gempak9 Privacy Policy

This Privacy Policy applies to all personal data processed by gempak9 in connection with the operation of gempak9.co and all associated services ("Platform"). It governs data collected when you register an account, make deposits or withdrawals, play games, contact customer support, participate in promotions, or otherwise interact with any gempak9 service.

gempak9 acts as the data controller in respect of personal data collected through the Platform. By registering an account or using the Platform, you acknowledge that you have read and understood this Policy. Where consent is the legal basis for a particular processing activity, your continued use constitutes consent for that processing.

This Policy should be read in conjunction with the gempak9 Terms & Conditions, which govern the broader contractual relationship between gempak9 and registered players.

gempak9 collects personal data through direct submission by you (e.g., during registration or KYC verification), through your use of the Platform (e.g., browsing behaviour, game history), and through third-party sources where permitted (e.g., identity verification providers, payment processors).

2.1 Registration & Account Data

• Full name as it appears on official identification documents
• Date of birth (for age verification purposes)
• Residential address, including city, state, and postcode
• Email address
• Mobile phone number
• Username and encrypted account password
• Preferred language and communication preferences

2.2 Identity Verification (KYC) Data

• Copies of government-issued identification (Malaysian IC, Passport)
• Proof of address documentation (utility bill, bank statement)
• Proof of payment method ownership
• Selfie or liveness verification image, where required

2.3 Financial Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references
• Account balance history
• Bonus and promotional credit records

2.4 Gaming Activity Data

• Game session records, including games played, bets placed, outcomes, and session durations
• Sportsbook wagering history
• Responsible gaming tool settings and activation history

2.5 Technical & Device Data

• IP address and geolocation data at login and during active sessions
• Device type, operating system, and browser type
• Session identifiers and authentication tokens
• Cookies and similar tracking technologies (see Section 8)

2.6 Customer Support Communications

• Records of live chat, WhatsApp, and email interactions with gempak9 support staff
• Support tickets and case records

gempak9 uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and administering your gempak9 account, including processing deposits, withdrawals, and bonus credits.
• Identity verification and KYC compliance: Verifying your identity and age in accordance with our regulatory obligations. All gempak9 services are restricted to individuals aged 21 and above.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, and other unlawful conduct. This includes monitoring account activity for patterns consistent with policy violations.
• Regulatory compliance: Meeting our obligations under applicable gaming licensing requirements, including transaction reporting, record-keeping, and responding to regulatory enquiries.
• Responsible gaming: Monitoring gaming behaviour to identify indicators of problem gambling; administering deposit limits, self-exclusion, and other responsible gaming tools.
• Customer support: Responding to queries, resolving account issues, and managing support interactions.
• Service improvement: Analysing aggregated and anonymised usage data to improve Platform performance, game selection, and user experience. Individual player data is not used for this purpose in a non-anonymised form without explicit consent.
• Promotional communications: Sending you information about promotions, new games, and platform updates where you have opted in to marketing communications. You may withdraw consent at any time by contacting gempak9 support.

gempak9 processes personal data on the following legal bases:

• Contract performance: Processing necessary to provide the services you have contracted for under the gempak9 Terms & Conditions, including account management and financial transactions.
• Legal obligation: Processing required to comply with our obligations under applicable gaming licensing regulations, anti-money laundering laws, and other applicable legislation.
• Legitimate interests: Processing necessary for gempak9's legitimate business interests, including fraud prevention, security monitoring, and service improvement, where these interests are not overridden by your privacy rights.
• Consent: Processing activities based on your explicit consent, including marketing communications and certain optional data uses. You may withdraw consent at any time without affecting the lawfulness of prior processing.

gempak9 does not sell your personal data to any third party under any circumstances. Personal data is shared with third parties only in the following limited circumstances:

• Payment processors and financial institutions: Your financial data is shared with payment providers (including FPX, Touch 'n Go eWallet, Boost, Maybank, CIMB, and Public Bank) to the extent necessary to process your deposits and withdrawals.
• Identity verification providers: KYC documentation is processed by accredited third-party identity verification services operating under contractual data processing agreements with gempak9.
• Game providers: Gameplay data is shared with game providers (e.g., Pragmatic Play, Evolution Gaming, Habanero) to the extent necessary for game functionality, dispute resolution, and fair gaming audits.
• Regulatory and law enforcement authorities: gempak9 may disclose personal data to regulatory bodies, licensing authorities, law enforcement agencies, or other governmental authorities where required to do so by law or court order, or where disclosure is necessary to protect gempak9's legal rights.
• Professional advisers: Personal data may be disclosed to gempak9's legal advisers, auditors, or other professional service providers where strictly necessary for the provision of those services, subject to confidentiality obligations.

