Privacy Policy

1 Definitions

In this Privacy Policy, the following terms carry the meanings defined below:

• "Personal Data" means any information that identifies or can be used to identify a natural person, directly or indirectly — including name, date of birth, national identity number, email address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" means gem777, the entity that determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means a third party that processes Personal Data on behalf of gem777 under a written data processing agreement.
• "Member" or "You" means any individual who has registered an Account on the gem777 Platform.
• "Platform" means the gem777 website at https://gem777.asia and all associated services.
• "Cookies" means small text files placed on your device by a website to store information about your browsing session and preferences.
• "IDR" means Indonesian Rupiah, the sole currency of operation on the Platform.

2 Data We Collect

gem777 collects the following categories of Personal Data in connection with your use of the Platform:

gem777 does not knowingly collect Sensitive Personal Data (such as racial or ethnic origin, religious beliefs, health data, or political opinions) through the Platform. Where KYC documents incidentally reveal such information, gem777 processes only the identity-relevant fields and does not record or use sensitive attributes for any purpose.

3 How We Collect Data

gem777 collects Personal Data through the following channels:

3.1 Direct Collection

You provide Personal Data directly to gem777 when you register an Account, complete the KYC verification process, submit a deposit or withdrawal request, contact our support team via live chat, email, or WhatsApp, or respond to a promotional survey or feedback request.

3.2 Automated Collection

When you visit and interact with the Platform, gem777's systems automatically collect Technical Data and Usage Data via server logs, cookies, pixel tags, and similar tracking technologies. This data is collected regardless of whether you are logged in to your Account.

3.3 Third-Party Sources

In limited circumstances, gem777 may receive Personal Data about you from third parties, including:

• Payment processors (such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, and ShopeePay), who may confirm transaction details, account names, and fraud signals.
• Identity verification service providers, who assist gem777 in confirming the authenticity of KYC documents and cross-referencing identity data against publicly available sanction and PEP (Politically Exposed Person) lists.
• Analytics platforms, which may provide aggregated or pseudonymized behavioral data about Platform visitors.

4 Purposes of Processing

gem777 processes your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and securing your gem777 Account, including authentication and password recovery.
• Identity Verification (KYC): Verifying that you meet the eligibility requirements set out in the Terms & Conditions — specifically that you are at least 21 years of age and a resident of Indonesia.
• Transaction Processing: Processing deposits and withdrawals in IDR via supported Indonesian banks and e-wallets, and maintaining accurate transaction records.
• Fraud Prevention and Security: Detecting and preventing fraudulent activity, bonus abuse, money laundering, and unauthorized access to your Account.
• Regulatory Compliance: Fulfilling obligations under applicable anti-money laundering (AML) and know-your-customer (KYC) frameworks.
• Customer Support: Responding to your queries, resolving disputes, and providing technical assistance.
• Platform Improvement: Analyzing Usage Data and Technical Data to improve the Platform's performance, user experience, and game content offering.
• Responsible Gaming: Monitoring betting patterns to identify potential problem gambling behavior and to facilitate self-exclusion or deposit limit requests.
• Marketing Communications: Sending you promotional offers and bonus notifications relevant to your activity on gem777, where you have provided consent or where gem777 has a legitimate interest in communicating with active Members.

5 Legal Basis for Processing

gem777 relies on the following legal bases for processing your Personal Data:

• Contractual Necessity: Processing that is necessary to perform the contract between you and gem777 — including Account management, transaction processing, and KYC verification — is carried out on the basis that it is required to deliver the services you have requested.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, and analytical improvements is based on gem777's legitimate interests in maintaining a safe, fair, and well-functioning platform, provided that those interests are not overridden by your privacy rights.
• Legal Obligation: Processing necessary to comply with applicable AML, KYC, and financial reporting obligations is carried out on the basis of legal compliance.
• Consent: Where gem777 sends you optional marketing communications beyond service-related notifications, such communications are sent on the basis of your consent, which you may withdraw at any time by contacting [email protected] or updating your communication preferences in your Account settings.

6 Data Sharing

gem777 does not sell, rent, or trade your Personal Data. We share your data only in the circumstances described below, and only to the extent strictly necessary for each purpose:

6.1 Payment Processors

To process deposits and withdrawals, gem777 shares your name, bank account or e-wallet details, and transaction amounts with the relevant payment processor. Supported processors include BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja. Each processor operates under its own privacy policy and applicable Indonesian financial regulations.

6.2 Identity Verification Providers

gem777 engages specialist third-party KYC providers to assist in verifying the authenticity of identity documents and cross-referencing submitted data against international sanctions and PEP lists. These providers act as Data Processors under written agreements with gem777 and are not permitted to use your data for any purpose beyond the specific verification task.

6.3 Technology and Infrastructure Providers

gem777 uses third-party technology providers for cloud hosting, database management, cybersecurity monitoring, and customer support software. These providers access Personal Data only to the extent required to deliver their contracted services and are bound by strict confidentiality and data security obligations.

