Privacy Policy

Gerbang88 operates as a Malaysian-market-oriented online gaming platform, offering slots, live casino, sports betting — including Liga Super Malaysia, EPL, and UFC markets — lottery, and arcade games. Our services are provided exclusively in Malaysian Ringgit (MYR), and our primary user base consists of players located across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam.

Gerbang88 operates as a Malaysian-market-oriented online gaming platform, offering slots, live casino, sports betting — including Liga Super Malaysia, EPL, and UFC markets — lottery, and arcade games. Our services are provided exclusively in Malaysian Ringgit (MYR), and our primary user base consists of players located across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam.

By creating an Account on Gerbang88, depositing funds, or otherwise using the Platform's services, you acknowledge that you have read and understood this Policy in full and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must discontinue use of the Platform immediately.

This Policy should be read in conjunction with our Terms & Conditions, which form a separate part of the legal framework governing your use of Gerbang88.

For the purpose of this Policy, the following terms shall carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living natural person, directly or indirectly — including but not limited to name, email address, date of birth, national identity number, phone number, IP address, device identifiers, and transaction records.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, Gerbang88.
• "Data Processor" means any third party that processes Personal Data on behalf of Gerbang88 under contractual instruction.
• "Player" / "User" means any natural person who registers an Account and accesses the Platform's services.
• "KYC Data" means identity and address verification documents submitted by a Player as part of the Know Your Customer verification process, including MyKad, passport, driving licence, and proof of address documentation.
• "Consent" means a freely given, specific, informed, and unambiguous indication by the Player that they agree to the processing of their Personal Data for a stated purpose.

3.1 Gerbang88 acts as the Data Controller in respect of all Personal Data collected from Players through the Platform. As Data Controller, Gerbang88 is responsible for ensuring that Personal Data is processed in accordance with this Policy and applicable data protection standards.

3.2 Where Gerbang88 engages third-party Data Processors — such as payment gateway providers, identity verification services, or customer support software providers — those processors are bound by written data processing agreements that require them to handle your data only in accordance with our documented instructions and to maintain appropriate security measures.

Gerbang88 collects Personal Data across several categories, as set out in the table below. We apply a data minimisation principle — we collect only the data that is genuinely necessary for the purposes described in Section 6.

Gerbang88 collects Personal Data through the following channels:

• 5.1 Direct submission — when you complete the Account registration form, submit KYC documents, contact customer support, or update your account profile.
• 5.2 Automated collection — through server logs, session cookies, and analytics tools when you access and interact with the Platform. This includes IP addresses, device identifiers, and behavioural data relating to game play and navigation patterns.
• 5.3 Payment processors — when you initiate a deposit or withdrawal via Malaysian payment services including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online Banking, or Hong Leong Connect. We receive confirmation data including transaction reference numbers and payment method type — we do not receive or store full bank account numbers or e-wallet credentials.
• 5.4 Identity verification services — when KYC documents are submitted and checked against third-party verification systems for authentication and fraud prevention purposes.
• 5.5 Third-party analytics providers — anonymised and aggregated usage data may be collected through analytics tools help us understand how the Platform is used and where improvements can be made.

Gerbang88 processes your Personal Data for the following documented purposes:

• 6.1 Account creation and management — to register, verify, maintain, and where necessary close your Gerbang88 Account.
• 6.2 Identity verification (KYC) — to confirm your identity and age (21+) as required for responsible gambling compliance and regulatory purposes.
• 6.3 Payment processing — to facilitate deposits and withdrawals in MYR through your chosen Malaysian payment method, and to maintain accurate transaction records.
• 6.4 Fraud and money laundering prevention — to monitor account activity for indicators of fraud, bonus abuse, multi-accounting, and other prohibited conduct described in our Terms & Conditions.
• 6.5 Customer support — to respond to your queries, complaints, and account-related requests via live chat and email.
• 6.6 Responsible gambling compliance — to manage deposit limits, self-exclusion lists, session controls, and age gate enforcement.
• 6.7 Platform improvement — to analyse aggregated and anonymised usage patterns to improve Platform features, game selection, and payment flows.
• 6.8 Legal and regulatory compliance — to respond to lawful requests from regulatory bodies, law enforcement agencies, or courts of competent jurisdiction.
• 6.9 Promotional communications — where you have opted in to receive promotional emails or notifications, to communicate bonus offers, game updates, and platform news. You may withdraw this consent at any time by contacting support.

Gerbang88 processes Personal Data under one or more of the following legal bases:

• 7.1 Contractual necessity — processing is required to perform the Account registration agreement and to deliver the gaming and payment services you have requested. Without this processing, your Account cannot function.
• 7.2 Legal obligation — processing is necessary to comply with applicable anti-money laundering (AML) requirements, age verification obligations, and lawful requests from regulatory and law enforcement authorities.
• 7.3 Legitimate interests — processing for the purposes of fraud detection, platform security, responsible gambling monitoring, and aggregated analytics — where those interests are not overridden by your fundamental privacy rights.
• 7.4 Consent — for optional processing activities such as marketing communications and the use of non-essential cookies, where we have obtained your freely given, informed, and specific consent prior to commencing processing.

8.1 Gerbang88 does not sell, rent, or trade your Personal Data to third-party advertisers or data brokers under any circumstances.

