Privacy Policy —
gem888 Data Commitment

1.Introduction

gem888 ("gem888", "we", "us", "our") operates the online casino and sports betting platform accessible at gem888.cam (the "Platform"). We are committed to processing your personal data responsibly, transparently, and in full compliance with the applicable data protection and privacy laws governing our operations.

This Privacy Policy ("Policy") describes in detail the categories of personal data we collect from you, the purposes for which it is processed, the legal bases upon which processing relies, the parties with whom it may be shared, the safeguards we apply, and the rights available to you as a data subject. This Policy applies to all Members, registered users, visitors, and any person who interacts with the Platform, its customer support channels, or any promotional materials issued by gem888.

By registering an Account, accessing the Platform, or otherwise engaging with gem888's services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact us to arrange closure of your account and erasure of your personal data where applicable.

2.Definitions

For the purposes of this Policy, the following terms shall have the meanings set out below:

3.Data We Collect

gem888 collects the minimum personal data necessary to operate the Platform, comply with regulatory obligations, and deliver a secure and personalised experience to Members. The categories of personal data we process are outlined in the table below:

4.How We Collect Your Data

gem888 collects personal data through the following channels and mechanisms:

• Direct Submission: Information you provide when registering an Account, completing KYC verification, initiating deposits or withdrawals, or communicating with our support team via live chat, email, or WhatsApp.
• Automated Collection: Technical and behavioural data collected automatically when you access or use the Platform — including IP addresses, session data, cookies, and device identifiers — via our servers and analytics infrastructure.
• Payment Processors: Financial confirmation data received from FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency network processors in connection with deposit and withdrawal transactions.
• KYC Service Providers: Identity verification outcomes and risk scores provided by our contracted KYC and anti-money laundering (AML) compliance service providers upon submission of identity documents.
• Fraud and Risk Systems: Behavioural and transactional signals generated by our internal fraud detection systems and third-party risk assessment tools to identify suspicious or anomalous account activity.

5.Data Processing & Purposes

gem888 processes personal data solely for defined, legitimate, and specified purposes. We do not process personal data in any manner incompatible with the purposes for which it was originally collected. The primary purposes of data processing are as follows:

• Account Management: Creating, maintaining, and administering your Member Account, including authentication, balance management, and communication of account-related notices.
• Service Delivery: Enabling access to casino games, sports betting markets, live dealer tables, and all other Platform features in accordance with your membership status and responsible gambling settings.
• Payment Processing: Facilitating deposits, processing withdrawal requests, reconciling financial records, and detecting payment fraud — in compliance with anti-money laundering (AML) obligations.
• Identity Verification (KYC): Verifying your identity and age (21+) before processing withdrawals, in compliance with regulatory requirements applicable to gem888's gaming licence.
• Regulatory Compliance: Meeting legal obligations including transaction reporting, record retention, sanctions screening, and cooperation with law enforcement or regulatory bodies where required by law.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, money laundering, and other unlawful conduct on the Platform.
• Responsible Gambling: Monitoring gaming activity to identify patterns consistent with problem gambling behaviour, enforcing deposit limits and self-exclusion settings, and contacting Members where welfare concerns arise.
• Customer Support: Responding to queries, resolving disputes, and maintaining support records to ensure continuity and quality of service.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve Platform performance, game selection, user experience, and service quality.
• Marketing Communications (with consent): Sending promotional offers, bonus notifications, and relevant gaming updates to Members who have opted in to marketing communications. You may withdraw consent at any time.

6.Legal Basis for Processing

Every instance of personal data processing at gem888 is underpinned by one or more of the following recognised legal bases:

7.Data Sharing & Disclosure

gem888 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may disclose personal data to the following categories of recipients only where necessary for the purposes described in this Policy, and only under appropriate contractual, legal, or regulatory safeguards:

• Payment Service Providers: FPX (PayNet Malaysia), DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency network processors — to facilitate and confirm financial transactions. These providers receive only the minimum data necessary to process the relevant transaction.
• KYC and AML Compliance Providers: Contracted identity verification and anti-money laundering screening services that process identity documents and perform sanctions checks on our behalf, bound by strict data processing agreements.
• Cloud Infrastructure and IT Services: Hosting, database, and cybersecurity service providers who process technical and operational data on gem888's infrastructure. All such providers are bound by confidentiality obligations and data processing agreements.
• Customer Support Platform Providers: Third-party live chat and ticketing system providers through which Member support interactions are conducted, subject to contractual data protection obligations.
• Regulatory Authorities and Law Enforcement: Where gem888 is under a legal obligation or receives a binding order to disclose personal data to a regulatory body, gaming authority, financial intelligence unit, or law enforcement agency, we will comply with such requirements to the extent mandated by applicable law.
• Professional Advisors: Solicitors, auditors, and compliance consultants engaged by gem888, where disclosure is necessary for the provision of professional advice — subject to professional confidentiality obligations.

