Gembet Privacy Policy: Protecting Your Personal Data in Singapore's Online Casino
Click to register
Gembet privacy policy defines how player data is handled across casino games and sports betting. It covers collection, lawful use, storage, and controlled disclosure. It also explains online casino data security controls used to reduce exposure. Terms apply to website use, account registration, payments in SGD, and support requests.
Personal data protection is governed by Singapore’s PDPA and related PDPC guidance. PDPA is Singapore’s law regulating personal data in private organisations. Where a player is in the EEA or UK, GDPR-style safeguards may apply. This text also explains user rights in data privacy and how to exercise them.
Introduction
How the Gembet privacy policy applies to casino and sportsbook accounts
This policy applies to account creation, identity checks, deposits, withdrawals, and betting activity. It also applies to device access, cookies, and customer support interactions. It covers data received directly from players and data generated by system logs. It also covers data obtained from payment and verification partners. Policy terms apply when you use the website or related services.
Singapore PDPA sets core duties for consent, purpose limitation, and security arrangements. The PDPC enforces these duties and issues decisions and undertakings. Recent PDPC cases highlight ransomware and vulnerability risks for organisations.
What Personal Data We Collect
How Gembet collects user personal information during registration and play
Data is collected when you register, verify identity, place bets, or request payments. Data is also collected when you contact support or enable account security options. Technical identifiers are collected when your device connects to the platform. Some data is collected via cookies or similar storage technologies. Some data is received from third parties you authorise, like payment providers.
Categories of personal data may include:
- Full name, date of birth, and nationality
- Email address and phone number
- Residential address for account verification
- Government-issued ID details for KYC checks
- IP address, device identifiers, and login timestamps
- Cookie identifiers and session tokens
- Payment references and transaction history in SGD
- Deposit and withdrawal method metadata
- Betting, gameplay, and bonus redemption history
- Responsible gaming limits and self-exclusion settings
- Support tickets, chat transcripts, and call recordings where permitted
Sensitive data is not requested unless a legal duty requires it. Identity documents are handled using restricted access and retention controls. Data minimisation is applied to reduce collection to necessary fields.
How We Use Your Personal Data
Why Gembet uses player data for SGD betting, security, and compliance
Personal data is used to create and manage your account and to deliver requested services. It is used to verify identity and meet KYC and fraud controls. It is used to process deposits, withdrawals, chargebacks, and dispute handling. It is used to detect collusion, bonus abuse, and account takeover behaviour. It is used to maintain platform integrity and audit trails.
Typical purposes include:
- Account onboarding and identity verification
- Payment processing, reconciliation, and financial reporting
- Fraud screening and risk scoring based on login patterns
- Customer support and complaint resolution
- Responsible gambling controls, including limit enforcement
- Product analytics using aggregated or pseudonymised data
- Legal compliance and regulator or court requests
Legal grounds under PDPA may include consent, contractual necessity, and legal obligations. PDPA also provides consent exceptions in defined cases, including legitimate interests and business improvement conditions.
Data Storage and Security Measures
Secure storage of player data in online gambling with layered controls
Player records are stored on secured infrastructure designed for confidentiality and integrity. Primary hosting is maintained in Singapore-based or Singapore-compliant data centres. Access is restricted through role-based permissions and audited admin actions. Secrets and encryption keys are handled using hardened key management controls. Backups are encrypted and tested for restore integrity.
Security controls include encryption in transit and at rest. TLS is used for browser-to-server traffic, reducing interception risk. AES-256 is used for stored sensitive fields and backup archives. Two-factor authentication can be required for high-risk sign-ins. Session tokens are rotated and invalidated after suspicious events.
| Feature | Description |
| Encryption (data at rest) | AES-256 for stored personal data and encrypted backups |
| Encryption (in transit) | TLS for secure browser and API communications |
| Firewalls / WAF | Network filtering and web application firewall rules |
| Intrusion detection | Alerts for anomalous access, scans, and credential stuffing |
| Access controls | Role-based access, least privilege, logged admin actions |
| Account protection | 2FA options, login throttling, risk-based challenges |
| Secure development | Code reviews, dependency checks, staged deployments |
| Monitoring | Centralised logs, alerting, and incident response playbooks |
Security audits are scheduled and tracked, including configuration reviews and vulnerability scanning. Incident response includes containment, eradication, and forensic review. Under Singapore’s enhanced PDPA, data breach notification duties apply in defined cases.
User Rights and Choices
Your rights to access and delete personal data under PDPA
PDPA gives individuals rights to access and correct personal data held by organisations. You can request a copy of key account data used for identity and payments. You can request correction of inaccurate contact details or verification fields. Where deletion is requested, retention limits and legal duties are assessed. Some records must be retained for fraud prevention and financial audit.
You can exercise these user rights in data privacy:
- Access: request account profile data and SGD transaction references.
- Correction: fix email, phone number, or address used for verification.
- Deletion: request removal of non-required data after account closure.
- Withdraw consent: stop optional marketing or analytics processing.
- Portability: request portable data where PDPA portability applies.
Requests are verified to prevent identity spoofing. Verification may require re-authentication or an ID re-check. Responses follow statutory timelines and PDPC guidance expectations.
Data Sharing and Third Parties
When Gembet shares data with payment processors and verification vendors
Personal data is shared only when needed to deliver services or meet legal duties. Payment providers receive transaction data necessary to process deposits and withdrawals. Verification vendors receive identity attributes needed for KYC validation. Fraud and security vendors may receive device and risk signals. Marketing platforms receive data only where consent or applicable rules allow it.
Third parties are required to follow contractual data protection clauses. Data sharing is limited to the minimum fields required for the task. Cross-border recipients must provide comparable protection where transfers occur. Singapore’s PDPA includes transfer rules requiring comparable standards for overseas recipients.
Compliance with Laws and Regulations
PDPA personal data protection duties and GDPR-aligned safeguards where relevant
Singapore’s PDPA sets baseline duties for notice, consent, purpose limitation, and protection. The PDPC is the regulator that enforces PDPA obligations and publishes decisions.
Enhanced PDPA amendments were phased in from 1 February 2021, with further commencement on 1 October 2022.
GDPR-style safeguards may be applied where user location or business relationships require it. These safeguards may include stricter consent records and narrower retention. They may also include documented lawful bases and DPIA-style risk reviews. If GDPR applies, cross-border transfer safeguards can include contractual clauses and transfer assessments.
Changes to This Policy
How policy updates are published and when changes take effect
Policy text may change due to operational, security, or legal updates. Updated versions are posted on the website with a new effective date. Material changes may trigger an account notice or email alert. Continued use after the effective date indicates acceptance of the updated terms. If a change affects consent-based processing, fresh consent may be requested.
Archived versions may be retained for audit and dispute handling. Date markers are used to track when obligations changed. Internal change logs support accountability and incident investigations. Policy change controls align with PDPA accountability expectations.
Contact Us
Contact the Gembet data protection team for privacy requests under PDPA
Privacy requests should be sent from your registered email where possible. Include your account identifier and the right you want to exercise. Do not send full card numbers or raw ID scans in email. Use the website’s secure channels when document submission is required.
Send requests and questions to [email protected]. This address handles access, correction, deletion, and consent withdrawal matters. It also handles online casino data security concerns, suspected account compromise, and breach inquiries.