Privacy Policy

1. Introduction and Scope

This Privacy Policy applies to all users of gem138 services, including visitors to our website, registered account holders, and anyone who interacts with our platform in any capacity. gem138 operates an online gaming platform accessible at gem138.cam, providing casino games, sports betting, and related entertainment services primarily to users in Indonesia.

gem138 acts as the data controller for the personal information we collect through our services. We are responsible for ensuring that your personal data is processed lawfully, fairly, and transparently in accordance with applicable data protection regulations. This Privacy Policy should be read in conjunction with our Terms and Conditions, which govern your use of gem138 services. Where there is any inconsistency between this Privacy Policy and the Terms and Conditions regarding data handling, this Privacy Policy shall prevail.

If you have questions or concerns about how gem138 handles your personal information, or if you wish to exercise any of your privacy rights, please contact our Data Protection Officer using the contact details provided at the end of this document.

2. Information We Collect

2.1 Information You Provide Directly

When you register for a gem138 account, we collect the following personal information that you provide during the registration process:

• Identity Information: Full legal name, date of birth, gender, and nationality as shown on your government-issued identification documents
• Contact Information: Email address, phone number (mobile or landline), and residential address including street, city, postal code, and province
• Account Credentials: Username, password (stored in encrypted form), and security questions/answers for account recovery purposes
• Financial Information: Bank account details (account number, bank name, account holder name) for deposits and withdrawals, e-wallet information (OVO, DANA, GoPay account identifiers), and transaction history
• Verification Documents: Copies of identification documents such as Indonesian KTP (Kartu Tanda Penduduk), SIM (Surat Izin Mengemudi), passport, utility bills, bank statements, or other documents required for identity verification and anti-money laundering compliance
• Communication Content: Content of messages, emails, live chat conversations, and phone calls with our customer support team (recorded for quality assurance and dispute resolution purposes)

2.2 Information Collected Automatically

When you access and use gem138 services, we automatically collect certain technical and usage information through various technologies including cookies, web beacons, and server logs:

• Device Information: Device type (desktop, mobile, tablet), operating system and version, browser type and version, screen resolution, device identifiers (IMEI, advertising ID), and mobile network information
• Connection Information: IP address, internet service provider, geographic location (country, region, city derived from IP address), time zone, and connection type
• Usage Data: Pages viewed, games played, bets placed, timestamps of activities, navigation paths, referral sources, search terms used on our site, and interaction with promotional content
• Behavioral Data: Betting patterns, gameplay preferences, session duration, frequency of visits, deposit and withdrawal patterns, and engagement with different game categories
• Performance Data: Platform performance metrics, error logs, crash reports, and loading times to help us improve service quality

2.3 Information From Third Parties

In certain circumstances, gem138 may receive information about you from third-party sources to verify your identity, prevent fraud, or comply with legal obligations:

• Payment Providers: Transaction confirmation, payment method validation, and fraud risk assessment data from BCA, BRI, BNI, Mandiri, and other Indonesian banks and e-wallet services
• Identity Verification Services: Results of identity checks, age verification, address validation, and sanctions screening conducted by specialized third-party verification providers
• Social Media Platforms: If you choose to link your gem138 account to social media accounts (optional feature), we may receive basic profile information in accordance with your social media privacy settings
• Affiliate Partners: Information about how you were referred to gem138, including affiliate ID, marketing campaign tracking codes, and referral sources

3. How We Use Your Information

gem138 uses your personal information for the following purposes, which are necessary for providing our services, complying with legal requirements, and improving your user experience:

3.1 Account Management and Service Delivery

• Creating and maintaining your gem138 account with accurate records
• Processing deposits, withdrawals, and other financial transactions securely
• Enabling you to place bets, play games, and access all features of our platform
• Managing your account balance, transaction history, and betting records
• Processing bonus claims and applying promotional offers to your account
• Providing customer support and responding to your inquiries, complaints, or requests
• Implementing responsible gaming controls such as deposit limits, self-exclusion, and reality checks

3.2 Verification, Security, and Fraud Prevention

• Verifying your identity and age to ensure you meet eligibility requirements (21+ age restriction)
• Preventing underage gambling, identity theft, and fraudulent account creation
• Detecting and preventing money laundering, bonus abuse, collusion, arbitrage betting, and other forms of fraud
• Monitoring for irregular betting patterns, multiple account use, and terms violations
• Conducting security audits and investigating suspicious activities or transactions
• Protecting gem138 systems, infrastructure, and intellectual property from cyber attacks and unauthorized access

