Privacy Policy City88 – Malaysia Member Data Protection

01 Scope of This Privacy Policy

This Privacy Policy applies to all users and members who access the City88 platform via the city88.vin website, the City88 mobile app for Android and iOS, and any other digital services operated under the City88 brand.

This document explains in detail how city88, as the responsible data controller, handles your personal information. This includes the types of data we collect, why we need it, how long we retain it, and who it may be shared with in limited and controlled circumstances.

This Privacy Policy does not apply to third-party websites or services that may be linked through our platform. We encourage you to read the privacy policy of any third party you visit separately.

02 Types of Personal Data We Collect

City88 collects the personal data necessary for platform operations, legal compliance, and improving the user experience. The following are the categories of data we collect:

Identification Data:

• Full name as stated on your official identification document.
• Malaysian Identity Card number (MyKad) or passport number.
• Date of birth for age verification.
• Gender and nationality.

Contact Data:

• A valid and active email address.
• Malaysian mobile phone number.
• Current residential address.

Financial Data:

• Bank account number and bank name for withdrawal purposes.
• E-wallet details such as Touch 'n Go eWallet or GrabPay.
• Records of deposit and withdrawal history on the platform.

Technical & Usage Data:

• IP address and device information used to access the platform.
• Web browser type, operating system and screen resolution.
• Activity log data including the date, time, and duration of gaming sessions.
• Records of games played and bets placed.

03 How We Collect Data

City88 collects your personal data through the following key channels:

• Account Registration: When you complete the registration form on the City88 platform, you directly provide us with your identification and contact information.
• KYC Verification: During the Know Your Customer process, you upload official identification documents containing personal data for the purpose of identity verification.
• Financial Transactions: Every time you make a deposit or withdrawal, our system records the transaction details including the payment method used.
• Platform Usage: Technical data is automatically collected when you use our platform, including gaming activity and session logs.
• Support Communication: When you contact the City88 customer support team via Live Chat or other channels, records of that communication are retained for service quality purposes.
• Cookies and Tracking Technologies: Our platform uses cookies and similar technologies to collect usage data that helps us streamline your experience.

04 Purpose of Personal Data Use

City88 uses the personal data collected for the following purposes, which are lawful and operationally necessary:

City88 will not use your data for any purposes not stated here without obtaining your prior consent, unless required by law or a valid court order.

05 Data Sharing With Third Parties

City88 does not sell, rent, or disclose your personal data to third parties for commercial purposes. However, in the course of operating the platform, we may share data in the following limited and controlled situations:

• Payment Service Providers: Required transaction information is shared with payment processors such as FPX, Touch 'n Go eWallet and GrabPay to enable deposits and withdrawals to be processed securely.
• Game Software Providers: Minimum technical data required to operate the games is shared with third-party game providers integrated with the city88 platform.
• Identity Verification Services: Identification data is shared with certified KYC service providers for the purpose of member identity verification.
• Relevant Authorities: City88 will disclose required information to legal authorities, enforcement agencies, or regulatory bodies when mandated by law or a valid court order.
• Professional Advisors: Lawyers, accountants, or auditors bound by professional confidentiality obligations may access certain data within the scope of their professional engagement.

All third parties receiving data from city88 are required to handle that information in accordance with data protection standards equivalent to or higher than those we adhere to.

06 Data Security Measures

City88 implements multiple layers of technical and organisational security controls to protect your personal data from unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All communications between your device and city88 servers are secured with TLS 1.3 encryption and a valid 256-bit SSL certificate.
• Encryption at Rest: Sensitive data such as passwords and financial information is encrypted using the latest encryption algorithms when stored in our database.
• Strict Access Controls: Access to member data is restricted to authorised personnel only, following the principle of least privilege. All access is logged and regularly monitored.
• Two-Factor Authentication: city88's internal systems are protected with multi-factor authentication to prevent unauthorised access.
• Vulnerability Scanning: The city88 platform undergoes regular security testing and vulnerability scanning by both our internal security team and independent security auditors.
• Data Backup: Member data is regularly backed up to a separate, secure location to ensure rapid data recovery in the event of a system failure.

