Privacy Policy

This Privacy Policy ("Policy") describes how GemsBet ("GemsBet", "we", "us", "our") collects, processes, stores, and protects personal data belonging to users ("Player", "you", "your") of the GemsBet online gaming platform, accessible at gemsbet.cam.

GemsBet operates as an international online gaming platform serving Malaysian players. We take our data protection obligations seriously and have designed our data practices to align with internationally recognised privacy standards, including those commonly referred to as the principles underlying the General Data Protection Regulation (GDPR) and other applicable data protection frameworks relevant to our operating jurisdiction.

This Policy applies to all personal data collected through your use of the GemsBet website, mobile interface, customer support channels, and any other interaction with our services. It applies to all players regardless of their location, including players accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations across Malaysia.

• "Personal Data" means any information that can directly or indirectly identify a natural person, including name, email address, date of birth, residential address, financial details, and device identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, GemsBet.
• "Data Processor" means a third party that processes personal data on behalf of GemsBet under a contractual arrangement, such as a payment service provider or KYC verification vendor.
• "Consent" means freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a defined purpose.
• "Sensitive Data" means a subset of personal data warranting enhanced protection, including but not limited to government-issued identity document numbers and financial account details.
• "KYC Data" means identity and address verification documents submitted by a Player in accordance with our Know Your Customer procedures.

GemsBet acts as the Data Controller in respect of personal data collected and processed through the Platform. As Data Controller, GemsBet determines the purposes for which your personal data is collected and the manner in which it is processed. Where GemsBet engages third-party service providers to process data on its behalf, those providers act as Data Processors subject to contractual data processing agreements.

Players with privacy-related inquiries, data access requests, or complaints may contact GemsBet's privacy team via the contact details set out in Section 16 of this Policy.

GemsBet collects personal data through several channels during the course of your relationship with the Platform. The categories of data collected include:

4.1 Registration Data

• Full legal name
• Date of birth (for age verification — minimum age 21 years)
• Email address
• Residential address (including postcode and country)
• Username and encrypted password
• Phone number (optional at registration; may be required for two-factor authentication)

4.2 Identity Verification (KYC) Data

• Copy of government-issued photo ID (Malaysian MyKad, driver's licence, or passport)
• Proof of address document (utility bill or bank statement — issued within 3 months)
• Selfie photograph for liveness verification

4.3 Financial & Transaction Data

• Payment method identifiers (e-wallet ID, bank account number — last 4 digits only, cryptocurrency wallet address)
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method used
• Currency denomination (MYR or other supported currency)

4.4 Gaming Activity Data

• Game session logs (games played, bet sizes, session duration, win/loss records)
• Sports betting history (markets wagered, odds accepted, outcomes)
• Bonus activations, wagering progress, and promotional participation records

4.5 Technical & Device Data

• IP address and approximate geolocation derived therefrom
• Device type, operating system, and browser information
• Session timestamps and log data
• Cookie identifiers and session tokens (see Section 10)

4.6 Communications Data

• Records of live chat, email, and any other support communications
• Feedback, complaints, and dispute correspondence

GemsBet processes your personal data for the following defined purposes:

GemsBet will not use your personal data for any purpose not listed above without providing prior notice and, where required, obtaining your consent.

GemsBet processes your personal data on one or more of the following legal bases:

• Contract Performance: Processing necessary to provide the services you have registered for and to fulfil our contractual obligations to you, including account management, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including anti-money laundering (AML) obligations, KYC requirements, and responsible gambling mandates imposed by our operating licence conditions.
• Legitimate Interest: Processing in pursuit of GemsBet's legitimate business interests, including fraud prevention, platform security, and product improvement — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out with your explicit and freely given consent, such as sending marketing communications or using non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

GemsBet does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. Data may be disclosed to the following categories of recipients, strictly for the purposes described:

7.1 Payment Service Providers

We share necessary transactional and identity data with payment processors to facilitate deposits and withdrawals. This includes providers supporting Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, and cryptocurrency network operators. These providers receive only the minimum data required to process the specific transaction.

7.2 Identity Verification Vendors

Third-party KYC and AML service providers process identity documents and biometric selfie data on our behalf to verify player identities as part of our compliance obligations. These vendors are bound by strict data processing agreements and may not use KYC data for any purpose other than the verification service provided to GemsBet.

7.3 Gaming Technology Providers

Game studios and live dealer operators may receive anonymised session identifiers and game-result data necessary for game operation and dispute resolution. No directly identifiable personal data (such as full name or payment details) is shared with game studios.

7.4 Legal and Regulatory Authorities

GemsBet may disclose personal data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where required by applicable law, court order, or in response to a lawful regulatory inquiry. We will notify you of such disclosures where legally permitted to do so.

