Privacy Policy

This Privacy Policy (hereinafter "Policy") describes how 368gem (hereinafter "368gem", "we", "us", or "the Company") collects, processes, stores, shares, and protects the personal data of users (hereinafter "you", "User", or "Player") of the online casino and sports betting platform operated at 368gem.cam (hereinafter "the Platform").

368gem is committed to handling personal data responsibly, transparently, and in accordance with internationally recognised data protection principles. This Policy is intended to give you a clear understanding of your privacy rights and how your information is managed when you register an account, make a deposit via channels such as DuitNow, Touch 'n Go eWallet, FPX, or Maybank2u, place bets, participate in promotions, or interact with our customer support team.

By registering an account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you should not use the Platform and may request account closure at any time.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial data, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, 368gem.
• "Data Processor" means a third party that processes personal data on behalf of and under the instruction of 368gem.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their personal data.
• "KYC Data" means identity verification documents and information collected as part of the Know Your Customer process, including copies of government-issued identification and proof of address.
• "Cookies" means small data files stored on your device by the Platform browser session to enable functionality, analytics, and user preference retention.

368gem acts as the Data Controller in respect of all personal data collected through the Platform. As Data Controller, 368gem is responsible for determining the purposes for which, and the manner in which, your personal data is processed.

368gem operates under an international gaming licence. While we serve a substantial player base in Malaysia — including players from Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and beyond — the Platform is not subject to Malaysian government data protection regulation. Data processing practices are instead governed by the data protection obligations set out under our international licensing framework.

The following categories of personal data may be collected by 368gem in the course of providing the Platform and its associated services:

368gem collects personal data through the following channels and methods:

Information you provide directly when: registering a player account; submitting KYC documents; making a deposit via DuitNow, Touch 'n Go eWallet, Boost, GrabPay, FPX, Maybank2u, CIMB Clicks, Public Bank, or Hong Leong Connect; submitting a withdrawal request; contacting customer support via live chat or email; participating in a promotion or VIP programme; or updating your account profile settings.

Information collected automatically when you access or use the Platform, including via server logs, cookies, pixel tags, browser fingerprinting, and device identification technologies. This includes IP address, session data, device type, browser type and version, and behavioural data on Platform interactions.

In limited circumstances, 368gem may receive personal data about you from third-party sources, including: identity verification service providers used during KYC processing; payment processors facilitating your deposit or withdrawal transactions; fraud detection and anti-money laundering screening services; and, where applicable, publicly available sources for regulatory compliance purposes.

368gem processes your personal data only for specific, legitimate purposes. The primary purposes for which your data is used are as follows:

• Account management — creating, maintaining, and closing player accounts; enabling login and session management; and managing account preferences and settings.
• Identity and age verification (KYC) — verifying that you meet the 21+ age requirement and that your identity matches the information provided at registration, as required by our licensing obligations.
• Payment processing — facilitating deposits in MYR via Malaysian payment methods and processing withdrawal requests to your verified payment accounts.
• Anti-money laundering and fraud prevention — screening transactions and player behaviour for indicators of money laundering, fraud, or other prohibited financial activities in compliance with applicable AML/CTF frameworks.
• Responsible gambling monitoring — identifying patterns of behaviour that may indicate problem gambling, enabling application of protective measures such as deposit limits, session controls, and self-exclusion where appropriate.
• Customer support — handling enquiries, resolving disputes, and providing technical assistance via live chat and email.
• Platform security — detecting and preventing unauthorised access, duplicate accounts, bonus abuse, and other security threats.
• Analytics and product improvement — understanding how players interact with the Platform to improve usability, performance, and service quality.
• Marketing communications — sending promotional offers, bonus notifications, and VIP programme updates where you have provided explicit consent and have not subsequently withdrawn it.
• Legal and regulatory compliance — meeting obligations under our international operating licence, responding to lawful requests from regulatory or law enforcement authorities, and maintaining records as required.

368gem relies on the following legal bases for the processing of personal data, consistent with internationally recognised data protection principles:

• Contractual necessity — processing required to perform the contract between you and 368gem (i.e., the Terms & Conditions), including account creation, transaction processing, and service delivery.
• Legal obligation — processing required to comply with applicable legal and regulatory obligations, including KYC/AML requirements under our international gaming licence.
• Legitimate interests — processing necessary for 368gem's legitimate business interests, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your fundamental rights and freedoms.
• Consent — where we rely on your consent for specific processing activities, such as sending direct marketing communications, you may withdraw that consent at any time by contacting our support team or updating your account notification preferences.

