Privacy Policy — Cita88

This Privacy Policy ("Policy") is issued by Cita88 ("Cita88", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at https://cita88.cam (the "Platform"). This Policy describes how we collect, use, disclose, store, and protect personal data relating to individuals who visit, register, or use our Platform ("you", "Member", "User").

Cita88 operates primarily for the benefit of users in Malaysia, including players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and across Peninsular and East Malaysia. Our Platform is designed to serve Malaysian residents and transactions are conducted in Malaysian Ringgit (MYR). Accordingly, the data practices described in this Policy are shaped by the needs of our Malaysian user base and the requirements of applicable data protection frameworks.

By registering an account, making a deposit, placing a wager, or accessing any feature of the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the Platform.

For the purposes of this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including names, identification numbers, contact details, financial data, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, recording, organisation, storage, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this context, Cita88.
• "Data Processor" means any third party that processes personal data on behalf of Cita88 under written instruction.
• "KYC" means Know Your Customer — identity verification procedures required of Members prior to processing withdrawals.
• "Cookies" means small text files placed on your device by the Platform to enable certain functional, analytical, and marketing features.
• "AML" means Anti-Money Laundering — regulatory requirements governing the detection and prevention of financial crime.

Cita88 acts as the Data Controller in respect of personal data collected from Members and visitors to the Platform. As Data Controller, Cita88 determines the purposes for which personal data is collected and the means by which it is processed.

Where Cita88 engages third-party service providers (such as payment processors, identity verification partners, or analytics providers) to process personal data on its behalf, those parties act as Data Processors and are contractually bound to process personal data only in accordance with Cita88's written instructions and applicable data protection law.

For all data protection enquiries, requests to exercise your rights, or privacy-related complaints, you may contact Cita88 using the details provided in Section 16 of this Policy.

The personal data we collect about you falls into the following categories, depending on your interaction with the Platform:

Cita88 collects personal data through the following means:

5.1 Direct Collection

• Registration forms completed when you create a Cita88 account;
• KYC verification submissions (ID document uploads, selfies, proof of address);
• Deposit and withdrawal requests, including payment method details;
• Communications you initiate with our support team via live chat, WhatsApp, or email;
• Responses to surveys, promotions, or feedback requests.

5.2 Automated Collection

• Technical data collected automatically as you browse and use the Platform, including IP address, device identifiers, and session data;
• Cookies and similar tracking technologies deployed to enable essential Platform functionality, analyse usage patterns, and support responsible gambling monitoring;
• Game and betting logs generated automatically as a result of your gaming activity.

5.3 Third-Party Sources

• Identity verification and fraud prevention providers who cross-reference the information you provide against public and proprietary databases;
• Payment processors (such as FPX, DuitNow, Touch 'n Go eWallet, Boost, and bank gateways) who confirm transaction status and payment method ownership.

Cita88 processes your personal data for the following purposes, each of which is underpinned by a lawful basis:

1. Account management and service delivery — To create and maintain your account, process deposits in MYR, facilitate withdrawals, and provide the gaming services you have requested. Legal basis: performance of a contract.
2. Identity and age verification (KYC) — To verify that you are at least 21 years of age and to confirm your identity prior to processing withdrawals, in accordance with our regulatory obligations. Legal basis: legal obligation and legitimate interests.
3. Anti-money laundering (AML) and fraud prevention — To detect, investigate, and prevent financial crime, suspicious transaction patterns, and fraudulent activity on the Platform. Legal basis: legal obligation.
4. Customer support — To respond to your enquiries and resolve complaints submitted via live chat, email, or other channels. Legal basis: performance of a contract and legitimate interests.
5. Responsible gambling monitoring — To identify and respond to indicators of problem gambling behaviour and to administer responsible gambling tools (deposit limits, self-exclusion, cooling-off periods). Legal basis: legal obligation and legitimate interests.
6. Platform improvement and analytics — To understand how Members use the Platform, identify technical issues, and improve game performance, navigation, and user experience. Legal basis: legitimate interests.
7. Marketing communications — To send you promotional offers and bonus notifications where you have consented to receive such communications. Legal basis: consent (which may be withdrawn at any time).
8. Legal compliance — To comply with applicable laws, respond to court orders, and cooperate with regulatory authorities or law enforcement agencies as required. Legal basis: legal obligation.

Cita88 does not sell your personal data to third parties. We may, however, share your data with the following categories of recipients where it is necessary, proportionate, and lawful to do so:

• Payment Processors — Including FPX network providers, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency network processors, solely to facilitate your deposit and withdrawal transactions;
• Identity Verification Providers — Third-party KYC and AML compliance vendors who verify the authenticity of identity documents and screen against sanctions and politically exposed persons (PEP) lists;
• Technology and Infrastructure Providers — Cloud hosting providers, cybersecurity firms, and software vendors that provide the technical infrastructure on which the Platform operates, under strict data processing agreements;
• Regulatory Authorities and Law Enforcement — Government bodies, financial intelligence units, and law enforcement agencies where we are legally required or compelled by a court order to disclose information;
• Professional Advisers — Lawyers, auditors, and compliance consultants engaged to advise Cita88, who are bound by confidentiality obligations;
• Business Successors — In the event of a merger, acquisition, or sale of all or part of Cita88's business, personal data may be transferred to the successor entity subject to equivalent privacy protections.

In all cases where personal data is shared with third parties acting as Data Processors, Cita88 requires those parties to implement appropriate technical and organisational security measures and to process data only for the purposes instructed by Cita88.

