Privacy Policy Gempak99 – Malaysian Player Personal Data Protection

Gempak99 collects various types of data depending on how you interact with our platform. We only collect data that is genuinely necessary to deliver the best service to you — no excessive collection of data that is irrelevant to the platform's functions.

Data is collected through three main channels: first, information you provide directly during registration and the KYC process; second, data generated automatically as you use the platform; and third, information from legitimate third parties such as payment providers (Touch 'n Go, GrabPay, DuitNow, Maybank2u, CIMB Clicks) that verify your transaction status.

Gempak99 uses the data collected for legitimate and necessary purposes to keep the platform running smoothly and deliver the best experience to every player. The following are the primary purposes for which your data is used:

• Account management and identity verification — keeps your account secure, verifies your identity during the KYC process, and prevents unauthorised access to your account.
• Financial transaction processing — processing deposits via Touch 'n Go, GrabPay, Boost, ShopeePay, DuitNow or FPX, and processing withdrawal of winnings to your Malaysian bank account or e-wallet.
• Gaming services provision — provides access to all games on the gempak99 platform and stores your game history, personal statistics, and preference settings.
• Customer Support — resolving complaints, responding to enquiries via live chat, email, or WhatsApp, and maintaining communication records for reference.
• Fraud prevention and security — detecting suspicious activity, preventing money laundering (AML), and maintaining the integrity of the Gempak99 platform for all players.
• Legal compliance — fulfils reporting obligations required under Malaysian law, including applicable PDPA and AMLA requirements.
• Platform improvements — analysing aggregated usage patterns to improve the performance, usability, and content of the Gempak99 platform.
• Marketing communications — sending you information about relevant Gempak99 promotions, bonuses and events — only if you have given your consent to receive such communications.

Gempak99 will not use your data for any purpose not listed above without first obtaining your additional consent. If you wish to withdraw consent for any specific purpose — such as marketing communications — you may do so at any time through your account settings or by contacting our team.

Gempak99 understands that many Malaysian players are concerned about who can access their data. Here is a full and honest explanation of the circumstances under which your data may be shared with third parties:

• Authorised payment providers — the transaction information required is shared with payment gateway providers such as Touch 'n Go, GrabPay, DuitNow, and the FPX system to process your deposits and withdrawals. This sharing is kept to a minimum and limited strictly to the information needed to complete the transaction.
• Certified game providers — game providers such as Pragmatic Play, Evolution Gaming, and others may receive data necessary to deliver games to you, subject to strict confidentiality agreements with gempak99.
• Technical services — Cloud service and technical infrastructure providers used by Gempak99 may have access to data in their technical capacity, subject to data processing agreements that comply with the PDPA.
• Legal requirement — Gempak99 will disclose data when required to do so by a valid court order, directive from a Malaysian enforcement agency, or mandatory reporting obligations under AMLA.
• Protection of Gempak99's interests — In confirmed cases of fraud, collusion, or criminal activity, relevant data may be shared with the appropriate legal authorities.

All third parties working with Gempak99 are bound by strict confidentiality and data protection agreements. They are only permitted to use your data for the purposes specified in their agreement with Gempak99 and may not use it for any purposes of their own.

Gempak99 invests seriously in data security infrastructure. We take a multi-layered approach to ensuring your data is protected from both internal and external threats at all times.

• Data encryption in transit — all communications between your device and gempak99 servers are secured with TLS 1.3 and 256-bit SSL encryption, ensuring no third party can intercept data in transit.
• Data encryption at rest — sensitive data such as passwords are stored in an irreversible hashed format. Financial data is stored in encrypted form with separately managed keys.
• Role-based access control — Gempak99 staff may only access data relevant to their specific job responsibilities. All access to player data is automatically logged and monitored.
• Continuous threat monitoring — the gempak99 system is monitored 24/7 by an information security team to detect any intrusion attempts or suspicious anomalous activity.
• Regular penetration testing — Gempak99 conducts regular penetration testing through independent cybersecurity firms to identify and patch vulnerabilities before they can be exploited.
• Two-factor authentication — Gempak99 supports and encourages the use of two-factor authentication (2FA) on your account for an added layer of protection.

