Privacy Policy — How 365gem Protects Your Data

1 Introduction & Scope

This Privacy Policy ("Policy") describes how 365gem ("the Platform", "we", "us", "our") collects, uses, stores, shares, and otherwise processes the personal data of individuals ("you", "Player", "User") who register an account with, visit, or otherwise interact with the 365gem online gaming platform accessible at 365gem.net and any associated subdomains or digital services.

This Policy applies to all personal data processed in connection with your use of 365gem — whether you are browsing the platform without registering, creating or maintaining an account, making a deposit or withdrawal, participating in casino games or sports betting, contacting customer support, or engaging with any other feature or service offered by 365gem.

By creating a 365gem account or using the platform in any capacity, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read in conjunction with the 365gem Terms & Conditions, which are incorporated by reference.

2 Data Controller Identity

For the purposes of applicable data protection law, 365gem is the data controller in respect of personal data collected from players who register or interact with the platform. As data controller, 365gem determines the purposes for which and the manner in which personal data is processed.

365gem operates under an internationally recognised gaming licence and is subject to the data protection obligations imposed by its licensing jurisdiction as well as applicable international standards. Queries regarding our data controller status or data processing activities may be directed to the contact address set out in Section 15 of this Policy.

3 Personal Data We Collect

365gem collects personal data through several channels — directly from you during registration and use of the platform, automatically through the operation of the website and gaming software, and from third parties where permitted by applicable law. The categories of personal data we collect are as follows:

We do not knowingly collect sensitive personal data beyond what is strictly required for identity verification (i.e., CNIC or passport information) and AML compliance. We do not collect biometric data, religious or political affiliations, or health information in the ordinary course of our operations.

4 How We Use Your Personal Data

365gem uses personal data collected from players for the following clearly defined purposes:

• Account Management: Creating, maintaining, verifying, and administering your 365gem player account, including processing login authentication and account settings changes.
• Identity Verification (KYC): Verifying your identity, age (confirming you are 21+), and source of funds as required under our licensing obligations and anti-money laundering regulations.
• Payment Processing: Processing deposits and withdrawals in PKR via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and any other permitted payment method, and maintaining records of all financial transactions.
• Game Provision: Enabling you to access and participate in casino games, sports betting markets, jackpots, and all other gaming features available on 365gem.
• Regulatory Compliance: Meeting our obligations under gaming licensing, anti-money laundering, counter-terrorism financing, and applicable data protection law — including producing records for regulatory inspection where required.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, collusion, money laundering, account compromise, and other security threats to the platform and its players.
• Responsible Gaming: Monitoring gaming patterns to identify potential indicators of problem gambling, administering player-requested limits and exclusions, and delivering responsible gaming communications.
• Customer Support: Responding to support requests, resolving complaints, and maintaining records of customer service interactions for quality assurance and dispute resolution.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have consented to receive such communications, or where permitted on the basis of legitimate interest for existing players.
• Platform Improvement: Analysing aggregated usage data to improve the 365gem platform, game library, user interface, and overall player experience.

5 Legal Basis for Processing

365gem processes personal data only where a valid legal basis exists for doing so. The legal bases on which we rely for the processing activities described in this Policy are as follows:

• Contractual Necessity: Processing necessary to perform our obligations under the Terms & Conditions you have entered into with 365gem — including account management, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC/AML obligations under our gaming licence and applicable financial crime legislation.
• Legitimate Interests: Processing necessary for 365gem's legitimate business interests where those interests are not overridden by your privacy rights — including fraud prevention, security monitoring, platform improvement, and certain marketing activities directed at existing registered players.
• Consent: Where you have given clear, informed consent to processing for a specific purpose — such as receiving marketing communications from 365gem. You may withdraw consent at any time as described in Section 12.

