City888 Privacy Policy – Full Personal Data Protection for Malaysian Players

The city888 Privacy Policy is a document that transparently explains how our platform manages the personal information collected when you use our services. It covers what data we collect, why we need it, how long we retain it, who can access it, and what rights you have as the owner of that data.

City888 fully complies with Malaysia's Personal Data Protection Act 2010 (PDPA) — the primary legislation governing how organisations in Malaysia handle individuals' personal data. Beyond PDPA, we also follow international industry best practices in data protection to ensure your information always remains safe with City888.

City888 collects personal data in several ways — directly from you during registration or platform use, automatically through tracking technologies, and in some cases from legitimate third-party sources such as identity verification providers. The following are the categories of data we collect:

Identity & Contact Data:

• Full name as shown on your MyKad or Malaysian passport.
• An active Malaysian mobile number used for account verification.
• Email address for account communications and important notifications.
• Date of birth for age eligibility verification (18 years and above).
• Residential address (required for players requesting withdrawals above a certain limit).

Financial & Transaction Data:

• Records of all deposit and withdrawal transactions made via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX (Maybank2u, CIMB Clicks).
• Transaction reference numbers and the timestamp of each payment.
• Details of the payment method used (e-wallet or bank type, but never your e-wallet password or PIN).

Activity & Game Data:

• Records of all betting activity — game type, bet value, outcomes, and session times on the City888 platform.
• Game preferences and usage patterns for service improvement purposes.
• Login and logout history for your City888 account.

Technical Data:

• IP address of the device used to access City888.
• Device type, operating system, and web browser used.
• Cookie and session data generated during use of the platform.

Every piece of data we collect has a clear and legitimate purpose. City888 does not collect data simply because it can — every data element we store serves a specific function in enabling us to provide you with a better and more secure service.

Primary Purposes of Data Use:

• Account Management: Identity information is used to create and manage your City888 account, verify your identity, and ensure account security.
• Payment Processing: Transaction data is used to accurately and securely process deposits and withdrawals via e-wallet and FPX Malaysia.
• Fraud Prevention: Activity patterns and technical data help City888 detect and prevent fraudulent activity, money laundering, and platform abuse.
• Legal Compliance: Certain data must be retained to fulfil legal obligations, including PDPA 2010 and Malaysia's anti-money laundering (AML) regulations.
• Service Improvements: Anonymised usage data is aggregated to understand how players interact with the City888 platform and to improve the user experience.
• Communications: Contact information is used to send important notifications relating to your account, transactions, and security updates — not for promotional purposes without your consent.
• Customer Support: Communication and account activity records enable City888's support team to assist you more efficiently whenever you reach out to us.

City888 will not use your data for purposes beyond those stated above without first obtaining your explicit consent.

This is one of the most common questions from City888 players, and we understand why. Most platforms are not transparent about who they share user data with. To be completely clear: City888 does not sell your personal data to any third party for marketing, advertising, or commercial purposes.

However, there are limited situations where we are required to share certain information:

• Technical Service Providers: Third parties that assist City888 in operating the platform — such as cloud service providers, payment gateways that process Touch 'n Go eWallet or DuitNow transactions, and game providers such as Pragmatic Play or PG Soft. All such providers are bound by strict confidentiality agreements and may only access the data necessary for their specific function.
• Identity Verification: For players who need to undergo KYC (Know Your Customer) verification, identity information may be shared with licensed and certified identity verification service providers.
• Legal Requirement: city888 will disclose required data if directed by a Malaysian court, law enforcement agency, or competent regulatory authority through a valid legal process.
• City888 Rights Protection: In cases where it is necessary to prevent fraud, protect the safety of other players, or enforce city888's Terms and Conditions, relevant information may be shared with the appropriate parties.

City888 continuously invests in cybersecurity infrastructure to protect players' personal data. Security isn't simply a box to tick — it's an ongoing process that demands constant monitoring, updating, and improvement.

Technical Measures We Employ:

• 256-bit SSL Encryption: All data transmitted between your device and City888's servers is encrypted using TLS 1.3 with AES-256 encryption — the same standard used by Malaysia's leading banking institutions.
• Secure Password Storage: City888 account passwords are never stored in plain text — they are stored as one-way hashes using an irreversible algorithm.
• Two-Factor Authentication (2FA): City888 supports two-factor authentication for player accounts, adding an extra layer of security to the login process.
• Continuous Monitoring: City888's cybersecurity team monitors systems 24/7 to detect any unusual activity or intrusion attempts.
• Periodic Audits: City888's security infrastructure is regularly audited by qualified independent parties to identify and address any potential vulnerabilities.
• Internal Access Controls: Access to players' personal data within city888 is strictly limited to staff who require it for their specific duties only — the "least privilege" principle, consistently applied.

