🔐 368gem Privacy Policy

1. Who We Are

This Privacy Policy applies to 368gem, the online casino and sportsbook platform operated at https://368gem.app under international gaming authority licensing ("368gem", "we", "us", "our"). 368gem is the data controller responsible for personal data collected from players and website visitors in connection with the use of the Platform.

This Policy describes what personal data 368gem collects, why we collect it, how we use and protect it, and the rights you have in relation to your personal data. It should be read in conjunction with the Terms & Conditions, which govern your use of the 368gem Platform overall.

By registering an account with 368gem or by continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read, understood, and accepted the data practices described herein.

2. Data We Collect

2.1 Registration & Account Data

When you register a 368gem account, we collect:

• Full legal name;
• Date of birth (to verify minimum age requirement of 21 years);
• Email address;
• Mobile phone number;
• Preferred username and encrypted password;
• Country and state/city of residence.

2.2 Identity Verification (KYC) Data

To comply with licensing obligations and to prevent fraud, we collect and verify:

• Government-issued photo identification (e.g., Malaysian MyKad, passport);
• Proof of address documentation where required;
• Proof of payment method ownership (e.g., eWallet account screenshot, bank statement).

2.3 Financial Transaction Data

For all deposit and withdrawal transactions, we record:

• Payment method type (e.g., Touch n Go eWallet, Boost, Maybank, CIMB, Public Bank, Visa/Mastercard);
• Transaction amounts in Malaysian Ringgit (MYR);
• Transaction timestamps and reference numbers;
• Partial payment identifiers as provided by payment processors (we do not store full card numbers or eWallet PINs).

2.4 Gaming Activity Data

We maintain records of your gaming activity on the Platform, including game sessions, bet amounts, game outcomes, and bonus usage. This data is required for account integrity, dispute resolution, and regulatory compliance.

2.5 Technical & Device Data

When you access the 368gem Platform, we automatically collect technical data including your IP address, device type and operating system, browser type and version, referring URL, session duration, and pages visited. This data is used for security monitoring, fraud prevention, and platform optimisation.

2.6 Communications Data

If you contact our support team, we retain records of that correspondence, including chat logs, email threads, and any information you provide during the support interaction, for quality assurance and dispute resolution purposes.

3. How We Collect Your Data

368gem collects personal data through the following channels:

• Directly from you — via account registration forms, KYC document uploads, support communications, and promotional participation;
• Automatically — through cookies, server logs, and session tracking when you access the Platform;
• From payment processors — transaction confirmation data provided by approved payment partners when you make deposits or withdrawals;
• From identity verification services — where 368gem uses third-party KYC providers to assist in document verification, those providers supply verification outcomes and flags to us.

4. Purposes & Legal Basis for Processing

368gem processes your personal data for the following purposes, each supported by a corresponding legal basis:

• Account creation and management — necessary for the performance of the contract between you and 368gem;
• Identity verification and age confirmation — necessary to comply with our legal obligations under licensing requirements and to protect against underage access;
• Payment processing and fraud prevention — necessary for the performance of the contract and to comply with anti-money laundering (AML) regulatory obligations;
• Customer support — necessary for the performance of the contract and our legitimate interest in resolving player disputes fairly;
• Platform security and fraud detection — our legitimate interest in protecting the integrity of the 368gem Platform and all player accounts;
• Regulatory compliance and reporting — necessary to comply with our legal obligations under gaming authority licensing;
• Marketing communications — based on your consent, where you have opted in to receive promotional emails or SMS notifications from 368gem. You may withdraw this consent at any time.

5. Data Sharing & Third-Party Disclosure

368gem does not sell, rent, or trade your personal data to third-party marketers. We may share your personal data only in the following limited circumstances:

• Payment processors: We share transaction data with approved payment partners (including Touch n Go eWallet, Boost, and banking institutions) solely to process your deposits and withdrawals. These partners are bound by their own privacy policies and contractual data protection obligations to 368gem.
• KYC and identity verification providers: We share identity document data with contracted KYC service providers for the purpose of verifying your identity. These providers are contractually prohibited from using your data for any other purpose.
• Licensing authority: We may be required to provide player account data, transaction records, and gaming activity logs to our licensing authority as part of regulatory compliance obligations or in response to formal regulatory investigations.
• Law enforcement and legal process: We will disclose personal data to law enforcement agencies or courts where required to do so by applicable law, a valid court order, or formal legal process.
• Platform technology providers: We share limited technical data with our hosting, analytics, and security infrastructure providers, all of whom are bound by data processing agreements limiting their use of your data to providing the contracted service.