Some of Cita88's service providers and technology infrastructure partners may be located outside Malaysia. Where personal data is transferred to jurisdictions that do not have data protection laws equivalent to those applicable in Malaysia, Cita88 will implement appropriate safeguards to ensure the protection of your personal data. These safeguards may include standard contractual clauses, data processing agreements, or other legally recognised mechanisms.

By using the Platform, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia where it is necessary for the purposes described in this Policy.

Cita88 retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law. The following general retention principles apply:

• Active account data — Retained for the duration of your membership with Cita88;
• KYC and identity verification records — Retained for a minimum of five (5) years following account closure, as required by AML regulations;
• Transaction and financial records — Retained for a minimum of five (5) years to satisfy AML and financial record-keeping obligations;
• Support correspondence — Retained for three (3) years from the date of last interaction, to support dispute resolution;
• Gaming and wagering history — Retained for a minimum of three (3) years following account closure;
• Marketing consent records — Retained until you withdraw consent or request erasure, whichever occurs first.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with our data destruction procedures. Where data is anonymised rather than deleted, it may be retained and used for statistical and analytical purposes without restriction.

The Platform uses cookies and similar tracking technologies to ensure its correct operation, analyse usage patterns, and deliver a personalised experience. The following categories of cookies are used:

10.1 Strictly Necessary Cookies

These cookies are essential to the functioning of the Platform. They enable core features such as account login sessions, security functions, and game loading. These cookies cannot be disabled without materially impairing the Platform's functionality.

10.2 Functional Cookies

These cookies remember your preferences (such as language settings and notification preferences) and personalise your experience without tracking your activity across external websites.

10.3 Analytical Cookies

We use analytical cookies and similar tools to understand how Members navigate and use the Platform, which pages are visited most frequently, and where technical errors occur. This data is used in aggregate and anonymised form to improve Platform performance and user experience.

10.4 Responsible Gambling Monitoring

Certain session data and behavioural metrics are collected to support our responsible gambling obligations, including detection of extended play sessions and identification of patterns associated with problem gambling risk.

You may adjust cookie preferences through your browser settings. Disabling certain cookies may affect your ability to use some features of the Platform. Please note that deleting cookies does not constitute a withdrawal of consent to data processing where we have another lawful basis for that processing.

Subject to applicable law and certain limitations, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact our data protection team using the contact details in Section 16.

Cita88 will respond to verified rights requests within thirty (30) calendar days. We may require you to confirm your identity before processing any request. In certain cases, legal retention obligations (such as AML requirements) may limit our ability to fulfil erasure requests in full.

The Platform is strictly intended for individuals aged 21 years and above. Cita88 does not knowingly collect or process personal data relating to individuals under the age of 21. The minimum age requirement is enforced through our KYC identity verification process, which requires all Members to submit a government-issued photo ID confirming they meet the minimum age threshold.

If Cita88 becomes aware that personal data has been collected from an individual who was under 21 at the time of collection, we will take prompt steps to delete that data and close the associated account. If you are a parent or guardian who believes your child has registered on the Platform, please contact us immediately using the details in Section 16 so that we can investigate and take appropriate action.

Cita88 takes the security of your personal data seriously and implements a range of technical and organisational measures designed to protect it against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmissions between your device and our servers;
• Encryption of personal and financial data at rest using industry-standard cryptographic algorithms;
• Strict role-based access controls ensuring that only authorised personnel can access personal data;
• Regular penetration testing and vulnerability assessments of Platform infrastructure;
• Multi-factor authentication requirements for internal systems that process personal data;
• Documented incident response procedures enabling rapid detection, containment, and notification of data security incidents.

Notwithstanding these measures, no system is completely impenetrable. In the event of a data security incident that is likely to result in a high risk to your rights and freedoms, Cita88 will notify you and, where required, the relevant supervisory authority, in accordance with applicable law.

You are responsible for maintaining the security of your account credentials. Do not share your password with any third party. Cita88 will never ask you to disclose your password via chat, email, or any other channel.

The Platform may contain references to or integration with third-party payment services (such as the Touch 'n Go eWallet app, Boost, or your Maybank online banking portal). When you are redirected to a third-party service to complete a transaction, you are subject to that service's own privacy policy and terms of use. Cita88 has no control over and accepts no responsibility for the data practices of third-party services.

We encourage you to review the privacy policies of any third-party service you interact with in connection with your use of Cita88, particularly your payment provider, before providing personal data to that service.

Cita88 reserves the right to update or revise this Privacy Policy at any time in response to changes in applicable law, our data processing activities, or our business operations. When material changes are made, we will notify registered Members by email or by a prominent notice on the Platform prior to the changes taking effect.

The most current version of this Policy will always be available at https://cita88.cam/privacy-policy, together with the effective date of the current version. Your continued use of the Platform following the publication of a revised Policy constitutes your acceptance of the updated terms. If you do not agree with any revision, you must discontinue use of the Platform and contact us to close your account.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a privacy concern, please contact our team through the following channels. We are committed to responding to all privacy-related enquiries promptly and in confidence.

• Live Chat — Available 24/7 on the Platform. For data rights requests, please state "Data Rights Request" at the start of your chat. Supported in English, Bahasa Melayu, and Mandarin.
• Email — [email protected] (plain text — not a clickable link). For formal data rights requests, complaints, or any matter requiring a written record.
• Response Time — We aim to acknowledge all privacy-related enquiries within 48 hours and to provide a full substantive response within thirty (30) calendar days, or such shorter period as required by applicable law.

Our team serves Members across all of Malaysia — from Kuala Lumpur and Penang to Johor Bahru, Shah Alam, Petaling Jaya, and beyond — and is committed to handling all privacy matters with professionalism, discretion, and the urgency they deserve.