All third parties with whom gempak9 shares personal data are required to process that data in accordance with applicable data protection standards and to implement appropriate security measures.

gempak9 retains personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable law and regulatory obligations.

• Active account data: Retained for the duration of your account relationship with gempak9 and for a period thereafter as required by our gaming licence and applicable AML regulations.
• KYC documentation: Retained for a minimum of five (5) years from the date of collection, or longer where required by applicable regulations.
• Transaction records: Retained for a minimum of five (5) years from the transaction date in accordance with financial record-keeping requirements.
• Gaming activity records: Retained for a minimum of three (3) years following account closure or last activity, whichever is later.
• Customer support communications: Retained for two (2) years following case closure.
• Marketing consent records: Retained for the duration of your account and for one (1) year following account closure as evidence of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised in accordance with gempak9's data deletion procedures.

gempak9 implements a multi-layered technical and organisational security programme to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and gempak9 servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive personal data and financial records stored by gempak9 are encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data systems is restricted on a least-privilege basis. Employee access is role-based, audited, and subject to background screening.
• Network security: gempak9's infrastructure is protected by enterprise-grade firewalls, intrusion detection systems, and regular penetration testing.
• Incident response: gempak9 maintains a documented data breach response plan. In the event of a security incident affecting your personal data, gempak9 will notify affected individuals and relevant authorities in accordance with applicable notification requirements.

You are responsible for maintaining the security of your account credentials. gempak9 will never ask for your password via email, WhatsApp, or any other communication channel. Any such request should be treated as fraudulent and reported to gempak9 support immediately.

gempak9 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that help us operate the Platform correctly and improve your experience.

Types of cookies used by gempak9:

• Essential cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without disrupting Platform functionality.
• Functional cookies: Remember your preferences (e.g., language settings, responsible gaming tool configurations) to provide a more personalised experience.
• Analytics cookies: Collect aggregated, anonymised data about how users interact with the Platform to help gempak9 improve navigation and performance. Individual user activity is not identifiable from analytics data.
• Security cookies: Used for fraud detection, bot identification, and session integrity monitoring.

You may control non-essential cookies through your browser settings. Note that disabling functional cookies may affect your Platform experience. Essential and security cookies cannot be disabled without impairing Platform functionality.

Subject to applicable law, you have the following rights in respect of the personal data gempak9 holds about you:

• Right of access: You may request a copy of the personal data gempak9 holds about you. We will provide this within 30 days of a verified request.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Account-level corrections (e.g., address, phone number) may be made directly through account settings.
• Right to erasure: You may request deletion of your personal data where it is no longer required for the purposes for which it was collected, subject to our regulatory retention obligations. Data subject to legal retention requirements cannot be deleted until the retention period expires.
• Right to restriction: You may request that gempak9 restrict processing of your data while accuracy is disputed or pending objection resolution.
• Right to data portability: Where technically feasible and legally applicable, you may request your personal data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes. Marketing opt-out is effective immediately upon request.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact gempak9's data protection contact at [email protected] with the subject line "Data Rights Request". We will respond within 30 days and may require identity verification before processing the request.

gempak9 strictly prohibits use of its Platform by individuals under the age of 21. gempak9 does not knowingly collect personal data from individuals under the age of 21. If gempak9 becomes aware that personal data has been collected from an underage individual, that data will be deleted immediately, the account will be closed, and any deposited funds will be returned to the originating payment method.

If you have reason to believe that an individual under 21 has registered a gempak9 account, please contact us immediately at [email protected]. We take underage gambling seriously and will act promptly on all credible reports.

gempak9 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, Platform features, or applicable law. Where changes are material, gempak9 will notify registered players via email or via prominent in-Platform notification prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this Policy. You are encouraged to review this Policy periodically. Continued use of the Platform following the effective date of any revision constitutes acknowledgement of the updated Policy.

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact gempak9 through the following channels:

• Data rights requests: [email protected] — subject line "Data Rights Request"
• General privacy enquiries: [email protected]
• Live chat: Available 24/7 on gempak9.co for urgent account and privacy matters
• WhatsApp support: Available 24/7 — contact details provided upon account registration

For matters relating to the general terms of your account, please refer to the gempak9 Terms & Conditions. For information on responsible gaming tools and player protection, please visit our Responsible Gaming page.