Privacy Policy — Gempak99

This Privacy Policy ("Policy") is issued by Gempak99 ("Platform", "we", "us", "our") and applies to all personal data collected through the website located at https://gempak99.casa, including all associated pages, services, applications, and features (collectively, the "Services").

Gempak99 is committed to protecting the privacy and security of every individual who interacts with our platform. We recognise that our players — whether located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or anywhere else in Malaysia — entrust us with sensitive personal and financial information, and we take that responsibility with the utmost seriousness.

This Policy is designed to provide full transparency about our data practices. We encourage you to read it carefully. By accessing the Gempak99 platform or creating an account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — i.e., a living individual who can be identified, directly or indirectly, by reference to that information.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or erasure.
• "Data Subject" means the individual to whom the personal data relates — in the context of Gempak99, this is the registered player or website visitor.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, Gempak99.
• "Third Party" means any natural or legal person other than the Data Subject, Gempak99, or its authorised data processors acting under its direct authority.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they signify agreement to the processing of their personal data.
• "KYC" means Know Your Customer — the identity and anti-money laundering verification process required before withdrawals can be processed.

Gempak99 acts as the Data Controller for all personal data collected through the platform at https://gempak99.casa. As Data Controller, Gempak99 is responsible for determining the purposes for which your personal data is collected and the manner in which it is processed.

For all privacy-related enquiries, data access requests, or complaints, you may contact Gempak99 directly using the details provided in Section 15 (Contact Us) of this Policy. We are committed to responding to all verified data subject requests within 30 calendar days of receipt.

Gempak99 collects the following categories of personal data from players and website visitors. The precise data points collected in each category will depend on your level of engagement with the platform:

Gempak99 collects personal data through the following methods:

5.1 Direct Collection

Information you provide directly when registering an account, completing identity verification (KYC), making a deposit or withdrawal, contacting our support team, participating in promotions, or completing any form on the platform.

5.2 Automated Collection

Technical and usage data collected automatically when you access the Gempak99 platform, including through cookies, pixel tags, server logs, and similar tracking technologies. This includes your IP address, device information, browser details, and behavioural data generated during your session.

5.3 Third-Party Sources

In certain circumstances, Gempak99 may receive personal data about you from third parties, including:

• Payment service providers (e.g., DuitNow, FPX operators, Touch 'n Go, GrabPay) in connection with transaction processing;
• Identity verification service providers used for KYC compliance;
• Fraud detection and anti-money laundering (AML) screening services;
• Analytics providers that supply aggregated or anonymised behavioural insights.

Gempak99 processes your personal data only for specific, legitimate purposes. The primary purposes for which we use your data are as follows:

• Account Management: To create, maintain, and administer your Gempak99 player account, including verifying your identity and managing account security.
• Transaction Processing: To facilitate deposits and withdrawals via Malaysian payment channels including DuitNow, FPX, Maybank, CIMB, Public Bank, Touch 'n Go eWallet, GrabPay, and Boost.
• KYC & Regulatory Compliance: To fulfil our legal obligations regarding identity verification, anti-money laundering (AML) checks, and responsible gambling compliance.
• Platform Operation & Improvement: To operate, maintain, monitor, and improve the Gempak99 platform, including diagnosing technical issues and enhancing user experience.
• Customer Support: To respond to your enquiries, complaints, and requests through live chat, email, and other support channels.
• Responsible Gambling: To monitor gameplay patterns and intervene where there are indicators of problem gambling behaviour, including applying self-imposed limits.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity money laundering, collusion, and other forms of abuse on the platform.
• Marketing Communications: To send you promotional offers, bonuses, and platform updates where you have provided explicit consent. You may opt out of marketing communications at any time.
• Legal Obligations: To comply with applicable laws, regulations, court orders, or requests from competent regulatory or law enforcement authorities.

Gempak99 processes your personal data on the basis of one or more of the following lawful grounds, depending on the specific purpose of processing:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions you agreed to when registering your account — including account management, game facilitation, and payment processing.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC, AML obligations, and regulatory reporting.
• Legitimate Interests: Processing carried out to pursue Gempak99's legitimate business interests where these are not overridden by your fundamental rights — including fraud prevention, platform security, and service improvement.
• Consent: Processing based on your freely given, specific consent — most notably for direct marketing communications. Where consent is the legal basis, you retain the right to withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

Gempak99 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may, however, share your data with the following categories of third parties strictly as necessary for legitimate operational and legal purposes:

8.1 Service Providers & Data Processors

Carefully selected third-party service providers who process data on Gempak99's behalf and under our documented instructions, including: payment processors (DuitNow, FPX, Touch 'n Go eWallet, GrabPay, Boost, Maybank, CIMB, Public Bank, Hong Leong), identity verification providers, fraud detection services, cloud hosting providers, and customer support software vendors. All such providers are bound by data processing agreements with Gempak99.