While city88 takes all reasonable steps to protect your data, no security system can offer absolute guarantees. We encourage you to take protective measures as well, such as using a strong password and never sharing your login credentials with anyone.

07 Data Retention Period

City88 retains your personal data only for as long as necessary to fulfil the original purpose of collection or as required by applicable law. The following are our retention period guidelines:

• Active Account Data: Retained for the duration your account is active on the city88 platform and for seven years after account closure to meet legal compliance requirements.
• Financial Transaction Records: Retained for a minimum of seven years in accordance with anti-money laundering and financial reporting legal requirements.
• KYC Documents: Retained for a minimum of five years after the business relationship ends, or longer if required by regulatory authorities.
• Technical Logs: Retained for 12 months for security purposes, technical troubleshooting and internal audits.
• Support Communication Records: Retained for two years from the date of last interaction for service quality purposes.
• Marketing Data: Retained until you withdraw consent or request deletion, with a maximum of three years from the date consent was given.

When data is no longer needed, City88 will delete or anonymise it using secure procedures to ensure it cannot be recovered.

08 Your Rights Regarding Personal Data

As a data subject, you hold the following rights regarding your personal information held by city88:

• Right of Access: You may request a copy of the personal data we hold about you at any time.
• Right to Rectification: If your data is inaccurate or incomplete, you have the right to request immediate correction.
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. Such requests are subject to our legal obligations to retain certain data.
• Right to Restriction of Processing: You may request that we restrict the processing of your data in certain situations, such as when the accuracy of the data is in dispute.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to Data Portability: You may request your data in a machine-readable format to transfer it to another service provider.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the validity of processing carried out before the withdrawal.

To exercise any of the above rights, please contact the city88 customer support team via Live Chat within the platform. We will process your request within 30 days of receipt.

09 Cookies & Tracking Technologies

The city88 platform uses cookies and similar tracking technologies to enhance the user experience, maintain session security, and analyse platform usage patterns. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login verification and session security. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects information on how you use the platform to help us identify technical issues and improve performance.
• Functional Cookies: Stores your preferences such as language and display settings to deliver a more personalised experience.
• Analytics Cookies: Helps us understand overall platform usage patterns in aggregate and anonymised form for product development purposes.

You can manage or disable cookies through your web browser settings. However, disabling essential cookies may affect the functionality of the City88 platform and your ability to access certain services. Cookies typically expire automatically or are deleted when you close your browser, depending on the cookie type.

10 Third-Party Links & Services

The city88 platform may contain references to third-party services such as game providers, payment processors, and other technology providers integrated with our platform. It is important that you understand the following:

• Each third party integrated with city88 has its own privacy policy governing how they handle data.
• City88 is not responsible for the privacy practices of third parties operating under their own policies.
• We only share the minimum necessary data with third parties and ensure every share is protected by appropriate contractual agreements.
• We encourage you to read and understand the privacy policies of relevant third-party service providers when using their services.

City88 conducts thorough assessments of all third-party partners before integrating them with our platform to ensure they meet the required data protection standards.

11 Children's Privacy

The city88 platform is strictly for individuals aged 18 and above. city88 does not knowingly collect personal data from individuals under the age of 18. All account registrations require age verification through a stringent KYC process.

Should city88 discover that personal data has been inadvertently collected from a minor, we will take immediate action to delete that data and close the relevant account. If you believe your child has registered on the city88 platform without your knowledge, please contact our support team immediately.

12 Amendments to This Privacy Policy

City88 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. Members will be notified of any amendments via an in-platform notice.

When we make material changes to this Privacy Policy, we will update the "Last Updated" date at the top of this document. Your continued use of the City88 platform after the changes take effect constitutes acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. If you disagree with any changes, you may choose to close your account in accordance with the procedures set out in our Terms and Conditions.

13 How to Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding this Privacy Policy or how city88 handles your personal data, we encourage you to reach out to us through the following channels:

• Live Chat: The fastest channel — available directly within the city88 platform for immediate responses.
• Support Email: [email protected] — for detailed inquiries or matters requiring documentation.

Our privacy team will endeavour to respond to all enquiries within three business days. For more complex data rights requests, we will notify you within that period of the expected time required to fulfil your request, with a maximum of 30 days from the date of receipt.