Privacy Policy Gempak98 – Your Personal Data Protection

Gempak98 ("we", "our platform") deeply values the trust you place in us when sharing personal information while using our services. This Privacy Policy is our commitment to you – clearly explaining what data we collect, why we need it, how we use it, and the steps we take to protect it.

We operate in accordance with Malaysia Personal Data Protection Act (PDPA) 2010 and internationally recognised security standards. Our goal is to ensure every gempak98 user feels safe and confident that their information is in responsible hands.

This Policy applies to all users who access the Gempak98 platform via the website, mobile app, or any related digital channel. It also covers all your interactions with our customer support team.

Gempak98 collects several categories of information for different purposes. Below is a detailed overview of the data we may collect from you:

Data is collected through several means: (1) information you provide directly during registration or platform use; (2) data collected automatically as you browse and use our platform; and (3) information from trusted third-party sources such as identity verification providers.

Gempak98 only uses your personal data for legitimate and necessary purposes. The following are the primary purposes for which your data is used:

• Account management: Creating, verifying, and managing your user account, including the KYC process required for financial security.
• Transaction processing: Processing deposits, withdrawals, and all financial transactions accurately and securely.
• Platform security: Detecting and preventing fraud, hacking, and suspicious activity that could compromise your account or our platform.
• Legal compliance: Fulfilling legal and regulatory obligations including anti-money laundering (AML) and know your customer (KYC) requirements.
• Service improvement: Analyzing usage patterns to improve the interface, platform performance, and overall user experience.
• Service communications: Sending important notifications related to your account, security, transactions, and platform updates.
• Customer support: Resolving complaints, answering inquiries, and providing effective technical support.
• Consented marketing: Delivering relevant promotions and special offers — only if you have given your consent to receive them.

We do not use your data to make automated decisions that have legal or significant effects on you without appropriate human involvement.

Gempak98 does not sell or rent your personal data to any third party for their commercial purposes. However, there are certain situations where we may need to share your data:

• Trusted service providers: Companies that help us operate the platform, such as payment processors, hosting providers, and identity verification services. All such parties are bound by strict confidentiality agreements.
• Legal obligations: When required by law, court order, or direction from a competent authority such as Bank Negara Malaysia or law enforcement agencies.
• Fraud prevention: Sharing information with industry fraud prevention networks to protect users from financial crime.
• Business transfer: In the event of a merger, acquisition, or sale of company assets, user data may be transferred as part of that transaction, with advance notice given to users.

Gempak98 continuously invests in the latest security technologies and processes to protect your personal data from unauthorised access, disclosure, alteration, or destruction. The key security measures we implement are:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and gempak98's servers is encrypted using the same encryption standard employed by leading financial institutions.
• Two-factor authentication (2FA): An additional layer of protection that requires OTP verification for sensitive activities such as new logins and withdrawals.
• 24/7 security monitoring: A real-time threat detection system that monitors suspicious activity around the clock.
• Certified secure servers: Data is stored in high-grade data centres with strict physical and digital access controls.
• Regular security audits: Penetration testing and security audits are conducted regularly by independent security experts.
• Internal access controls: Only staff who require access to perform their duties are permitted to access user data, and all access is logged.

Gempak98 uses cookies and similar tracking technologies to enhance your experience, maintain session security, and understand how our platform is used. Here are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login, session management, and security. These cookies cannot be disabled.
• Preference Cookies: Remembering your preferences such as language and display settings for a more convenient experience.
• Analytics Cookies: Helping us understand how users interact with our platform so we can improve it. This data is collected in aggregate and does not personally identify you.
• Security Cookies: Detecting suspicious login activity and helping prevent fraud and unauthorized access.

You can manage cookie settings through your internet browser. Please note that disabling certain cookies may affect the functionality of the Gempak98 platform. More information on managing cookies is available in your browser settings.

Under Malaysia's PDPA and the best-practice privacy principles we uphold, you have several important rights regarding your personal data held by Gempak98. We respect and facilitate the exercise of these rights:

Gempak98 retains your personal data only for as long as necessary to fulfil the original purpose of collection, or as required by law. Our general data retention guidelines are as follows:

• Active account data: Retained for the duration your account is active and for 5 years after account closure for audit purposes.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysia's financial and tax legal requirements.
• KYC records and identity verification: Retained for 6 years after account closure in accordance with AML requirements.
• Support communication logs: Retained for 3 years for dispute resolution and quality improvement purposes.
• Analytics data: Aggregated data that does not identify individuals may be retained for a longer period for trend analysis purposes.

When data is no longer needed and there is no legal obligation to retain it, Gempak98 will securely delete or anonymise it using industry-recognised data disposal procedures.

Gempak98 may update this Privacy Policy from time to time to reflect changes in our practices, new technologies, legal requirements, or other operational reasons. When we make changes, we will:

• Updating the "Last Updated" date at the top of this document
• Displaying an in-platform notice to logged-in gempak98 users
• Sending notification emails to registered users for significant changes
• Retaining previous versions of this policy for reference

Your continued use of the gempak98 platform after the effective date of any policy changes will be considered your acceptance of the updated policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, gempak98's Data Protection Officer (DPO) team is ready to assist.

You can reach us through several channels:

• Live Chat: Available 24/7 directly within the gempak98 platform for instant responses
• Privacy Email: [email protected] – we will reply within 2 business days
• General Support: [email protected] – for general account and privacy enquiries

All privacy-related enquiries will be handled in strict confidence and resolved promptly in accordance with established procedures.