Citi88 Privacy Policy – Player Personal Data Protection

To provide a secure, seamless service that meets legal requirements, citi88 collects several categories of personal information from users. We only collect data that is strictly necessary for platform operations and regulatory compliance.

Registration Information

When you register an account, we collect the following information:

• Full name as stated in your official identification document.
• Date of birth for age verification purposes (21 years and above).
• An active and reachable email address.
• A Malaysian mobile number registered in your name.
• Passwords are stored in hashed form — we do not store passwords in plain text.

Identity Verification Information (KYC)

To comply with anti-money laundering legal requirements, we collect:

• A copy of your MyKad, passport, or other valid official identification document.
• Recent proof of address such as a bank statement or utility bill no older than three months.
• Additional financial documents that may be required to verify high-value transactions.

Financial Information

To process deposits and withdrawals, we collect bank account details, e-wallet account numbers (Touch 'n Go, GrabPay), and complete transaction records. Credit or debit card information, where applicable, is processed directly by certified payment providers and is not stored on citi88 servers.

Technical and Usage Information

We also automatically record technical data including IP address, device and browser type, operating system, access date and time, and pages visited within the platform. This data is used solely for security, fraud detection, and user experience improvement purposes.

Citi88 collects personal information through several different channels throughout your use of our platform:

• Directly from you — via the registration form, KYC process, customer support forms, and email communications.
• Automatically — via cookies, server logs, and tracking technologies while you browse the platform.
• From third parties — including certified payment providers, identity verification partners, and fraud prevention agencies we use to verify your information.

The personal data we collect is used exclusively for the following purposes. We do not use your data beyond the stated scope without obtaining your consent first:

The use of data for promotional communications is subject to your consent. You may withdraw this consent at any time by contacting our support team.

Citi88 does not sell your personal data. However, in the course of operating the platform, we may share certain information with selected third parties in the following circumstances:

Authorized Service Providers

We work with third-party providers acting as data processors on our behalf, including payment providers that process deposit and withdrawal transactions, KYC verification partners, cloud service providers for secure data storage, and customer support service providers. All these partners are bound by strict data protection agreements.

Legal Requirement

We are required by law to disclose certain information to authorities upon lawful request, including law enforcement agencies, courts, and financial regulatory bodies. Such disclosures will be made in accordance with proper legal procedures.

The citi88 platform uses cookies and similar tracking technologies to enhance user experience, maintain login sessions, and analyze usage patterns. Cookies are small text files stored in your browser when you visit our platform.

Types of Cookies We Use

• Essential Cookies: Required for core platform operations, including login session management and security. These cookies cannot be disabled.
• Preference Cookies: Saves your language, theme, and display preferences to ensure a more comfortable experience.
• Analytics Cookies: Helps us understand how users interact with the platform so we can make continuous improvements. We use analytics tools that do not identify individuals.
• Marketing Cookies: Used to display relevant promotional information to you. These cookies are only activated with your consent.

You can manage your cookie settings through your browser at any time. Disabling certain cookies may affect some platform features, but core platform functionality will continue to work normally.

The security of your personal data is citi88's highest priority. We implement multiple layers of technical and organizational protection to ensure your data remains safe from unauthorized access, disclosure, or modification at all times.

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption at rest for sensitive information stored in the database.
• Role-based access control — only staff who require access to specific data are granted permission.
• Active 24/7 threat monitoring with advanced intrusion detection systems.
• Regular security audits by independent third parties to identify and address vulnerabilities.
• Two-factor authentication (2FA) is available for all user accounts as an additional security layer.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding your personal data held by citi88. We are committed to respecting and facilitating the exercise of these rights:

Citi88 retains your personal data only for as long as it is needed for the purposes stated in this policy or as required by applicable law. The following are our data retention guidelines:

• Active account data: Retained for the duration your account is active, plus any period required by law after account closure.
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysia's financial legal requirements.
• KYC documents: Retained for 5 years after the business relationship end date.
• Customer support communication logs: Retained for 2 years from the date the ticket is resolved.
• Analytics cookie data: Retained for no more than 13 months from the date of collection.

Once the retention period expires, data will be securely deleted using non-recoverable methods or fully anonymised for aggregate analytics purposes.

The citi88 platform is strictly for individuals aged 21 and above. We do not intentionally collect, store, or process personal data from individuals under the age of 21.

If we discover that personal data of a minor has been collected inadvertently, we will immediately take the following steps:

• Closing the relevant account immediately.
• Deleting all related personal data within 72 hours.
• Returning any deposited funds in accordance with the appropriate procedures.

The citi88 platform may contain links or references to third-party websites or services for general informational purposes. This Privacy Policy applies solely to the citi88 platform and does not cover the privacy practices of any third-party websites.

Citi88 is not responsible for the content, privacy policies, or practices of any such third-party websites. We encourage you to read the privacy policy of every website you visit before providing any personal information to them.

Citi88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in data practices, legal requirements, or new platform features. The latest effective date will always be displayed at the top of this page.

For amendments involving material changes to how we handle your data, we will provide reasonable notice via your registered email or in-platform notification at least 14 days before the changes take effect. Continued use of the platform after that date constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, we are here to listen and assist you.

You can reach our Data Privacy Officer through the following channels:

• Email: [email protected] (please state "Privacy Inquiry" in the email subject line)
• Live Chat: Available 24 hours a day, 7 days a week via the citi88 platform

We are committed to responding to all privacy-related enquiries within 5 business days. For formal requests relating to PDPA rights, the processing period is no more than 21 business days from the date a complete request is received.