8.Data Retention

gem888 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulatory obligation, or gaming licence conditions. The following retention guidelines apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with gem888's data destruction procedures. Anonymised aggregated data may be retained indefinitely for statistical and analytical purposes, as it can no longer be linked to any identifiable individual.

9.Cookies & Tracking Technologies

gem888 uses cookies and similar tracking technologies on the Platform to enable core functionality, enhance security, and — where you have provided consent — improve your experience and enable relevant communications.

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without disrupting Platform functionality.
• Functional Cookies: Remember your preferences — such as language setting, responsible gambling tool configurations, and display preferences — across sessions.
• Analytical Cookies: Used to collect aggregated, anonymised information about how Members interact with the Platform — including page views, session duration, and feature usage — to support platform improvement. These are deployed only with your consent.
• Security Cookies: Support fraud detection and prevention systems by helping identify unusual access patterns, such as simultaneous logins from geographically distinct IP addresses.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform effectively, including preventing secure login. gem888 does not use third-party advertising or cross-site tracking cookies.

10.Data Security

gem888 implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security controls include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and gem888's servers is encrypted using industry-standard Transport Layer Security (TLS), equivalent to the encryption used by major Malaysian banks.
• Two-Factor Authentication (2FA): Members can enable 2FA on their Accounts to add an additional layer of access security beyond password authentication.
• Encrypted Data Storage: Sensitive personal data — including KYC documents, financial details, and identity numbers — is stored in encrypted form at rest on access-controlled servers.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. gem888 staff are subject to confidentiality obligations and regular security training.
• Intrusion Detection and Monitoring: Our security operations team runs 24/7 monitoring of platform infrastructure for anomalous access patterns, potential intrusions, and data breach indicators.
• Regular Security Audits: Third-party security assessments and penetration testing are conducted periodically to identify and remediate vulnerabilities in our systems.

In the event of a personal data breach that poses a risk to the rights and freedoms of affected Members, gem888 will notify impacted individuals and relevant authorities within the timeframe required by applicable law, and will take immediate remedial action.

11.Your Data Rights

As a data subject, you hold a range of rights over your personal data held by gem888. We are committed to facilitating the exercise of these rights promptly and without undue friction. The rights available to you are as follows:

To exercise any of the rights above, please contact gem888 at [email protected] with the subject line "Data Rights Request". We may request identity verification before processing your request to ensure the security of your data. We will acknowledge your request within five (5) business days and respond fully within thirty (30) calendar days.

12.International Data Transfers

gem888 operates globally and may transfer personal data to, or process it in, countries outside Malaysia where our service providers and infrastructure partners are based. Such transfers may include servers located in jurisdictions with different data protection frameworks from Malaysia.

Where personal data is transferred internationally, gem888 ensures that adequate safeguards are in place to protect it to an equivalent standard as that applied within Malaysia. These safeguards include contractual data processing agreements with all third-party processors, requiring them to maintain appropriate technical and organisational security measures and to process data only in accordance with gem888's documented instructions.

13.Protection of Minors

gem888 is strictly an adult platform. Registration and use of our services are permitted only for individuals who are 21 years of age or older. We do not knowingly collect or process personal data of individuals under this age.

If gem888 becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to: (a) suspend the Account pending investigation; (b) delete or anonymise all personal data associated with the Account; (c) void any wagers placed and return any funds to the source payment method where recoverable; and (d) document the incident in accordance with our compliance obligations.

We encourage parents and guardians to monitor the online activities of children in their care. Parental control software is available that can restrict access to gambling-related websites. If you believe a minor may have accessed gem888, please contact us immediately at [email protected].

14.Policy Amendments

gem888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Where amendments are material — that is, where they meaningfully affect your rights or how your data is used — we will notify registered Members via their registered email address at least fourteen (14) calendar days before the changes take effect.

We encourage all Members to review this Policy periodically. The "Last Updated" date displayed at the top of this page will be revised upon each material amendment. Continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement of the updated terms.

15.Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by gem888, please contact our Data Protection team using the details below. All privacy-related requests and complaints will be acknowledged within five (5) business days and resolved within thirty (30) calendar days.