While we take every reasonable precaution, no security system can be guaranteed 100% safe from all threats. In the unlikely event of a security breach affecting your data, City888 is committed to notifying you within the timeframe required under Malaysia's PDPA 2010.

City888 uses cookies and similar tracking technologies to keep the platform running properly and to understand how players use our services. Cookies are small text files stored on your device when you visit a website — they do not contain viruses and cannot access other files on your device.

Types of Cookies We Use:

• Essential Cookies: Required for the city888 platform to function at a basic level — including maintaining your login session, saving language preferences, and ensuring session security. These cookies cannot be disabled without affecting core platform functionality.
• Performance Cookies: Collects information about how city888 pages are used — which pages are visited most frequently, how long players spend in each section, and any error messages that appear. All information is collected anonymously and used solely to improve the platform.
• Functional Cookies: Saves your preferences such as language, preferred betting limits, and display settings so you don't have to reconfigure them every time you log in to City888.

You can manage or delete cookies through your web browser settings at any time. Please note that disabling certain cookies may affect your experience on the City888 platform.

The Personal Data Protection Act 2010 (PDPA) of Malaysia grants you certain rights regarding your personal data held by city888. We fully respect these rights and provide straightforward ways for you to exercise them:

• Right of Access: You have the right to request a copy of all personal data city888 holds about you. We will process data access requests within 21 business days.
• Right to Rectification: If any of your personal data held by City888 is inaccurate or outdated, you have the right to request immediate correction.
• Right to Deletion: Under certain circumstances, you may request that city888 delete your personal data. However, some data may need to be retained to fulfil legal obligations or audit requirements.
• Right to Withdraw Consent: If the processing of your data is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the validity of any processing that took place prior to the withdrawal.
• Right to Object: You may object to the processing of your data for specific purposes, such as direct marketing communications.
• Data Portability Rights: You may request your data in a machine-readable format for transfer to another platform if you close your city888 account.

To exercise any of the rights above, contact us at support@city888.online, stating the right you wish to exercise and the information needed to verify your identity. City888 is committed to responding to all data rights requests within the timeframe set out by PDPA 2010.

City888 retains your personal data only for as long as necessary for the purposes set out in this policy, or as required by applicable Malaysian law. The following are the data retention guidelines we follow:

• Active Account Data: For as long as your City888 account is active and you continue to use the platform, your account data will be retained and kept up to date.
• Data After Account Closure: After a City888 account is closed, basic identity data and transaction records are retained for a minimum of 7 years to meet Malaysian legal compliance and financial audit requirements.
• Technical Data & Logs: Access logs and technical data are retained for 90 days for security purposes and technical troubleshooting.
• Customer Support Records: Customer support correspondence and interaction records are retained for 3 years for reference and service improvement purposes.
• Cookie Data: Session cookies are deleted automatically when you close your browser. Persistent cookies have a set expiry period of between 30 days and 12 months, depending on the type.

When data is no longer needed and there is no legal obligation to retain it, City888 will securely delete or anonymise that data using procedures that ensure it cannot be recovered.

The technology landscape and privacy law environment are constantly evolving. City888 may need to update this Privacy Policy from time to time to reflect changes in our practices, the technologies we use, or applicable legal requirements.

When we make significant changes to this policy — such as altering the purposes for which data is used, adding new categories of data collected, or changing how we share data — we will:

• Updating the "Updated" date at the top of this document.
• Sending email notifications to all active City888 members at least 14 days before changes take effect.
• Displaying clear notices on the City888 platform during the transition period.

For minor changes that do not materially affect your rights or privacy — such as spelling corrections or clarifications of language — we may update this policy without specific advance notice. We encourage you to review this page periodically.

Continued use of the City888 platform after a policy change takes effect will be considered acceptance of the updated policy. If you do not agree with the changes, you may close your City888 account and request data deletion in accordance with the procedures set out in Section 07.

If you have any questions, concerns, or complaints about how City888 handles your personal data, we strongly encourage you to reach out to us directly. We would much rather resolve any issues with you directly than have you escalate to an external authority.

Contact the city888 Data Protection Team via:

• Email: support@city888.online — please include "Privacy Policy Enquiry" in your email subject line to ensure it reaches the right team. We aim to respond within 48 hours for all privacy-related enquiries.
• Live Chat: Available directly on the city888 platform — average response time under 3 minutes, 24/7. Best for quick, straightforward enquiries.

For formal requests relating to data rights (access, correction, deletion), please submit via email with your full name and City888 account number to facilitate identity verification. All requests will be processed within the timeframe stipulated by Malaysia's PDPA 2010.