While we take all reasonable steps to protect your data, no security system can guarantee absolute 100% protection under all circumstances. We encourage you to take personal precautions as well — such as using a strong, unique password for your Gempak99 account, never sharing your login credentials with anyone, and keeping your devices up to date.

Gempak99 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit a website. The following are the types of cookies we use:

You can manage cookie settings through your web browser. However, disabling essential cookies may affect the functionality of certain Gempak99 platform features — such as login and game session functions. Analytics and preference cookies can be disabled without affecting the platform's core functionality.

Under Malaysia's Personal Data Protection Act 2010 and international data protection best practices, you have the following rights regarding your personal data at Gempak99:

• Right of Access — you have the right to request and receive a copy of the personal data Gempak99 holds about you in a readable format.
• Right to Rectification — if the data we hold about you is inaccurate or out of date, you have the right to request prompt correction.
• Right to Erasure — under certain circumstances, you may request that Gempak99 delete your personal data. Such requests are subject to applicable legal retention requirements.
• Right to Restrict Processing — you may request that Gempak99 restrict how your data is processed in certain situations, such as during a dispute about data accuracy.
• Right to Data Portability — you have the right to request your data in a structured format that can be transferred to another platform.
• Right to Withdraw Consent — you may withdraw consent for specific purposes (such as marketing communications) at any time without affecting your overall use of the platform.
• Right to Lodge a Complaint — if you believe Gempak99 has violated your privacy rights, you have the right to lodge a complaint with the relevant Malaysian data protection authority.

To exercise any of these rights, submit a written request to support@gempak99.express with the email subject line "Data Privacy Request". Please include your full name and Gempak99 account number to help us process your request more quickly. Gempak99 will respond within 14 working days from the date of receipt of the completed request.

Gempak99 retains your personal data for as long as your account remains active and for a reasonable period thereafter, depending on the type of data and applicable legal requirements.

• Active account data — retained for as long as your account remains active on the Gempak99 platform. This data is required to allow you to log in, play and carry out financial transactions.
• Financial transaction data — retained for 7 years from the transaction date, in accordance with Malaysian legal requirements relating to financial records and AMLA. This includes deposit records via Touch 'n Go, GrabPay, DuitNow, FPX and withdrawals to Malaysian bank accounts.
• KYC and identity verification data — retained for 5 years from the date of verification or account closure, whichever is later, in accordance with compliance requirements.
• Support communication records — retained for 2 years for reference and dispute resolution purposes.
• Cookie and analytics data — automatically deleted according to the set retention period (see the cookie table above).

Once the retention period expires, or when an account is closed and there is no legal requirement to retain the data further, Gempak99 will securely delete or anonymise your data using methods that render it unrecoverable.

Gempak99 has a Data Protection Officer responsible for ensuring compliance with this Privacy Policy and handling all privacy-related enquiries from our Malaysian players.

You can reach the Gempak99 privacy team through any of the following channels:

• Email: support@gempak99.express — use the subject line "Privacy Enquiry" or "Data Request"
• Live Chat: Available 24/7 within the gempak99 platform — select the "Privacy & Data" category when starting a chat session
• Response time: General enquiries are responded to within 2 business days; formal data rights requests within 14 business days

If you are not satisfied with gempak99's response to your privacy complaint, you have the right to refer the matter to the Department of Personal Data Protection Malaysia (JPDP) under the Ministry of Communications and Digital.

Gempak99 reserves the right to update this Privacy Policy from time to time to reflect changes in practices, technology, or legislation. Any material changes will be communicated to you by email at least 7 days before taking effect. The latest version is always available on this page.