Privacy Policy

This Privacy Policy ("Policy") is published by Gempa99 ("the Operator", "we", "us", "our") and applies to all personal data collected, processed, or stored in connection with the operation of the website gempa99.cam and all associated services, including account management, deposits, withdrawals, betting, gaming, and customer support ("the Platform" or "the Service").

Gempa99 is committed to protecting the privacy of all individuals who interact with the Platform, including registered players ("Players"), prospective players, and visitors who browse the website without creating an account ("Visitors"). This Policy sets out, in plain and formal terms, what personal data we collect, why we collect it, how we use it, with whom we may share it, and what rights you have in respect of your data.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which are incorporated into the overall agreement between you and Gempa99. By using the Platform, you acknowledge that you have read and understood this Policy.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person — a person who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or factors specific to their physical, economic, or online identity.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, restriction, erasure, or destruction.
• "Data Controller" means Gempa99, as the entity that determines the purposes and means of processing Personal Data on the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of Gempa99 under a contractual arrangement and in accordance with our instructions.
• "KYC Data" means identity verification documents submitted by Players, including government-issued identification, proof of address, and related verification materials.
• "Cookie" means a small text file placed on a user's device by a website for the purposes of session management, personalisation, analytics, or advertising.
• "Consent" means any freely given, specific, informed, and unambiguous indication of a data subject's wishes by which they agree to the processing of their Personal Data.

The categories of personal data that Gempa99 may collect about you are described in the table below. The specific data collected will depend on the nature of your interaction with the Platform.

Gempa99 collects personal data through the following primary channels:

• Direct submission: Data you actively provide when registering for an account, completing KYC verification, making deposits or withdrawals, contacting our support team, or updating your account profile.
• Automated technical collection: Data collected automatically as you use the Platform, including through cookies, web beacons, server log files, and similar technologies that record your IP address, device identifiers, and browsing behaviour on our Platform.
• Payment providers: Transaction confirmation data received from payment processors including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency processing partners.
• Identity verification services: Results of identity checks carried out by our KYC partners where we engage third-party services to verify the authenticity of documents submitted by Players.
• Fraud prevention and AML services: Risk-scoring data provided by third-party fraud detection and anti-money laundering compliance services that we are legally obligated to use.

Gempa99 processes personal data for the following specific and legitimate purposes:

• Account administration: To create, maintain, and manage your Player account, including authentication, password management, and account security.
• Contract performance: To deliver the services you have requested, including processing deposits, executing bets, paying out winnings, and providing customer support.
• Identity verification (KYC): To verify your identity and age in accordance with our legal obligations, and to ensure that the Platform is not accessed by persons under 21 years of age or by persons in prohibited jurisdictions.
• Payment processing: To process financial transactions and to record transaction histories for accounting and regulatory compliance purposes.
• Anti-money laundering (AML) and fraud prevention: To detect, investigate, and prevent fraudulent activity, money laundering, and other financial crimes in accordance with applicable law.
• Responsible gambling compliance: To monitor gambling behaviour, apply deposit and loss limits set by Players, process self-exclusion requests, and to identify patterns that may indicate problem gambling in accordance with our Responsible Gambling obligations.
• Service improvement: To analyse aggregated usage data to improve the functionality, performance, and user experience of the Platform.
• Marketing communications: Where you have provided consent, to send promotional offers, bonus notifications, and platform updates by email or in-platform notification. You may withdraw consent at any time through your account settings.
• Legal compliance: To comply with applicable laws, court orders, regulatory requirements, and requests from competent authorities.

Gempa99 processes your personal data on one or more of the following legal bases, depending on the purpose of the processing:

• Contractual necessity: Processing that is required to perform the contract between you and Gempa99 — primarily the operation of your player account, payment processing, and service delivery.
• Legal obligation: Processing that is necessary for Gempa99 to comply with its legal obligations, including KYC, AML, fraud prevention, and regulatory reporting requirements.
• Legitimate interests: Processing carried out to pursue the legitimate business interests of Gempa99, provided those interests are not overridden by your rights and freedoms — including fraud detection, platform security, and service analytics.
• Consent: Processing based on your freely given, specific, and informed consent — principally in relation to direct marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Gempa99 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may, however, share your personal data with the following categories of recipients where necessary and in accordance with this Policy:

• Payment service providers: Including DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency processing partners — solely to the extent required to process your transactions.
• Identity verification and KYC providers: Third-party services engaged to verify the authenticity of identity documents submitted during account registration or at our request.
• Fraud prevention and AML compliance services: Specialist providers that assist with transaction monitoring, risk-scoring, and regulatory compliance obligations.
• Technology and hosting providers: Cloud hosting, cybersecurity, and IT infrastructure providers that process data on our behalf under strict data processing agreements and confidentiality obligations.
• Regulatory and law enforcement authorities: Where Gempa99 is required by applicable law, court order, or regulatory direction to disclose personal data to a competent authority. We will, where legally permissible, endeavour to notify you of such a disclosure.
• Group companies and successors: In the event of a corporate restructuring, merger, acquisition, or sale of assets, personal data may be transferred to a successor entity, subject to equivalent privacy protections.

Gempa99 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Strictly necessary cookies: Required for the Platform to function correctly. These include session management cookies that keep you logged in, security tokens, and fraud-prevention identifiers. These cookies cannot be disabled without affecting Platform functionality.
• Performance and analytics cookies: Used to collect anonymised information about how visitors use the Platform, including which pages are visited most frequently, error messages encountered, and session durations. This data is used solely to improve the Platform.
• Functionality cookies: Used to remember your preferences, such as language settings, bet display preferences, and session timeout configurations.
• Marketing cookies: Where you have provided consent, these cookies may be used to deliver promotional content relevant to your interests. You may withdraw consent at any time by adjusting your cookie preferences or browser settings.

You may manage or disable non-essential cookies through your browser settings at any time. Note that disabling certain cookies may affect your experience of the Platform. For further information on cookie management, consult the help documentation provided by your browser.

Gempa99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active account data: Retained for the duration of your account with Gempa99 and for a period of five (5) years following account closure, in accordance with standard financial record-keeping obligations.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of account closure, as required by applicable anti-money laundering legislation.
• Transaction records: Retained for a minimum of seven (7) years from the date of each transaction, in accordance with applicable financial regulation.
• Support communications: Retained for three (3) years from the date of the last interaction, to enable us to investigate subsequent complaints and to fulfil our quality assurance obligations.
• Marketing preferences and consent records: Retained for as long as your account is active and for a period of two (2) years following withdrawal of consent, to maintain evidence of consent and opt-out records.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents re-identification.

Gempa99 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption-at-rest for sensitive data stored in our databases, including password hashes and financial identifiers.
• Two-factor authentication (2FA) availability for all Player accounts.
• Role-based access controls limiting access to personal data to authorised personnel on a need-to-know basis.
• Regular vulnerability assessments and penetration testing of the Platform's infrastructure.
• Documented incident response procedures to ensure timely detection and containment of any security breach.

While Gempa99 takes all reasonable steps to protect your data, no method of electronic transmission or storage is entirely infallible. You are encouraged to use a strong, unique password for your account and to enable two-factor authentication to reduce the risk of unauthorised access.

Subject to applicable data protection law, you may exercise the following rights in respect of your personal data held by Gempa99. To exercise any of these rights, contact our support team using the details in Section 15.

Gempa99 will respond to all rights requests within the timeframes required by applicable law. We may request proof of identity before processing certain requests to protect your data from unauthorised access.

The Gempa99 Platform is strictly intended for individuals who are at least twenty-one (21) years of age. We do not knowingly collect, process, or retain personal data relating to persons under the age of 21.

If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account. We apply age verification controls during registration and at the KYC stage to minimise the risk of underage access to the Platform.

If you are a parent or guardian and believe that a person under your care has created an account on Gempa99, please contact our support team immediately so that we can investigate and take appropriate action.

In the course of operating the Platform and providing services to Malaysian players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across the country, Gempa99 may process and store personal data on servers located outside Malaysia, including in jurisdictions that may not offer the same level of data protection as Malaysia.

Where personal data is transferred to a third country or international territory, Gempa99 takes appropriate safeguards to ensure that such transfers are lawful and that your data continues to benefit from an adequate level of protection. Such safeguards may include the use of standard contractual clauses, adequacy decisions, or equivalent contractual protections as recognised under applicable data protection law.

By using the Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Malaysia as described in this Policy.

Gempa99 reserves the right to update or revise this Privacy Policy at any time in response to changes in applicable law, our data processing activities, or our business operations. Where material changes are made to this Policy, we will provide reasonable notice to registered Players via a notice published on the Platform or by email to your registered address, prior to the changes taking effect.

The date of the most recent revision of this Policy is shown at the top of this page. We recommend reviewing this page periodically to stay informed of how we handle your personal data. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms, subject to any rights you may have to object under applicable law.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how your personal data has been handled, please contact our support team using the details set out below. Our team is available twenty-four hours a day, seven days a week.

Data rights requests will be acknowledged promptly and resolved within the timeframe required by applicable data protection law. Please include your registered email address and account username in any data rights request to enable us to verify your identity and process your request efficiently. For questions about responsible gambling tools and self-exclusion, please visit our Responsible Gambling page.