gem999 Privacy Policy

Section 1

1 Definitions

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information that identifies or can reasonably be used to identify a natural person, directly or indirectly — including name, identification number, location data, online identifiers, or factors specific to the physical, economic, or social identity of that person.
• "Processing" means any operation performed on Personal Data — including collection, recording, storage, structuring, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction — whether or not carried out by automated means.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, gem999.
• "Data Processor" means any third party that processes Personal Data on behalf of gem999 under a written data-processing agreement.
• "Player" / "you" means any individual whose Personal Data is processed by gem999, including registered account holders and website visitors.
• "KYC Data" means identity and age-verification documents submitted by a Player, including copies of Indonesian National ID (KTP), passport, selfie images, and bank account evidence.
• "Cookies" means small text files placed on your device by the gem999 website to store session, preference, and analytics information.

Section 2

2 Data Controller

gem999 acts as the Data Controller for all Personal Data collected through the gem999.cam platform. gem999 operates under an international gaming license and maintains data-processing practices consistent with internationally recognized privacy standards, including the principles of purpose limitation, data minimization, storage limitation, accuracy, integrity, and confidentiality.

All data-protection queries, subject-access requests, and complaints should be directed to gem999's Data Protection Officer (DPO). Contact details are provided in Section 14 of this policy. The DPO is responsible for overseeing gem999's data governance framework, handling player rights requests, and liaising with any applicable regulatory authority on data-protection matters.

Section 3

3 Data We Collect

gem999 collects only the Personal Data that is necessary for the specific purposes described in Section 5. The categories of data we collect are as follows:

gem999 does not collect Sensitive Personal Data (such as racial or ethnic origin, religious beliefs, health data, or political opinions) except where strictly required by law or by the responsible-gaming obligations described in our Responsible Gaming policy — for example, when a player voluntarily discloses a gambling-related health concern to our support team.

Section 4

4 How We Collect Data

gem999 collects Personal Data through the following channels:

• Direct Registration: When you complete the gem999 account registration form, you provide Identity Data and Contact Data directly. This data is submitted over an encrypted HTTPS connection secured by 256-bit SSL.
• KYC Submission: When you submit identity documents to complete the verification process before your first withdrawal, gem999 collects KYC Data including a government-issued photo ID and, where applicable, bank account evidence.
• Financial Transactions: When you make a deposit or request a withdrawal via supported Indonesian payment channels, gem999 receives Financial Data including the payment method identifier and transaction amount in IDR.
• Platform Usage: As you browse and use the gem999 platform, Technical Data and Usage Data are collected automatically through server logs, session tracking, and analytics tools. This data is collected to ensure platform stability, detect fraud, and improve user experience.
• Customer Support: When you contact gem999 via live chat or email, Communications Data is collected and stored as part of your support record.
• Cookies and Similar Technologies: gem999 uses first-party cookies and, where applicable, limited third-party analytics tags to collect Technical Data and Usage Data. Full details are provided in Section 9.
• Third-Party Sources: In limited circumstances, gem999 may receive identity-verification data from licensed KYC service providers or fraud-prevention databases to cross-check information you have provided during registration.

Section 5

5 Purposes & Legal Basis for Processing

gem999 processes Personal Data only where a valid legal basis exists. The purposes for which we process your data, together with the corresponding legal basis, are set out below:

Where processing is based on your consent, you have the right to withdraw that consent at any time by updating your communication preferences in the account settings panel or by contacting gem999 support. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Section 6

6 Data Sharing & Disclosure

gem999 does not sell, rent, or trade your Personal Data to third parties for their own commercial purposes. gem999 may share your data with the following categories of recipients only to the extent necessary for the purposes described in Section 5:

• KYC and Identity Verification Providers: Licensed third-party identity-verification services that assist gem999 in verifying the authenticity of KTP, passport, and other documents submitted during registration or re-verification.
• Payment Processing Partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) that process deposit and withdrawal transactions. These providers receive only the Financial Data necessary to complete the specific transaction.
• Game Content Providers: Licensed game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive a pseudonymous player identifier and session token to facilitate game launches and return RNG or live-dealer outcomes. They do not receive your full identity or financial data.
• Fraud Prevention and AML Services: Third-party fraud-detection and anti-money-laundering compliance platforms that help gem999 identify and prevent fraudulent account activity, bonus abuse, and suspicious transactions.
• IT Infrastructure Providers: Cloud hosting, content-delivery, and cybersecurity service providers that operate the gem999 platform infrastructure under strict data-processing agreements with gem999.
• Legal and Regulatory Authorities: Competent courts, law-enforcement agencies, financial intelligence units, and gaming regulators to whom gem999 is legally required to disclose data — for example, in the context of an AML Suspicious Activity Report or a court order.
• Professional Advisors: Lawyers, auditors, and accountants who are bound by professional-secrecy obligations and who assist gem999 with legal, financial, or compliance matters.

Section 7

7 Data Retention

gem999 retains Personal Data for only as long as is necessary for the purposes for which it was collected, or as required by applicable law and our international gaming license obligations. The following retention periods apply:

• Active Account Data: Retained for the full duration of your account being active on the platform, plus a minimum of five (5) years after account closure, to satisfy AML record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, in compliance with international AML standards.
• Transaction Records: All deposit, withdrawal, and betting transaction records are retained for a minimum of five (5) years from the date of the transaction.
• Support Communications: Live-chat transcripts and support-ticket records are retained for three (3) years from the date of the interaction, unless the communication relates to a formal complaint, in which case it is retained for five (5) years.
• Marketing Consent Records: Records of your opt-in to marketing communications are retained for the period during which you remain opted in, plus three (3) years thereafter as evidence of your consent.
• Technical and Usage Data: Aggregated or anonymized analytics data may be retained indefinitely. Raw server logs containing IP addresses are retained for no longer than 12 months and are then anonymized or deleted.
• Self-Exclusion Records: Records relating to voluntary self-exclusion are retained for the duration of the exclusion period plus five (5) years, to prevent circumvention by re-registration.

Upon expiry of the applicable retention period, gem999 will securely delete or anonymize your Personal Data in accordance with industry-standard data-destruction practices.

Section 8

8 Security Measures

gem999 implements a layered set of technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-Bit SSL Encryption: All data transmitted between your device and gem999's servers is encrypted using industry-standard TLS/SSL protocols. The padlock icon in your browser confirms that your connection is secure at all times.
• Password Hashing: Account passwords are never stored in plain text. gem999 uses a modern one-way cryptographic hashing algorithm with salting to store password credentials securely.
• Access Controls: Access to Personal Data within gem999's internal systems is restricted on a strict need-to-know basis. All staff with access to player data are subject to confidentiality agreements and regular privacy-awareness training.
• Two-Factor Authentication (2FA): gem999 offers optional 2FA for player accounts and enforces 2FA for all internal staff accounts that have access to player data.
• Intrusion Detection and Monitoring: gem999's infrastructure is protected by real-time intrusion-detection systems, automated anomaly alerts, and regular penetration testing conducted by independent security specialists.
• Data Minimization in Logs: System logs are designed to capture the minimum data needed for security monitoring. Full card numbers and bank account numbers are never logged in plain text.
• Incident Response: gem999 maintains a documented data-breach response plan. In the event of a breach affecting your Personal Data, gem999 will notify you and the relevant regulatory authority within the timeframe required by applicable law.

Section 9

9 Cookies & Tracking Technologies

gem999 uses cookies and similar browser-based storage technologies to enable essential platform functionality, maintain your session state, remember your preferences, and collect anonymized analytics data to improve the platform. The types of cookies used are described below:

gem999 does not use third-party advertising or retargeting cookies. You may manage cookie preferences through your browser settings at any time. Disabling strictly necessary cookies will impair or prevent access to the gem999 platform. Disabling functional or analytics cookies will not affect your ability to log in or place bets.