368gem does not sell or rent your personal data to any third party. We may, however, share your personal data with the following categories of third parties, strictly for the purposes described in this Policy:

We engage third-party service providers who process personal data on our behalf under written data processing agreements. These include: payment processing partners (e.g., providers facilitating DuitNow, FPX, Touch 'n Go eWallet, and bank transfer processing); identity verification and KYC service providers; fraud detection and AML screening vendors; cloud infrastructure and data hosting providers; customer support platform operators; and analytics service providers.

Certain technical data (such as session identifiers and game transaction records) may be shared with certified third-party game content providers to enable gameplay, ensure fair game outcomes, and process game-level transactions. Game providers are contractually prohibited from using this data for any purpose beyond the provision of licensed game services to 368gem.

368gem may disclose your personal data to relevant governmental, regulatory, law enforcement, or judicial authorities where required to do so by applicable law, court order, or regulatory requirement under our international gaming licence. We will endeavour to notify you of such disclosure where legally permissible.

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of 368gem's assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer and the applicable privacy terms governing the successor entity.

368gem is an internationally licensed platform. Personal data collected from Malaysian players may be processed by 368gem or its authorised service providers on servers and in jurisdictions outside of Malaysia. Such international transfers may include jurisdictions where the data protection laws differ from those applicable in Malaysia.

Where personal data is transferred internationally, 368gem ensures that appropriate safeguards are in place, including: contractual data protection clauses with data processors; engagement of service providers who maintain recognised data security certifications; and application of technical security controls including encryption both in transit and at rest.

368gem retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and licensing obligations. The following general retention principles apply:

• Active account data — retained for the duration of your account registration and for a period of up to 5 years following account closure, in accordance with AML and gaming licensing record-keeping requirements.
• KYC documents — retained for a minimum of 5 years from the date of the last transaction or account closure, whichever is later, as required under anti-money laundering frameworks.
• Transaction records — retained for a minimum of 5 years following the relevant transaction, for financial audit and AML compliance purposes.
• Customer support records — retained for a period of up to 3 years from the date of the relevant interaction, for dispute resolution and quality assurance.
• Marketing consent records — retained for as long as the consent remains valid plus a reasonable period following withdrawal of consent to evidence that consent had been obtained.

Upon expiry of the applicable retention period, personal data is securely deleted, anonymised, or archived in a manner that prevents identification of individual data subjects, subject to any overriding legal obligation to retain the data.

368gem uses cookies and similar tracking technologies to operate the Platform effectively, maintain your session state, and collect anonymous usage analytics. The following categories of cookies are used:

• Strictly Necessary Cookies — essential for the Platform to function. These include session cookies that maintain your login state, security tokens, and load-balancing cookies. These cannot be disabled without disrupting Platform functionality.
• Functional Cookies — used to remember your preferences, such as preferred language and display settings, to provide a personalised experience across sessions.
• Analytics Cookies — used to collect anonymous data on how visitors use the Platform, including page views, session duration, and navigation paths. This data is used in aggregate form to improve Platform performance and user experience.
• Security Cookies — used for fraud detection, bot prevention, and identifying unusual account access patterns. These are essential for protecting the integrity of your account and the Platform.

You may adjust your browser settings to refuse cookies or to alert you when cookies are being set. Please note that disabling cookies may affect the functionality of certain Platform features. As 368gem is a functional online betting platform rather than a content website, disabling strictly necessary cookies will prevent you from maintaining an authenticated session.

368gem implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, and disclosure. These measures include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and 368gem servers
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records
• Two-factor authentication (2FA) available for player accounts as an additional layer of login security
• Regular penetration testing and security audits conducted by independent third-party security specialists
• Access controls limiting internal staff access to personal data on a strict need-to-know basis
• Segregated storage of player funds and personal data to limit blast radius in the event of a security incident
• Automated monitoring systems for detection of unusual access patterns, brute-force attempts, and data exfiltration indicators
• Documented incident response procedures with defined escalation paths and player notification protocols

While 368gem employs industry-standard security measures, no system is completely immune to security risks. You are responsible for maintaining the confidentiality of your account login credentials and for ensuring that your own device and network security practices are adequate. You should notify 368gem immediately if you suspect that your account credentials have been compromised.

As a data subject, you hold the following rights in relation to the personal data that 368gem holds about you. To exercise any of these rights, please contact our support team via live chat or by email at [email protected] (plain text — not a clickable link). We will respond to verified requests within a reasonable timeframe and in accordance with our applicable legal obligations.