Privacy Policy — 939gem Platform

1Introduction

This Privacy Policy ("Policy") describes how 939gem ("939gem", "we", "us", "our") collects, processes, stores, shares and protects personal data obtained from individuals ("User", "you", "your") who access or use the 939gem website at 939gem.cam and all associated services ("Platform").

939gem is an English-language online gambling information and entertainment platform serving users in Pakistan and other jurisdictions where access is not restricted by applicable law. We are committed to handling personal data responsibly, transparently and in accordance with applicable data protection law in the jurisdiction(s) in which 939gem is registered and licensed to operate.

By registering an Account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. If you do not agree with this Policy, you should not access or use the Platform.

2Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

3Data Controller Information

939gem acts as the Data Controller for Personal Data collected through the Platform. As Data Controller, we are responsible for determining the purposes for which and the means by which Personal Data is processed.

For all data protection enquiries, rights requests and complaints, you may contact us through the details provided in Section 16 of this Policy. We aim to acknowledge all data-related requests within five (5) business days and resolve them within thirty (30) days, unless extended processing time is permitted by applicable law.

Where 939gem engages third-party Data Processors (such as payment processing services, KYC verification platforms or fraud detection providers), each processor operates under a written data processing agreement that imposes obligations equivalent to those applicable to 939gem under this Policy.

4Personal Data We Collect

We collect Personal Data through several channels depending on how you interact with the Platform. The categories of data we collect include:

4.1 Registration Data. When you create an Account on 939gem, we collect:

• Full legal name;
• Date of birth (for age verification purposes);
• Email address;
• Username and encrypted password hash;
• Country and province/city of residence (e.g., Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad, Multan, Peshawar);
• Mobile phone number (where provided for two-factor authentication or account recovery).

4.2 Identity Verification (KYC) Data. To comply with AML obligations and verify minimum age requirements, we may collect:

• Scanned copy or photograph of your CNIC (front and back) or valid passport;
• Proof of address document (utility bill, bank statement or equivalent — dated within three months);
• Selfie or biometric liveness verification image;
• CNIC number or passport number (used as a unique identifier for AML record-keeping).

4.3 Financial Transaction Data. When you make deposits or withdrawals, we collect:

• Transaction amounts and timestamps;
• Payment method type (the name of a payment method such as a bank transfer reference — note: we do not store full card numbers or full payment account credentials directly; these are handled by our PCI-compliant payment processors);
• Transaction reference identifiers issued by payment processors.

4.4 Betting and Gaming Activity Data. We maintain records of:

• Wagers placed, odds at time of placement, outcomes and resulting balances;
• Games accessed, session durations and in-game activity;
• Responsible gambling limit settings you have configured.

4.5 Technical and Usage Data. When you visit the Platform, we automatically collect:

• IP address and approximate geolocation (country/city level);
• Device type, operating system and browser version;
• Referring URL and pages visited on the Platform;
• Session duration and clickstream data;
• Cookie identifiers (see Section 9).

4.6 Communications Data. When you contact 939gem support, we retain records of your communications — including emails, live chat transcripts and submitted support tickets — for quality assurance, dispute resolution and regulatory compliance purposes.

5How We Use Your Personal Data

We process Personal Data only for specific, legitimate purposes. The primary purposes for which we use your data are:

6Legal Basis for Processing

Each processing activity carried out by 939gem is grounded in one or more recognised legal bases under applicable data protection law. The primary legal bases we rely upon are:

• Contractual Necessity: Processing required to perform the contract between 939gem and you — including Account creation, bet processing, payment handling and customer support.
• Legal Obligation: Processing required to comply with AML laws, KYC regulations, responsible gambling obligations and record-keeping requirements imposed by the operator's licensing jurisdiction.
• Legitimate Interests: Processing necessary for 939gem's legitimate interests, including fraud prevention, platform security, abuse detection and improvement of services — where those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where no other legal basis applies — primarily for optional marketing communications — we process data based on your freely given, specific and informed consent. Consent can be withdrawn at any time.

