Privacy Policy cita88 — Personal Data Protection for Malaysian Players

01 Information We Collect

Cita88 collects various types of personal information based on platform operational requirements and legal compliance. We adhere to the principle of minimum collection — only data that is strictly necessary is collected.

Registration & Identity Information:

• Full name as stated on your Malaysian identity card (MyKad)
• Identity card or passport number
• Date of birth for age verification (18 years and above)
• Active email address for account communications
• Mobile phone number for two-factor authentication (2FA)
• Current residential address for KYC purposes

Financial & Transaction Information:

• Bank account or eWallet number for deposit and withdrawal processing
• Transaction history including deposits, withdrawals, and wagering
• Debit card details if the relevant payment method is used

Technical & Usage Information:

• IP address, browser type and operating system of your device
• Cookie information and session identifiers
• Game activity logs and login records
• General geolocation data for regional restriction compliance

All data collection is conducted lawfully with your explicit consent at the point of registration. You have the right to withdraw this consent at any time, although doing so may affect your ability to use certain platform features.

02 How We Use Your Data

Every piece of information collected by cita88 is used for specific and legitimate purposes. We will not use your data for any other purpose without first obtaining your renewed consent.

03 Data Sharing & Disclosure

Cita88 does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, in certain limited situations, data may be shared with the following parties:

• Registered Payment Providers: Transaction information that must be shared with FPX, Maybank, CIMB, Touch 'n Go eWallet, and other payment providers solely to process your financial transactions.
• Game Providers: Minimum data required to operate casino or slot games powered by third-party providers we work with, subject to strict confidentiality agreements.
• Regulatory Authority: cita88 fully complies with lawful requests from Malaysian government authorities, financial intelligence units, and regulatory bodies where required by law.
• Technical Service Providers: Hosting companies, cloud service providers, and IT partners that help us operate the platform — all bound by strict data processing agreements.

All data sharing is conducted strictly on a "need-to-know" basis — recipients only receive the data they need to carry out their specific tasks, nothing more.

04 Cookies & Tracking Technology

Cita88 uses cookies and similar tracking technologies to enhance the user experience and ensure platform security. The cookies we use fall into several categories:

• Essential Cookies: These cookies are required for the platform's core operations, including login authentication, session management, and security functions. They cannot be disabled without affecting platform functionality.
• Performance Cookies: Helps us understand how players interact with the platform so we can make continuous improvements. This data is collected in aggregate and cannot be used to identify individuals.
• Functional Cookies: Remembers your preferences such as language, time zone, and display settings to provide a more personalised experience.
• Marketing Cookies: Used to display relevant offers and promotions based on your interests. You may decline these cookies without affecting the core functionality of the platform.

You can manage your cookie settings through your browser settings at any time. Please note that disabling certain cookies may affect specific features on the cita88 platform. Session cookies are automatically deleted when you close your browser, while persistent cookies have expiry periods as stated in their respective cookie settings.

05 Data Security & Storage

Cita88 invests seriously in security infrastructure to ensure your personal data is always protected. The technical and organisational security measures we implement include:

• 256-bit SSL/TLS end-to-end encryption for all data communications between users and servers
• Password storage using one-way hashing algorithms that cannot be decrypted
• Two-factor authentication (2FA) available and encouraged for all player accounts
• Continuous 24/7 intrusion detection and security monitoring
• Isolation of sensitive data environments from public systems using multi-layered firewalls
• Periodic data backups across multiple data centers to ensure service continuity
• Mandatory security training for all staff with access to user data
• Internal data access auditing with tamper-proof logs

Data Retention Period: Active account data is retained for as long as your account remains active. Following account closure, financial data and KYC records are retained for 7 years in accordance with Malaysian anti-money laundering (AMLA) legal requirements. Data that is no longer required will be securely deleted or anonymised.

06 Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act (PDPA) 2010, you have the following rights regarding the personal data we hold:

• Right of Access: You have the right to obtain a copy of all personal data we hold about you. Requests will be processed within 21 business days.
• Right to Rectification: If any of your data is inaccurate or outdated, you have the right to request an immediate correction. We will process your request within 14 business days.
• Right to Erasure: You may request the deletion of your personal data, subject to applicable legal retention requirements. Data deletion will be carried out within 30 business days.
• Right to Withdraw Consent: You may withdraw consent for data processing at any time. Withdrawal does not affect the validity of any processing that took place prior to your request.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes. cita88 will cease such processing immediately upon receiving your request.
• Right to Data Portability: You may request that your data be delivered to you in a machine-readable format for transfer to another platform.

To exercise any of the above rights, please contact our data protection team at [email protected] with the subject line "PDPA Rights Request". Please include proof of identity for verification purposes. All requests will be acknowledged within 3 business days.

07 Policy Amendments & Contact Us

Cita88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in law, technology, or our business practices. Any material amendments will be communicated to you via:

• Notice displayed on the cita88 homepage at least 14 days before taking effect
• Notification email sent to your registered email address
• In-account notification upon your next login

Continued use of the platform after an amendment's effective date constitutes your acceptance of the updated policy. If you do not agree with any changes, you may close your account before the effective date.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer (DPO):

• Email: [email protected]
• Live Chat: Available 24/7 via the cita88 platform
• Response Time: Within 3 business days for all privacy inquiries