3.3 Legal Compliance and Regulatory Requirements

• Complying with Indonesian and international anti-money laundering (AML) and counter-terrorism financing (CTF) regulations
• Maintaining records as required by gaming licenses, financial regulations, and tax authorities
• Responding to lawful requests from law enforcement, regulatory bodies, courts, or government agencies
• Conducting sanctions screening and politically exposed persons (PEP) checks as required by law
• Reporting suspicious transactions to relevant authorities where legally mandated

3.4 Marketing and Communications

• Sending promotional offers, bonus notifications, and information about new games or features (with your consent where required by law)
• Customizing marketing messages based on your preferences, betting history, and engagement patterns
• Conducting market research, surveys, and customer satisfaction studies to improve our services
• Analyzing the effectiveness of marketing campaigns and promotional activities

3.5 Platform Improvement and Analytics

• Analyzing user behavior to understand how players interact with our platform and identify popular features
• Optimizing website performance, loading times, and mobile responsiveness
• Developing new features, games, and services based on user preferences and feedback
• Conducting A/B testing to improve user interface, navigation, and overall experience
• Generating aggregated, anonymized statistics for business intelligence and strategic planning

4. Legal Basis for Processing

gem138 processes your personal data based on the following legal grounds under applicable data protection laws:

• Contractual Necessity: Processing is necessary to perform our contract with you (the Terms and Conditions), including account creation, transaction processing, and service delivery
• Legal Obligation: Processing is required to comply with legal and regulatory obligations including AML/CTF compliance, age verification, tax reporting, and responding to lawful government requests
• Legitimate Interests: Processing is necessary for our legitimate business interests such as fraud prevention, security monitoring, platform improvement, and marketing (where not overridden by your privacy rights)
• Consent: Where required by law, we obtain your explicit consent before processing certain data, particularly for marketing communications and optional data collection activities

5. Information Sharing and Disclosure

gem138 does not sell your personal information to third parties. However, we may share your data with the following categories of recipients for the purposes described in this Privacy Policy:

5.1 Service Providers and Business Partners

• Payment Processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP), e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja), and payment gateway operators who process your deposits and withdrawals
• Identity Verification Providers: Third-party services that conduct KYC (Know Your Customer) checks, age verification, address validation, and sanctions screening
• Technology and Infrastructure Providers: Cloud hosting services, content delivery networks (CDN), cybersecurity firms, and IT support providers who maintain our platform infrastructure
• Game Providers: Licensed game suppliers (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, and others) who provide the casino games and betting platforms integrated into gem138
• Customer Support Tools: Live chat platforms, ticketing systems, and communication tools used to provide customer service
• Marketing and Analytics Services: Email delivery services, SMS providers, analytics platforms, and marketing automation tools used to communicate with you and analyze platform usage

5.2 Legal and Regulatory Authorities

We may disclose your personal information to law enforcement agencies, regulatory bodies, courts, tax authorities, or other government entities when:

• Required by law, court order, subpoena, or other legal process
• Necessary to comply with anti-money laundering, counter-terrorism financing, or tax reporting obligations
• Requested by gaming regulators or licensing authorities as part of compliance audits
• Required to protect gem138's legal rights, property, or safety, or that of our users or the public
• Necessary to detect, prevent, or investigate fraud, security breaches, or criminal activity

5.3 Business Transfers

In the event gem138 undergoes a merger, acquisition, asset sale, bankruptcy, or other business transaction, your personal information may be transferred to the acquiring entity or successor organization. We will notify you via email or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

6. Data Security and Protection

gem138 implements comprehensive technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. Our security practices include:

• Encryption: All data transmitted between your device and our servers is protected using 256-bit SSL/TLS encryption. Sensitive data stored in our databases (passwords, financial information) is encrypted at rest.
• Access Controls: Personal information is accessible only to authorized gem138 employees and contractors who require it to perform their job functions. Access is granted on a need-to-know basis with role-based permissions.
• Secure Infrastructure: Our servers and databases are hosted in secure data centers with physical security controls, environmental monitoring, redundant power supplies, and backup systems.
• Network Security: Firewalls, intrusion detection systems, anti-malware protection, and regular security patching protect our systems from cyber threats.
• Security Audits: We conduct regular internal security assessments and engage third-party security firms to perform penetration testing and vulnerability assessments.
• Employee Training: All gem138 staff receive data protection and security awareness training to ensure they understand their obligations regarding user privacy.
• Incident Response: We maintain an incident response plan to quickly detect, contain, and remediate any security breaches, and to notify affected users as required by law.

Despite these measures, no data transmission over the internet or electronic storage system is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activities conducted through your account.