7Data Sharing & Third-Party Processors

939gem does not sell, rent or trade your Personal Data to third parties for their own marketing or commercial purposes. We share Personal Data only in the following circumstances:

7.1 Service Providers (Data Processors). We engage carefully selected third-party service providers who process data on our behalf under strict written data processing agreements. These include:

• KYC / Identity Verification Providers: Identity document scanning and biometric liveness verification platforms that assist us in verifying CNIC, passport and selfie submissions;
• Payment Processors: Entities that process financial transactions. Payment method names referenced on this Platform — including those familiar to Pakistani users such as Easypaisa, JazzCash, Raast, HBL, UBL, Meezan Bank and Bank Alfalah — are contextual references only. None of these providers have endorsed or facilitated gambling on 939gem. Actual payment processing is conducted through the operator's live cashier partners;
• Fraud Detection Systems: Third-party risk-scoring and fraud prevention services that analyse transaction patterns;
• Platform Infrastructure Providers: Cloud hosting, CDN and database service providers that store and transmit Platform data under security standards consistent with this Policy.

7.2 Legal Authorities. We may disclose Personal Data to law enforcement agencies, regulatory authorities or courts where required to do so by applicable law, court order, or where we reasonably believe disclosure is necessary to protect the rights, property or safety of 939gem, our users or the public.

7.3 Business Transfers. In the event of a merger, acquisition, restructuring or sale of assets, Personal Data may be transferred as part of that transaction. You will be notified of any such transfer and any material change to data processing arrangements that results from it.

8Data Retention

We retain Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention principles apply:

• Active Accounts: Personal Data associated with an active Account is retained for the duration of the Account's existence, and for a defined period following Account closure determined by our legal and regulatory obligations.
• KYC Records: Identity verification documents and AML records are retained for a minimum of five (5) years following Account closure, or longer where required by the operator's licensing jurisdiction's AML regulations.
• Transaction Records: Financial transaction data is retained for a minimum of five (5) years to comply with AML record-keeping requirements and applicable tax or accounting obligations.
• Support Communications: Customer support records are retained for a period of two (2) years following resolution of the relevant matter, unless the matter is subject to ongoing legal proceedings.
• Marketing Data: Email marketing consent records and communication history are retained until you withdraw consent, plus a reasonable period to demonstrate compliance with the consent requirement.
• Technical Logs: System access logs and security event records are retained for a period of twelve (12) months unless extended for the purposes of an ongoing security investigation.

On expiry of the applicable retention period, Personal Data is either securely deleted from our systems or irreversibly anonymised such that it can no longer be attributed to an identifiable individual.

9Cookies & Tracking Technologies

939gem uses cookies and similar tracking technologies to enable essential Platform functionality, personalise your experience and understand how the Platform is used. A cookie is a small text file stored on your device by your browser when you visit the Platform.

We use the following categories of cookies:

You can manage cookie preferences through your browser settings. Most browsers allow you to view, delete and block cookies. Note that blocking essential cookies will impair your ability to use the Platform. For full information on managing cookies, refer to your browser's help documentation.

10Data Security

939gem implements appropriate technical and organisational security measures designed to protect your Personal Data against accidental loss, unauthorised access, disclosure, alteration or destruction. Our security measures include:

• Transport Security: All data transmitted between your browser and 939gem servers is encrypted using TLS (Transport Layer Security). HTTPS is enforced site-wide — there are no unencrypted HTTP pages on this Platform.
• Access Controls: Personal Data is accessible only to authorised 939gem personnel and Data Processors with a documented need to access it. Role-based access controls limit data access on a need-to-know basis.
• Password Security: User passwords are stored as salted cryptographic hashes — we do not store plaintext passwords and cannot retrieve your password; only reset it through a verified process.
• KYC Document Security: Identity documents submitted through the secure verification portal are stored in an access-controlled environment separate from general Platform data stores.
• Incident Response: We maintain a documented data breach response procedure. In the event of a confirmed Personal Data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant regulatory authorities within the timeframes required by applicable law.
• Regular Reviews: Our security controls are reviewed periodically and updated in response to changes in threat landscape, regulatory guidance and Platform architecture.