Section 10

10 Your Privacy Rights

Subject to applicable law and gem999's legal obligations — including AML record-keeping requirements that may limit the ability to delete certain data — you have the following rights in respect of your Personal Data:

• Right of Access: You have the right to request a copy of the Personal Data gem999 holds about you. gem999 will provide a Subject Access Response within 30 calendar days of receiving a valid request.
• Right to Rectification: If any Personal Data gem999 holds about you is inaccurate or incomplete, you have the right to request that it be corrected. For KYC-related data, corrections may require re-submission of supporting documentation.
• Right to Erasure: You may request that gem999 delete your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no other legal basis applies. This right is subject to override by gem999's AML and licensing record-keeping obligations.
• Right to Restriction of Processing: You may request that gem999 restrict processing of your data in certain circumstances — for example, while the accuracy of a data point is being contested.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive your Personal Data in a structured, machine-readable format and to request that gem999 transmit it to another data controller.
• Right to Object: You have the right to object to processing based on gem999's legitimate interests. gem999 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (such as direct marketing communications), you may withdraw that consent at any time through your account settings or by contacting support.
• Right to Lodge a Complaint: If you are unsatisfied with how gem999 has handled your Personal Data or responded to your rights request, you have the right to lodge a complaint with the relevant data-protection supervisory authority in your jurisdiction.

To exercise any of the rights above, please contact gem999's Data Protection Officer using the details in Section 14. Include your account username and a description of your request. gem999 may need to verify your identity before processing any rights request.

Section 11

11 Minors

The gem999 platform is strictly for adults aged 21 and above. gem999 does not knowingly collect Personal Data from individuals under the age of 21. Age verification is performed at the point of registration and at the point of first withdrawal as part of the KYC process.

If gem999 discovers that Personal Data has been collected from an individual under 21 years of age — whether through a registration error or through submission of falsified age information — gem999 will immediately close the associated account, delete the data to the extent not required to be retained by applicable law, and return any verifiable deposits where legally required.

If you are a parent or guardian and have reason to believe that your child under 21 has registered an account on gem999, please contact our support team immediately using the details in Section 14. gem999 takes underage access extremely seriously and will act on all reports promptly.

Section 12

12 International Data Transfers

gem999 operates globally and may store or process your Personal Data on servers located outside Indonesia. When Personal Data is transferred to or accessed from a jurisdiction outside Indonesia, gem999 ensures that appropriate safeguards are in place to maintain a level of data protection equivalent to that required under gem999's licensing obligations. These safeguards may include:

• Standard contractual clauses approved by the relevant data-protection authority, incorporated into the agreements between gem999 and its Data Processors.
• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection by gem999's compliance team, based on criteria equivalent to internationally recognized adequacy assessment standards.
• Binding corporate rules where Personal Data is transferred within the gem999 group of companies.

You may request further information about the specific safeguards applied to international transfers of your Personal Data by contacting the DPO at the address in Section 14.

Section 13

13 Policy Amendments

gem999 may update this Privacy Policy from time to time to reflect changes in our data-processing practices, platform features, applicable law, or regulatory guidance. When material changes are made — that is, changes that affect how we process your Personal Data or that alter your rights — gem999 will notify you by email to the address registered on your account no less than 14 calendar days before the revised policy takes effect.

The version number and effective date displayed at the top of this page always reflect the current version in force. We encourage you to review this policy periodically. If you continue to use the gem999 platform after the effective date of a revised policy, your continued use constitutes acceptance of the updated terms. If you object to any changes, you may request the closure of your account before the effective date, and any remaining verified Real Money Balance will be returned to your last verified payment method.

Section 14

14 Contact the Data Protection Officer

For all privacy-related inquiries, subject-access requests, rights-exercise requests, or data-protection complaints, please contact gem999's Data Protection Officer. All contact details are provided as plain text only and are not clickable links.