8.2 We may share your Personal Data with the following categories of third party, strictly on a need-to-know basis and subject to equivalent data protection obligations:

• Payment processors: Malaysian payment service providers (including but not limited to DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong) — for the purpose of processing your transactions. These providers receive only the transaction data necessary to execute and confirm your payment.
• Identity verification providers: Third-party KYC and AML screening services used to authenticate your identity documents and check your name against regulatory watchlists.
• Customer support platforms: Software providers that support our live chat and email support infrastructure, who process support conversation data on our behalf.
• Analytics providers: Aggregated and anonymised usage data may be processed by analytics tools to assist with Platform development. No individually identifying data is transmitted to analytics providers.
• Regulatory authorities and law enforcement: Where required by law, court order, or regulatory direction — Gerbang88 will disclose Personal Data to competent authorities without prior notice to the Player where legally required to do so.

8.3 All third-party Data Processors with whom Gerbang88 shares Personal Data are required under contract to: (a) process data only for the documented purpose; (b) maintain appropriate technical and organisational security measures; (c) not transfer data to sub-processors without Gerbang88's prior written consent; and (d) cooperate with data subject access requests within applicable timelines.

9.1 Gerbang88 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations.

The following general retention periods apply:

9.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in manner that renders it impossible to re-identify. Where deletion is not immediately possible due to backup system constraints, data is quarantined and excluded from active processing until secure deletion can be completed.

10.1 Gerbang88 implements a layered set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS / SSL): All data transmitted between your device and the Gerbang88 Platform is encrypted in transit using 256-bit SSL encryption.
• Encryption at rest: Sensitive data fields — including identity document data and financial records — are encrypted in our database using industry-standard encryption algorithms.
• Access controls: Access to player Personal Data within Gerbang88's internal systems is restricted on a strict need-to-know basis, enforced through role-based access control (RBAC) and audit logging.
• Two-factor authentication: Internal administrative access to player data systems requires multi-factor authentication. Players are also offered two-factor authentication on their Accounts.
• Penetration testing and vulnerability management: The Platform is subject to periodic security assessments by qualified third-party security professionals.
• Incident response: Gerbang88 maintains a documented data breach response procedure. In the event of a material personal data breach, affected Players will be notified without undue delay where required by applicable law.

11.1 Gerbang88 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files placed on your device when you access the Platform.

11.2 We use the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function — including session management, login authentication, and security tokens. These cannot be disabled without affecting core functionality.
• Functional cookies: Used to remember your preferences (such as language and display settings) to personalise your experience.
• Analytics cookies: Used to collect anonymised data about how the Platform is used — page visits, session duration, and feature interactions — to help us identify improvements. No individually identifying data is transmitted.
• Security cookies: Used to detect and prevent fraudulent activity, including bot detection and session hijacking protection.

11.3 You can manage your cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, but may affect the availability of certain personalisation features. Please note that strictly necessary and security cookies cannot be disabled via browser settings without affecting Platform functionality.

Subject to applicable law, you hold the following rights in respect of your Personal Data held by Gerbang88. To exercise any of these rights, submit a written request to [email protected]. We will respond within 30 calendar days.

13.1 Gerbang88 is strictly prohibited to persons under the age of 21 years. We do not knowingly collect Personal Data from individuals under the age of 21.

13.2 Age verification is conducted as part of the KYC process. Where Gerbang88 discovers or has reasonable grounds to believe that an Account has been registered by a person under 21 years of age, the Account will be immediately closed, all Personal Data associated with the minor will be deleted to the extent legally permissible, and the matter may be referred to relevant authorities.

13.3 If you are a parent or guardian and believe that a person under 21 in your care has registered an Account with Gerbang88, please contact us immediately at [email protected]. We will investigate and take appropriate action without undue delay.

14.1 Some of Gerbang88's third-party Data Processors may be located outside of Malaysia. Where Personal Data is transferred to processors in countries that do not provide an equivalent level of data protection, Gerbang88 ensures that appropriate safeguards are in place — including standard contractual clauses, binding corporate rules, or other legally recognised transfer mechanisms — prior to any such transfer.

14.2 Gerbang88 does not transfer Personal Data internationally beyond what is strictly necessary for the purposes described in this Policy. Where payment data is transmitted to Malaysian payment service providers (including Touch 'n Go eWallet, DuitNow, FPX, and the major Malaysian banks), that processing occurs within Malaysia and is subject to Malaysian financial services regulations.

15.1 Gerbang88 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or Platform operations. Material changes will be communicated to registered Players via the Platform notification system or by email to the registered Account address.

15.2 The updated Policy will be effective from the date of publication at this URL. Continued use of the Platform following the effective date of any updated Policy constitutes your acceptance of the revised terms.

15.3 We recommend that you review this page periodically to stay informed of how Gerbang88 handles your Personal Data. The version number and effective date at the top of this Policy indicate when it was last updated.

16.1 For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the Gerbang88 privacy team using the details below. All privacy-related correspondence should be directed to the email address below and marked with the subject line "Privacy Request":

16.2 If you are not satisfied with Gerbang88's response to a privacy complaint, you have the right to escalate the matter to the relevant supervisory authority in your jurisdiction. Players in Malaysia may refer data-related grievances to Bank Negara Malaysia (BNM) or other competent Malaysian regulatory bodies as applicable to the nature of the complaint.

16.3 Gerbang88 treats all privacy complaints seriously and will acknowledge receipt of your complaint within 5 business days and provide a substantive response within 30 calendar days of receipt.