8.2 Regulatory & Law Enforcement Authorities

Gempak99 may disclose personal data to regulatory authorities, law enforcement agencies, or courts of competent jurisdiction where required to do so by law, court order, or regulatory obligation. Such disclosures will only be made to the minimum extent required to satisfy the legal obligation.

8.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Gempak99's business assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

Gempak99 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your active account relationship with Gempak99, plus a minimum of five (5) years following account closure to satisfy anti-money laundering and record-keeping requirements.
• Transaction Records: Retained for a minimum of seven (7) years in accordance with financial record-keeping obligations.
• KYC & Identity Verification Documents: Retained for a minimum of five (5) years following the date of verification or account closure, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the support interaction, subject to any ongoing investigation or dispute.
• Marketing Consent Records: Retained for the duration of your consent plus two (2) years to demonstrate compliance in the event of a complaint.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with an identified individual.

Gempak99 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. Our security framework includes:

• Transport Layer Encryption: All data transmitted between your device and Gempak99 servers is protected by 256-bit SSL/TLS encryption.
• Access Controls: Strict role-based access controls ensure that only authorised personnel with a legitimate business need can access personal data. All access is logged and monitored.
• Two-Factor Authentication (2FA): Available to all players for an additional layer of account protection, and required for all administrative access to internal systems.
• Data Minimisation: We collect only the personal data strictly necessary for the stated purposes and restrict internal access on a need-to-know basis.
• Regular Security Audits: Our platform and infrastructure undergo regular penetration testing and security assessments conducted by independent specialists.
• Incident Response: Gempak99 maintains a documented data breach response procedure. In the event of a data breach that poses a risk to affected individuals, we will notify relevant parties in accordance with applicable regulatory requirements.

Gempak99 uses cookies and similar technologies (including pixel tags and session tokens) to operate the platform and improve your user experience. Cookies are small text files stored on your device when you visit the platform.

11.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the platform to function, including session management, authentication, and security. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: Enable enhanced functionality such as remembering your language preferences, display settings, and session continuity across pages.
• Analytical Cookies: Used to collect anonymised data about how visitors use the platform, helping us identify technical issues and improve the user experience. Data collected is aggregated and does not identify individual users.
• Marketing Cookies: Used only where you have given explicit consent, to provide relevant promotional messaging. These cookies may track your activity across sessions.

11.2 Managing Cookies

You may configure your browser settings to decline or delete cookies at any time. Please note that disabling strictly necessary cookies will impair your ability to use the Gempak99 platform. For details on how to manage cookies in your specific browser, refer to your browser's help documentation.

Subject to applicable law and verification of your identity, you hold the following rights with respect to your personal data held by Gempak99:

• Right of Access: You may request a copy of the personal data Gempak99 holds about you, along with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. Some corrections can be made directly within your account profile.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where processing is no longer necessary, consent has been withdrawn, or data been unlawfully processed. Note that certain data must be retained to satisfy legal obligations and cannot be deleted upon request.
• Right to Restrict Processing: You may request a temporary restriction on the processing of your data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract, you may request that your personal data be provided in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing carried out on the basis of legitimate interests, or to direct marketing at any time, without providing justification.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact the Gempak99 support team using the details provided in Section 15. We will acknowledge all requests within five (5) working days and respond in full within thirty (30) calendar days. We may request proof of identity before processing any request to protect the privacy of our players.

The Gempak99 platform is strictly intended for use by adults aged21 years and above. We do not knowingly collect, process, or store personal data belonging to any person under the age of 21. Registration is not permitted for individuals below this age threshold.

Where Gempak99 discovers or receives credible evidence that an account has been created by or on behalf of a person under the age of 21, the following steps will be taken immediately:

• The account will be suspended pending full investigation.
• All personal data associated with the account will be erased upon confirmation of age non-compliance, subject to any mandatory legal retention obligations.
• Any real-money deposits will be returned to the source of payment following completion of the investigation.
• The matter may be reported to the relevant authorities where legally required.

Gempak99 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable legal requirements, or platform functionality. The updated Policy will be published athttps://gempak99.casa/privacy-policy with a revised "Last Updated" date at the top of the page.

For material changes that significantly affect the way we process your personal data, Gempak99 will provide advance notice via a prominent notification on the platform or by email to your registered address. Your continued use of the platform following the effective date of any revised Policy constitutes your acknowledgement of the updated terms.

For all privacy-related enquiries, data subject access requests, consent withdrawals, or complaints regarding Gempak99's data processing practices, please contact us through one of the following channels: