Privacy Policy — gem999

Introduction

gem999 operates as an international online entertainment platform offering casino games, live dealer tables, and sports betting services. Our primary user base consists of players in Indonesia, a market we serve with deep respect for local culture, payment preferences, and consumer expectations around digital privacy.

gem999 takes data privacy seriously — not merely as a legal obligation, but as a core operational principle. We collect only the data we genuinely need, we retain it only for as long as necessary, and we protect it with technical measures appropriate to the sensitivity of the information concerned. This policy is your complete reference for understanding how all of that works in practice.

Throughout this document, references to "gem999", "we", "us", or "our" refer to the entity that owns and operates the gem999 platform at gem999.bet. References to "you", "your", or "the Player" refer to any individual who accesses or uses the gem999 platform in any capacity.

Definitions

The following terms carry the meanings set out below wherever they appear in this Privacy Policy:

Data We Collect

gem999 collects Personal Data across several categories, depending on the nature of your interaction with the platform. The table below summarises the categories of data we collect and representative examples within each category.

gem999 does not collect full credit or debit card numbers. gem999 does not collect biometric data beyond what is strictly required for identity liveness verification during KYC. gem999 does not collect sensitive personal data such as religious beliefs, political opinions, or health records, except where voluntarily disclosed by a player in the context of a responsible gaming support request.

How We Collect Data

gem999 collects Personal Data through the following channels:

• Direct interactions: Data you provide when registering an account, completing the KYC verification process, making a deposit or withdrawal request, contacting customer support via live chat, email, or WhatsApp, or completing any other form on the platform.
• Automated technical collection: Data collected automatically when you visit gem999.bet — including IP address, device fingerprint, browser cookies, and session analytics — regardless of whether you are a registered user.
• Payment processors: Confirmation data returned by BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, LinkAja, and other payment partners, confirming that a transaction has been initiated or completed. gem999 does not receive raw banking credentials from these providers.
• KYC verification providers: Identity match scores, document authenticity flags, and sanctions-list screening results returned by gem999's contracted third-party identity verification service.
• Game studios: Aggregated bet and outcome data returned by game studios (e.g., Pragmatic Play, Evolution Gaming, Spribe, Pocket Games Soft) to reconcile account balances and settle promotions.
• Fraud and risk systems: Behavioural risk scores and device reputation data from gem999's internal fraud detection infrastructure and contracted anti-fraud service providers.

Purpose & Legal Basis for Processing

gem999 processes Personal Data only where a lawful basis exists. The primary purposes for which we process your data, and the corresponding legal basis in each case, are set out below:

gem999 will not use your Personal Data for any purpose that is incompatible with the purposes listed above without obtaining your prior consent or establishing a new lawful basis.

Data Sharing & Disclosure

gem999 does not sell, rent, or trade your Personal Data to any third party for marketing or commercial purposes. We share data only in the limited circumstances described below, and only to the extent strictly necessary for each purpose:

• Payment processors and banking partners: We share the minimum necessary transaction data (name, account number, amount, reference) with BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja to process your deposits and withdrawals. Each provider is bound by its own regulatory obligations and data protection commitments.
• KYC and identity verification providers: We transmit your identity documents and a liveness photograph to our contracted KYC service provider solely for the purpose of verifying your identity and age. The provider is contractually prohibited from using your data for any purpose beyond the verification service.
• Game studios: We share your account identifier and session token with the game studio whose title you are actively playing (e.g., Pragmatic Play, Evolution Gaming, Spribe) to facilitate real-time gameplay and settle game outcomes. Studios do not receive your full name, payment details, or contact information.
• Fraud and risk intelligence providers: Anonymised or pseudonymised technical data (IP address, device fingerprint, behavioural pattern data) may be shared with contracted anti-fraud service providers to assess and mitigate fraud risk. These providers are not permitted to use the data for any purpose beyond fraud prevention.
• Cloud infrastructure and hosting providers: gem999's platform is hosted on enterprise cloud infrastructure. The hosting provider has access to server data solely for the purpose of operating and maintaining the infrastructure, under a binding data processing agreement.
• Legal and regulatory authorities: gem999 will disclose Personal Data to competent authorities — including financial intelligence units and law enforcement agencies — where required to do so by applicable law, a valid court order, or a binding regulatory directive. gem999 will notify you of any such disclosure to the extent permitted by law.
• Corporate transactions: In the event of a merger, acquisition, or sale of gem999's business or assets, Personal Data may be transferred to the acquiring entity, provided the acquiring entity agrees to honour the privacy commitments set out in this policy.