6.4 Game Content Providers

Certain game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive pseudonymized player identifiers and session data required to operate their games within the gem777 Platform. Full identity data is not shared with game studios.

6.5 Legal and Regulatory Disclosure

gem777 may disclose your Personal Data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable law, court order, or valid legal process, or where gem777 reasonably believes disclosure is necessary to protect the rights, property, or safety of gem777, its Members, or the public.

6.6 Business Transfers

In the event that gem777's business or a substantial part of its assets are acquired by or merged with another entity, your Personal Data may be transferred to the acquiring entity as part of that transaction. gem777 will notify affected Members of any such transfer and the resulting change in data controller at least 30 days in advance.

7 Cookies & Tracking Technologies

gem777 uses cookies and similar tracking technologies to operate the Platform, maintain your session, and analyze usage patterns. The following categories of cookies are in use:

You may manage or disable non-essential cookies through your browser's privacy settings. Please note that disabling cookies may affect the functionality of certain features on the Platform, including the ability to maintain a logged-in session across pages. gem777 does not use third-party advertising or retargeting cookies.

8 Data Retention

gem777 retains Personal Data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

• Account and identity data: Retained for the duration of your Account's active status, plus a minimum of 5 years following account closure, to satisfy AML record-keeping obligations.
• Transaction records: Retained for a minimum of 5 years from the date of each transaction, in accordance with financial record-keeping requirements.
• KYC documents: Retained for the duration of your active Account, plus 5 years after closure or last activity, whichever is later.
• Support communications: Retained for 2 years from the date of the last communication in each support ticket thread, to assist with dispute resolution.
• Technical and usage logs: Retained for 12 months on a rolling basis, after which they are anonymized or deleted.
• Marketing consent records: Retained for the duration of your consent, plus 3 years from the date of withdrawal to evidence compliance.

At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymized. Where data must be retained for legal reasons beyond your request for deletion, gem777 will restrict its processing to only those purposes mandated by law.

9 Security Measures

gem777 implements a layered security framework to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. Key measures include:

• TLS/SSL Encryption: All data transmitted between your device and gem777's servers is encrypted in transit using 256-bit TLS/SSL protocols.
• Encryption at Rest: Sensitive data fields — including identity document images, bank account details, and passwords — are encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data within gem777's systems is strictly limited to authorized personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Penetration Testing: gem777's infrastructure undergoes regular independent security audits and penetration testing to identify and remediate vulnerabilities.
• Incident Response: gem777 maintains a documented data breach response plan. In the event of a breach affecting your Personal Data, you will be notified promptly with details of the incident and the steps taken to mitigate its impact.

10 Your Rights

As a data subject, you have the following rights in relation to your Personal Data held by gem777. To exercise any of these rights, please contact [email protected] with your full name, registered email address, and a description of your request. gem777 aims to respond to all rights requests within 30 calendar days.

11 Minors

The gem777 Platform is strictly intended for adults aged 21 years and older. gem777 does not knowingly collect, store, or process Personal Data from any individual under the age of 21. If gem777 becomes aware that Personal Data has been collected from an individual under the minimum age, that data will be deleted immediately and the associated Account will be permanently closed.

If you are a parent or guardian and you believe that a minor in your care has registered an Account with gem777, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

12 International Data Transfers

gem777's primary operations and data storage infrastructure are maintained in data centers serving the Southeast Asian region, with a principal user base in Indonesia. In certain circumstances — such as the use of internationally based KYC verification providers, cloud infrastructure services, or game content providers — your Personal Data may be transferred to and processed in jurisdictions outside of Indonesia.

Where such international transfers occur, gem777 ensures that appropriate safeguards are in place, including contractual data protection clauses with the receiving party that impose data handling obligations equivalent to those described in this Policy. gem777 does not transfer Personal Data to jurisdictions that do not provide an adequate level of data protection without implementing supplementary safeguards.

13 Policy Amendments

gem777 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform features. Where amendments are material — such as changes to the categories of data collected, new third-party sharing arrangements, or revised retention periods — gem777 will provide at least 14 days' advance notice via a prominent notice on the Platform homepage or by email to your registered address.

The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision. Continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree to the amended terms, you should cease using the Platform and contact support to request a withdrawal of your available balance and closure of your Account.

14 Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how gem777 handles your Personal Data, please contact our support team using the details below. All contact details are provided as plain text only and are not clickable links.

• Email: [email protected]
• Live Chat: Available 24/7 via the Platform interface
• WhatsApp: Available 08:00–24:00 WIB daily (number displayed after login)
• Email Response Time: Within 2–6 hours (WIB business hours)

gem777 is committed to resolving all privacy-related complaints promptly and fairly. If you are not satisfied with gem777's response to your complaint, you may escalate the matter to the relevant data protection authority in your jurisdiction or pursue resolution through the dispute process described in the Terms & Conditions.