7. Data Retention

gem138 retains your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary depending on the type of data and applicable legal requirements:

• Account Information: Retained for the duration of your active account plus 7 years after account closure to comply with Indonesian financial record-keeping requirements and anti-money laundering regulations
• Transaction Records: Maintained for 10 years after the transaction date as required by Indonesian tax laws and financial regulations
• Identity Verification Documents: Stored for 7 years after account closure for AML/CTF compliance and to prevent fraudulent re-registration
• Marketing Communications: Retained until you opt out or withdraw consent, then deleted within 30 days except where required for legal compliance
• Customer Support Records: Kept for 3 years to resolve disputes and improve service quality
• Usage and Analytics Data: Aggregated and anonymized for long-term storage; identifiable usage data deleted after 2 years unless needed for fraud investigation or legal purposes

After the applicable retention period expires, we securely delete or anonymize your personal information so it can no longer be associated with you. If deletion is not technically feasible (e.g., data stored in backup archives), we will securely isolate the data from further processing until deletion becomes possible.

8. Your Privacy Rights

Under applicable data protection laws, you have the following rights regarding your personal information. To exercise these rights, please contact our Data Protection Officer using the contact details provided at the end of this Privacy Policy.

8.1 Right to Access

You have the right to request confirmation of whether we are processing your personal data and to obtain a copy of your data. We will provide this information free of charge within 30 days of your request. You may request this information once per year.

8.2 Right to Rectification

If your personal information is inaccurate, incomplete, or outdated, you have the right to request correction. You can update most information directly through your gem138 account settings, or contact customer support for assistance.

8.3 Right to Erasure ("Right to be Forgotten")

You may request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent (where consent was the legal basis for processing). However, this right is subject to legal limitations, particularly where we must retain data to comply with legal obligations or for fraud prevention purposes.

8.4 Right to Restrict Processing

You may request that we temporarily restrict the processing of your personal information in certain situations, such as when you contest the accuracy of the data or object to processing, while we verify your claim.

8.5 Right to Data Portability

Where technically feasible, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit this data to another service provider.

8.6 Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. If you object to marketing, we will cease such processing immediately. For other objections, we will assess whether compelling legitimate grounds override your objection.

8.7 Right to Withdraw Consent

Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

8.8 Right to Lodge a Complaint

If you believe gem138 has violated your privacy rights or applicable data protection laws, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

9. Cookies and Tracking Technologies

gem138 uses cookies, web beacons, and similar tracking technologies to enhance your browsing experience, analyze platform usage, and deliver personalized content. Cookies are small text files stored on your device that allow us to recognize you on subsequent visits and remember your preferences. We use the following types of cookies:

• Essential Cookies: Necessary for basic platform functionality such as login, security, and transaction processing. These cannot be disabled without affecting core services.
• Performance Cookies: Collect anonymous information about how you use our website to help us improve performance and fix errors.
• Functional Cookies: Remember your preferences (language, display settings) to provide a more personalized experience.
• Marketing Cookies: Track your browsing behavior to deliver targeted advertising and measure marketing campaign effectiveness (used only with your consent).

You can manage cookie preferences through your browser settings. Most browsers allow you to refuse cookies or delete existing ones. However, disabling essential cookies may prevent you from using certain features of gem138. For detailed information about the cookies we use, please refer to our Cookie Policy.

10. International Data Transfers

gem138 primarily operates in Indonesia and stores user data on servers located within Indonesian jurisdiction. However, some of our service providers and technology partners are located outside Indonesia, which may require transferring your personal data internationally. When we transfer data across borders, we implement appropriate safeguards to ensure your information remains protected, including:

• Requiring third-party processors to comply with international data protection standards
• Using standard contractual clauses approved by data protection authorities
• Ensuring adequate levels of data protection in the destination country
• Implementing technical measures such as encryption during transfer and storage

11. Children's Privacy

gem138 services are strictly prohibited for individuals under 21 years of age. We do not knowingly collect personal information from anyone under the legal gambling age in Indonesia. If we become aware that a user is underage, we will immediately terminate their account, void all bets, forfeit all funds, and delete their personal information from our systems. If you believe we have inadvertently collected information from a minor, please contact us immediately so we can take corrective action.

12. Changes to This Privacy Policy

gem138 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices, services, legal requirements, or for other operational reasons. When we make material changes, we will notify you by posting a prominent notice on our website or by sending an email to the address registered with your account at least 14 days before the changes take effect. Your continued use of gem138 services after the effective date of the revised Privacy Policy constitutes acceptance of the updated terms. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Information and Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or how gem138 handles your personal information, or if you wish to exercise any of your privacy rights, please contact our Data Protection Officer:

Email: [email protected] (Subject line: Privacy Inquiry)

Response Time: We will acknowledge privacy-related inquiries within 48 hours and provide substantive responses within 30 days of receipt

For general customer support unrelated to privacy matters, please use our standard support channels available 24/7 through live chat and email.