Cookies & Tracking Technologies

gem999 uses cookies and similar tracking technologies on the gem999.bet website. The following table describes the categories of cookies we deploy and their purpose:

gem999 does not deploy advertising or cross-site tracking cookies. We do not use third-party advertising networks or retargeting pixels on gem999.bet.

You may manage or delete cookies at any time through your browser settings. Disabling strictly necessary or security cookies will impair your ability to log in and use the platform. Disabling functional or analytics cookies will not affect core gameplay functionality but may reduce the personalisation of your experience.

Data Retention

gem999 retains Personal Data for as long as is necessary to fulfil the purpose for which it was collected, and in any event for as long as required by applicable legal and regulatory obligations. The following retention periods apply as defaults:

• Active account data: Retained for the lifetime of the account and for a minimum of 5 years following permanent account closure, to satisfy anti-money-laundering record-keeping requirements.
• Transaction records (deposits and withdrawals): Retained for a minimum of 5 years from the date of each transaction in accordance with financial record-keeping obligations.
• KYC identity documents: Retained for a minimum of 5 years from the date of verification or from the date of account closure, whichever is later.
• Customer support communications: Retained for 3 years from the date of each interaction, or longer where the interaction relates to a dispute, complaint, or potential legal claim.
• Session and technical logs: Retained for 13 months from the date of each session for fraud and security review purposes, then deleted or anonymised.
• Marketing communications preferences: Retained until you withdraw consent for marketing communications. Withdrawal of consent is recorded and retained permanently as evidence of compliance.
• Responsible gaming records: Self-exclusion and cooling-off period records are retained for a minimum of 5 years to prevent re-registration and to support any subsequent responsible gaming review.

Upon expiry of the applicable retention period, Personal Data is either securely deleted from gem999's systems or rendered permanently anonymous so that it can no longer be linked to any individual. gem999 does not retain data "just in case" — retention beyond the periods above requires a specific, documented justification.

Data Security

gem999 implements a layered security architecture to protect your Personal Data against unauthorised access, accidental loss, destruction, and misuse. The key technical and organisational measures in place include:

• 256-bit TLS/SSL encryption for all data in transit between your browser and gem999's servers, including all login sessions, game sessions, and payment transactions.
• AES-256 encryption at rest for all Personal Data stored in gem999's database infrastructure, including identity documents, financial records, and contact details.
• Password hashing using a modern salted hashing algorithm (bcrypt). gem999 does not store plaintext passwords and cannot retrieve your password — only reset it via the account recovery process.
• Role-based access controls (RBAC) ensuring that gem999 staff can access Personal Data only to the extent required for their specific role. Access to Sensitive Personal Data (identity documents, financial records) is logged, audited, and restricted to a small number of authorised compliance and finance personnel.
• Two-factor authentication (2FA) available to all registered players and mandatory for all gem999 staff accounts with access to backend systems.
• Regular penetration testing conducted by independent third-party security firms on an annual basis, with critical vulnerabilities patched within 48 hours of identification.
• DDoS protection and web application firewall (WAF) at the network perimeter to prevent platform disruption and block malicious traffic patterns.

Your Rights Over Your Personal Data

gem999 respects your right to understand and control how your Personal Data is used. The following rights are available to all gem999 users and may be exercised free of charge by contacting our support team:

• Right of Access: You may request a copy of all Personal Data gem999 holds about you. gem999 will respond within 30 days of a verified request.
• Right to Rectification: If any Personal Data gem999 holds about you is inaccurate or incomplete, you may request that it be corrected. Account profile data (email, phone number, address) may be updated directly within your account settings for minor changes; corrections to KYC identity documents require support team assistance.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data. gem999 will honour this request except where retention is required by law (e.g., anti-money-laundering record-keeping), where the data is needed to defend a pending legal claim, or where gem999 has a legitimate overriding interest (e.g., maintaining a record of a self-exclusion to prevent re-registration).
• Right to Restrict Processing: You may request that gem999 stop actively using your Personal Data while you contest its accuracy or the lawful basis for processing, pending resolution of your objection.
• Right to Data Portability: You may request a machine-readable export of Personal Data you have provided to gem999 directly (e.g., account profile data, transaction history). This right applies to data processed on the basis of consent or contract performance.
• Right to Object: You may object to processing carried out on the basis of legitimate interest, including responsible gaming profiling and platform analytics. gem999 will cease such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To opt out of marketing emails, use the unsubscribe link in any gem999 marketing email or contact support.

