of protection.

8 International Data Transfers

GemBets's primary operations are based in Malaysia and our principal data storage infrastructure is located within the region. However, some of our third-party service providers — including certain cloud infrastructure and KYC verification providers — may process personal data in jurisdictions outside Malaysia.

Where personal data is transferred internationally, GemBets ensures that appropriate safeguards are in place to protect your data to a standard materially equivalent to that required under applicable data protection principles. These safeguards include contractual protections (such as standard contractual clauses), adequacy assessments, and vendor security certifications.

9 Data Retention

GemBets retains personal data for no longer than is necessary for the purpose for which it was originally collected, or as required by applicable law and regulation. The following general retention periods apply:

At the expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be used to identify any individual. Where a legal hold or investigation is in progress, data may be retained beyond the standard period until the matter is resolved.

10 Cookies & Tracking Technologies

GemBets uses cookies and similar tracking technologies (such as pixel tags and local storage) on the gembets platform. These technologies serve different functions, which are categorised as follows:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable you to log in, maintain your session, and complete transactions. They cannot be disabled without impairing core functionality.
• Performance and Analytics Cookies: These cookies collect anonymised data about how players use gembets — which pages are visited most, where users encounter errors, and how the platform performs on Malaysian mobile networks. This data helps us improve the platform. Analytics cookies require your consent.
• Functionality Cookies: These cookies remember your preferences, such as preferred language, display settings, and previously selected payment methods, to provide a more personalised experience.
• Marketing and Targeting Cookies: Where you have consented, these cookies track your activity across sessions to enable us to deliver relevant promotional content and measure campaign effectiveness. They are only activated with your explicit opt-in.

You can manage your cookie preferences at any time by adjusting your browser settings or, where applicable, through the cookie preference centre on the gembets platform. Please note that disabling strictly necessary cookies will impair your ability to use the platform.

11 Security Measures

GemBets implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our key security measures include:

• Encryption: All data in transit is protected by 256-bit SSL/TLS encryption. Sensitive data stored at rest — including payment details, KYC documents, and account credentials — is encrypted using industry-standard algorithms.
• Access Controls: Access to personal data within gembets is restricted on a strict need-to-know basis. Staff with authorised access are subject to confidentiality obligations and regular security training.
• Multi-Factor Authentication: Administrative access to production systems containing personal data requires multi-factor authentication. We also offer 2FA options to players for their own account security.
• Intrusion Detection and Monitoring: Our platform infrastructure is monitored continuously for anomalous activity, intrusion attempts, and data breaches using automated security tooling and human oversight.
• Regular Security Audits: GemBets engages independent security professionals to conduct periodic penetration tests and vulnerability assessments of the platform and underlying infrastructure.
• Data Breach Response: In the event of a data breach that poses a risk to your rights and freedoms, GemBets will notify affected players and, where required by applicable law, relevant regulatory authorities, within the timeframe prescribed by law.

12 Your Rights as a Data Subject

Subject to applicable data protection law and certain limitations, you have the following rights regarding your personal data held by GemBets. To exercise any of these rights, please contact us at [email protected] with a clear description of your request and sufficient information for us to verify your identity.

GemBets will respond to all verified data subject requests within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day window. There is generally no fee for exercising your rights, except where requests are manifestly unfounded or excessive.

13 Data Processing Relating to Minors

The gembets platform is strictly intended for individuals aged 21 years and above. GemBets does not knowingly collect, process, or retain personal data relating to individuals under the age of 21.

As part of our registration and KYC processes, we verify the age of all players. Where we have reason to believe that personal data has been provided by or on behalf of a person under 21, we will immediately suspend the associated account, delete or quarantine the personal data in question, and void any transactions made under that account pending investigation.

If you believe that gembets may have inadvertently collected data from a person under 21, please contact us immediately at [email protected]. We will investigate and take appropriate action as swiftly as possible.

Parents and guardians concerned about underage access to gambling platforms are encouraged to install parental control software on shared devices and to monitor any financial accounts or e-wallets accessible to minors, including Touch 'n Go eWallet and Boost accounts.

14 Changes to This Privacy Policy

GemBets reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. The most current version of this Policy will always be accessible on this page, with the "Last updated" date revised accordingly.

Where we make material changes to this Policy — changes that significantly affect how we process your personal data or the rights available to you — we will notify registered players by email to the address on their account at least 14 days prior to the changes taking effect. For minor or clarificatory changes, the updated Policy will take effect upon publication.

Your continued use of the gembets platform after a change notification constitutes your acceptance of the revised Privacy Policy. If you do not accept any material change, you should cease using the platform and contact us to close your account. We will process any remaining eligible balance upon verified account closure.

15 Contact Us

GemBets takes data privacy seriously and maintains a dedicated team to handle all privacy-related enquiries, data subject requests, and complaints. If you have any questions about this Privacy Policy, or if you wish to exercise any of the rights described in Section 12, please contact us using the details below.

This Privacy Policy was last reviewed and updated on 1 January 2026. If you have concerns about how your data has been handled that remain unresolved after contacting gembets, you may be entitled to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.