6. International Data Transfers

368gem's primary data processing infrastructure is located in secure data centre facilities. Some of our contracted service providers — including KYC verification and payment processing partners — may be located outside Malaysia. Where personal data is transferred internationally, 368gem ensures that such transfers are protected by contractual safeguards, including standard data protection clauses, that require the recipient to maintain data protection standards equivalent to those described in this Policy.

7. Data Retention

368gem retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or licensing obligations. The following general retention periods apply:

• Account data and KYC records: Retained for a minimum of 5 years following permanent account closure, as required under standard gaming authority licensing and AML regulatory requirements;
• Financial transaction records: Retained for a minimum of 5 years following the date of the transaction;
• Gaming activity logs: Retained for a minimum of 3 years following account closure;
• Support communications: Retained for 2 years following the resolution of the relevant support interaction;
• Marketing consent records: Retained for the duration of your active consent and for 2 years following withdrawal of consent, for legal record-keeping purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Security Measures

368gem implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit;
• Encryption of sensitive data fields (including passwords, which are stored as salted cryptographic hashes — we never store your password in plain text) at rest;
• Role-based access controls ensuring that only authorised 368gem personnel can access personal data, and only to the extent necessary for their specific function;
• Regular security assessments and penetration testing of the Platform;
• Two-factor authentication (2FA) requirements for account access and for internal administrative systems;
• Continuous intrusion detection and anomalous access monitoring.

While 368gem takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. In the event of a data breach that poses a material risk to your rights, 368gem will notify affected players and, where required, the relevant regulatory authority, within the timeframes required by applicable law.

9. Cookies & Tracking Technologies

9.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device across pages and sessions. 368gem uses cookies to ensure the Platform functions correctly and to improve your experience.

9.2 Cookies We Use

• Strictly Necessary Cookies: These are essential for the Platform to function. They include session cookies that maintain your logged-in state and security cookies that prevent cross-site request forgery. These cookies cannot be disabled without breaking core Platform functionality.
• Performance & Analytics Cookies: Where you consent, we use analytical cookies to understand aggregate patterns of how players navigate the Platform. This data is used solely to improve the user experience and Platform features. No individual-level data is shared with external analytics services that would identify you personally.

9.3 Managing Cookies

You can control cookie settings through your browser preferences. Disabling strictly necessary cookies will impair your ability to use the 368gem Platform, including your ability to remain logged in. Analytical cookies can be declined without affecting core Platform functionality.

10. Your Rights

Subject to applicable law and our regulatory obligations, you have the following rights in relation to your personal data held by 368gem:

• Right of Access: You may request a copy of the personal data 368gem holds about you.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data where there is no longer a lawful basis for its retention. Note that certain data must be retained for regulatory compliance purposes and cannot be deleted on request.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances, for example while a rectification request is under review.
• Right to Object: You may object to processing of your data where we rely on our legitimate interest as the legal basis, including direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact our support team in writing at [email protected] (plain text — not a clickable link). We will respond within 14 business days of receiving your request.

11. Children & Minors

368gem is strictly prohibited for individuals under 21 years of age. We do not knowingly collect personal data from individuals under 21. If we discover or are notified that personal data has been collected from an underage individual, we will promptly delete that data and close the associated account. Parents or guardians who believe their child has registered an account with 368gem should contact our support team immediately.

12. Changes to This Policy

368gem reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to registered account holders by email to their registered address prior to the changes taking effect. The "Last updated" date at the top of this Policy indicates when the most recent revision was made. Continued use of the 368gem Platform after notification of changes constitutes acceptance of the updated Policy. We encourage you to review this Policy periodically to stay informed of how 368gem protects your data.

13. Contact & Data Requests

For all privacy-related enquiries, data subject access requests, or complaints regarding 368gem's handling of your personal data, please contact us via:

• Email: [email protected] (plain text — not a clickable link)
• Live Chat: Available 24/7 through the 368gem Platform — mark your message as "Privacy Request" for expedited routing to our data team

368gem is committed to resolving all privacy concerns promptly and transparently. If you are unsatisfied with our response to a data-related complaint, you may escalate the matter to the relevant licensing authority or applicable data protection regulator in your jurisdiction.