6 Data Sharing & Third-Party Disclosure

365gem does not sell your personal data to third parties. We do not share personal data with unaffiliated parties for their own marketing purposes. Personal data is disclosed to third parties only in the following circumstances, and only to the extent necessary for the stated purpose:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, and Meezan Bank receive transaction data necessary to execute deposits and withdrawals. These providers operate under their own data protection obligations and we require that they handle your data securely and in accordance with applicable law.
• KYC & Identity Verification Providers: Third-party identity verification services receive copies of identity documents (CNIC or passport) provided during the KYC process, for the purpose of verifying your identity and age.
• Game Providers: The certified third-party game providers whose software titles are available on the 365gem platform may receive player session data necessary for game operation, including account identifiers and wager records. These providers are contractually required to use this data only for game provision purposes.
• Regulatory Authorities: 365gem may be required by law, court order, or regulatory direction to disclose player data to competent authorities, including gaming regulators, financial intelligence units, and law enforcement agencies. Such disclosures are made only to the extent legally required.
• Professional Advisers: Lawyers, auditors, accountants, and insurers who provide services to 365gem may have access to personal data on a confidential, need-to-know basis where necessary for the provision of those services.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of 365gem's business, player data may be transferred to the relevant successor entity, subject to equivalent data protection obligations being maintained by the transferee.

7 Cookies & Tracking Technologies

365gem uses cookies and similar tracking technologies on the platform to ensure correct operation, improve user experience, and analyse platform usage. A cookie is a small text file placed on your device by a website server. The following categories of cookies are used by 365gem:

• Strictly Necessary Cookies: Required for the platform to function — including authentication session cookies that keep you logged in to your 365gem account and security cookies that protect against cross-site request forgery. These cannot be disabled without impairing platform functionality.
• Functional Cookies: Remember your preferences such as language settings, responsible gaming limit selections, and game lobby display preferences. Disabling these may reduce the personalisation of your 365gem experience.
• Analytical Cookies: Used to collect aggregated, anonymised information about how players navigate and use the 365gem platform, enabling us to identify areas for improvement. The data collected does not identify individual users.
• Marketing Cookies: Where you have consented to marketing communications, these cookies help 365gem understand which promotions you have viewed or engaged with, enabling more relevant communications over time.

You may manage cookie preferences through your browser settings. Note that blocking strictly necessary cookies will impair your ability to log in and use the 365gem platform. Continued use of the platform after reviewing this cookie information constitutes acknowledgement of our cookie practices.

8 Data Retention

365gem retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for as long as is required by applicable legal, regulatory, or contractual obligations. Specific retention periods are as follows:

• Account Data: Retained for the duration of your active 365gem account and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements under our gaming licence.
• KYC / Identity Documents: Retained for a minimum of five (5) years from the date of verification, or longer where required by applicable AML legislation applicable to our licensing jurisdiction.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction. Certain records may be retained longer where subject to regulatory investigation or legal proceedings.
• Gaming Session Data: Retained for a minimum of three (3) years from the date of the session, to enable dispute resolution, audit, and regulatory compliance.
• Support Communications: Retained for two (2) years from the date of the communication, or longer where related to an unresolved dispute or ongoing complaint.
• Marketing Consent Records: Retained for the duration of your account and for one (1) year following any withdrawal of consent, as evidence of the basis on which marketing was conducted.

Where personal data is no longer required and no legal obligation requires its retention, 365gem will securely delete or anonymise it. Anonymised data — where all identifying elements have been irreversibly removed — may be retained indefinitely for statistical and analytical purposes.

9 Data Security

365gem implements a range of technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, disclosure, or alteration. These measures include, but are not limited to:

• Transport Layer Security (TLS) encryption for all data transmitted between the player's device and 365gem's servers.
• One-way cryptographic hashing of all player passwords — meaning passwords are never stored or accessible in their original form.
• Access controls limiting internal access to personal data to authorised personnel with a demonstrable need-to-know for their role.
• Regular independent security reviews and penetration testing of 365gem's platform infrastructure.
• Automated monitoring for unusual login activity, suspicious transaction patterns, and potential account compromise.
• Physical and environmental security controls applied to the data centres in which 365gem data is stored.

While 365gem takes its security obligations seriously and implements appropriate measures for the risk level involved, no online system can guarantee absolute security. In the event of a data breach that is likely to result in risk to your rights or freedoms, 365gem will notify affected players and the relevant supervisory authority in accordance with applicable legal requirements.

10 Your Privacy Rights

Subject to applicable law and the limitations described herein, you hold the following rights in relation to the personal data that 365gem processes about you. To exercise any of these rights, please contact us as described in Section 15.