7.5 Professional Advisers

Lawyers, accountants, and auditors engaged by GemsBet may access personal data where necessary for the provision of their services, subject to professional confidentiality obligations.

GemsBet retains personal data for defined periods appropriate to the purpose of collection and consistent with applicable legal retention obligations:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised such that it can no longer be attributed to an identified individual.

Subject to applicable law and certain limitations inherent to our compliance obligations, you hold the following rights in relation to your personal data held by GemsBet:

To exercise any of these rights, please contact GemsBet's privacy team using the contact information in Section 16. We will respond to verified requests within 30 calendar days. Where a request is complex or numerous, we may extend this period by a further 60 days with prior notification.

GemsBet uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that help us deliver a functional and secure user experience.

10.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens and security cookies. They cannot be disabled without impairing core functionality.
• Performance & Analytics Cookies: Anonymised data about how players navigate and interact with the Platform, used to identify usability issues and improve overall performance. No personally identifiable information is included in analytics reports.
• Functional Cookies: Store your preferences such as language, currency display (MYR), and game lobby layout settings to personalise your experience on return visits.
• Marketing Cookies: Used only with your consent to deliver relevant promotional information. These track whether you have viewed or interacted with a particular promotion. You may opt out at any time.

10.2 Managing Cookies

You can manage or delete cookies through your browser settings. Most modern browsers (Chrome, Firefox, Safari, Edge) allow you to block or delete specific categories of cookies. Please note that disabling strictly necessary cookies will prevent certain core functions of the Platform from operating correctly.

As an internationally operating platform, GemsBet may transfer personal data to, and process it in, countries other than Malaysia. This may include our server infrastructure, KYC vendors, or payment processing partners located in other jurisdictions.

Where personal data is transferred internationally, GemsBet ensures that appropriate safeguards are in place to protect your data, including contractual clauses that require receiving parties to apply data protection standards equivalent to those we apply within our own operations. We do not transfer personal data to jurisdictions that lack adequate data protection frameworks without implementing such contractual safeguards.

GemsBet is strictly for persons aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. The Platform is not designed for, marketed to, or intended to be accessed by minors.

Where GemsBet discovers or has reasonable grounds to believe that a registered player is under the minimum age, the account will be suspended immediately pending age verification. Any personal data collected from a person subsequently confirmed to be under 21 will be deleted, and any associated funds will be returned via the deposit method used.

GemsBet implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in transit: All data transmitted between your device and GemsBet servers is encrypted using 256-bit SSL/TLS protocols. Look for the padlock icon in your browser to confirm the secure connection.
• Encryption at rest: Sensitive data stored on our servers, including financial records and KYC documents, is encrypted using industry-standard encryption at rest.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff with data access undergo background checks and receive mandatory data protection training.
• Two-factor authentication (2FA): Available to all players and mandatory for certain account actions such as withdrawal requests above defined thresholds.
• Penetration testing: Our infrastructure undergoes regular independent security assessments to identify and remediate vulnerabilities.
• Data breach response: In the event of a confirmed personal data breach that presents a risk to player rights, GemsBet will notify affected players and relevant authorities within the timeframes required under applicable law.

While we apply rigorous security measures, no internet-based system is entirely immune to risk. Players are strongly advised to use strong, unique passwords for their GemsBet account, enable 2FA, and never share login credentials with any third party.

The GemsBet platform does not contain outbound links to external third-party websites. However, certain integrated services — such as payment gateways and game platforms — may operate under their own independent privacy policies and terms of service.

GemsBet is not responsible for the privacy practices or content of third-party services that you access through integrated features within the Platform. Players are encouraged to review the privacy policies of any third-party service provider they interact with in the course of using GemsBet.

GemsBet reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or operational requirements. The "Last updated" date at the top of this document will be revised accordingly upon each update.

Where changes are material — for example, a change to the purposes for which we process data or the introduction of new data sharing arrangements — we will provide at least seven (7) days' advance notice by posting a prominent notice on the Platform and/or sending notification to your registered email address.

Your continued use of GemsBet following the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not agree with any modification, you should discontinue use of the Platform and request account closure.

For all privacy-related inquiries, data access requests, or complaints regarding GemsBet's data processing activities, please contact our privacy team through the following channels:

• Email: support at gemsbet.cam — please include "Privacy Request" in the subject line for faster routing
• Live Chat: Available 24 hours a day, 7 days a week, through the GemsBet Platform interface
• Response commitment: Privacy inquiries are acknowledged within 5 business days; substantive responses to data rights requests are provided within 30 calendar days

When submitting a data rights request, please provide your registered username and email address to enable identity verification before data is disclosed or acted upon. GemsBet may request additional verification in cases where the account holder's identity cannot be confirmed from the initial request.