To exercise any of the above rights, contact gem999 support via live chat or email at [email protected]. gem999 will verify your identity before processing any data rights request. gem999 aims to respond to all verified requests within 30 calendar days; complex requests may take up to 60 days, and gem999 will notify you if an extension is required.

International Data Transfers

gem999 operates as an international platform and may store or process your Personal Data in countries outside Indonesia, including in jurisdictions where gem999's cloud infrastructure, KYC providers, or game studio partners maintain data centres.

When Personal Data is transferred internationally, gem999 ensures that appropriate safeguards are in place to protect it to a standard at least equivalent to the protections described in this policy. These safeguards include:

• Binding contractual clauses with all data processors that establish minimum security and privacy standards consistent with internationally recognised data protection frameworks.
• Transfers only to service providers who have demonstrated compliance with recognised international data security standards (e.g., ISO 27001 certified infrastructure providers).
• Strict data minimisation — only the data strictly necessary for the contracted service is transferred; no bulk transfers of Personal Data are made to third-party processors for unrelated purposes.

By using the gem999 platform, you acknowledge that your Personal Data may be processed outside Indonesia as part of the normal operation of the service described in this policy.

Minors

gem999 is strictly an adults-only platform (21+ only). gem999 does not knowingly collect Personal Data from any individual under the age of 21. Age verification is a mandatory step in the account registration and KYC processes.

If gem999 discovers — through KYC review, complaint, or any other means — that a registered account belongs to an individual under the age of 21, the account will be immediately and permanently closed. Any deposits made will be refunded to the originating payment method after a compliance review; any winnings accumulated will be voided.

If you believe that a minor has registered an account on gem999 or is accessing the platform, please contact gem999 support immediately at [email protected]. gem999 takes these reports seriously and will investigate all credible notifications as a compliance priority.

Third-Party Links & Integrations

The gem999 platform integrates with third-party game studios, payment providers, and security services as described in this policy. While gem999 carefully vets all third-party partners, gem999 is not responsible for the privacy practices of any third-party service that operates its own independent platform, app, or interface.

gem999.bet does not contain outbound links to external websites for advertising or affiliate purposes. Any links you encounter on the platform will direct you to other pages within gem999.bet only. If you access a third-party platform or service through a link you found outside of gem999.bet (e.g., via a third-party affiliate site), gem999 is not responsible for the data practices of that third party, and you should review its own privacy policy independently.

Changes to This Privacy Policy

gem999 reserves the right to update or amend this Privacy Policy at any time. The most current version of the policy will always be available at gem999.bet/privacy-policy, and the "Last Updated" date at the top of this page will reflect when the most recent revision was published.

Where a change is material — meaning it significantly affects how we collect, use, or share your Personal Data — gem999 will notify registered players by email at least 7 calendar days before the change takes effect. Non-material changes (such as typographical corrections, restructuring of clauses for clarity, or updates to contact details) may take effect immediately without advance notice.

Your continued use of the gem999 platform after an amended Privacy Policy takes effect constitutes your acknowledgement of the updated policy. If you do not agree with a material change, you should stop using the platform and contact support to request account closure before the change takes effect. Any Personal Data collected prior to the change will continue to be handled under the policy version in effect at the time of collection, to the extent legally possible.

Contact & Complaints

For any question, concern, or formal complaint relating to gem999's privacy practices or the handling of your Personal Data, please contact the gem999 Data Protection team through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week on the gem999 platform. Fastest response channel — average first response under 90 seconds.
• Email: [email protected] — formal data rights requests and written complaints will be acknowledged within 5 business days and resolved within 30 calendar days.
• WhatsApp: +62 811 9999 888 — available 24/7. Native Indonesian-speaking agents are available on every shift.

gem999 aims to resolve all privacy-related concerns promptly and to your satisfaction. If you are not satisfied with gem999's response to a formal complaint, you may escalate the matter to the data protection authority in your jurisdiction or to the relevant regulatory body overseeing gem999's international licence.

gem999 does not provide a postal address for routine support enquiries. For formal legal correspondence from authorised legal representatives, a registered correspondence address is available upon written request via the email address above, subject to verification of the requester's identity and authority.