Despite these measures, no data transmission over the internet or storage system can be guaranteed to be 100% secure. You are responsible for maintaining the security of your Account credentials — use a strong, unique password and enable two-factor authentication where available.

11International Data Transfers

As an operator serving users in Pakistan and other jurisdictions, 939gem may transfer Personal Data to countries outside the User's country of residence, including to the jurisdiction in which 939gem's servers and Data Processors are located.

Where Personal Data is transferred internationally, we take steps to ensure that appropriate safeguards are in place to protect the data in a manner consistent with the principles of this Policy. These safeguards may include:

• Transfers to jurisdictions that have been assessed as providing an adequate level of data protection;
• Use of standard contractual clauses or equivalent contractual safeguards in data processing agreements with international processors;
• Binding corporate rules or other approved transfer mechanisms where applicable.

Pakistan does not currently have a comprehensive data protection law equivalent to the EU GDPR or similar frameworks. However, 939gem applies the data protection principles described in this Policy to all users, regardless of location, as a matter of operational commitment.

12Your Data Rights

Subject to applicable law, you have the following rights with respect to your Personal Data held by 939gem. You may exercise these rights by contacting us using the details in Section 16.

We will respond to all rights requests within thirty (30) days. Where a request is complex or we receive multiple requests simultaneously, we may extend this period by a further two months, with written notice to you explaining the reason for the extension. We will not charge a fee for processing a rights request unless the request is manifestly unfounded or excessive.

13Children's Privacy

939gem is strictly an adults-only platform. The Platform is not directed at, and we do not knowingly collect Personal Data from, any person under the age of 18 — or the higher minimum age required by the operator's licensing jurisdiction.

Age verification is conducted as part of the KYC process. Where we have reasonable grounds to believe that a User is under the applicable minimum age, the Account will be suspended immediately pending age verification, and any deposits made by an underage user will be returned to the original payment source in accordance with our Terms and Conditions.

If you are a parent or guardian and believe that a person under your care has created an Account on 939gem, please contact us immediately using the details in Section 16. We will investigate and, where confirmed, close the Account and return any funds without delay.

14Third-Party Links & Services

The Platform may contain references to third-party services or payment method names for contextual purposes. These references do not constitute links to external websites from 939gem pages, and 939gem does not embed third-party tracking scripts from advertising networks.

Where the Platform does interface with third-party services for operational purposes — such as payment processors for transaction completion or KYC providers for identity verification — those third parties have their own privacy policies that govern how they process data submitted directly to them. 939gem is not responsible for the privacy practices of third-party service providers beyond the data processing agreements we hold with them as described in Section 7.

We recommend that you review the privacy policy of any third-party service that you use in connection with your 939gem Account, particularly payment services you access independently outside the Platform's cashier.

15Changes to This Privacy Policy

939gem reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law or Platform services. The "Last Reviewed" date at the top of this page will be updated to reflect any revision.

Where we make material changes to this Policy — meaning changes that affect how we use your Personal Data or that materially affect your rights — we will notify registered Users via email to the address on file and/or by displaying a prominent notice on the Platform upon your next login. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

We encourage you to review this Policy periodically to stay informed about how 939gem protects your data. If you have concerns about any changes, you may contact us using the details below or request Account closure if you do not accept the revised terms.

16Contact Us — Data Protection Enquiries

For all data protection matters — including rights requests, concerns about data processing, reporting suspected data breaches or general privacy enquiries — please contact the 939gem data protection team using the details below.

We ask that when submitting a rights request or data complaint, you include: your registered Account username or email address, a clear description of your request or concern, and the specific section of this Policy you believe is relevant. This helps us process your request accurately and promptly.