cita888 Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") is issued by cita888 ("cita888", "we", "us", "our"), the operator of the online gaming platform at cita888.net ("the Platform"). This Policy describes how cita888 collects, uses, stores, shares, and protects personal data about individuals who register accounts on, access, or otherwise interact with the Platform ("you", "your", "the Player").

cita888 is committed to handling personal data responsibly and in compliance with the privacy obligations imposed by its international gaming licence and applicable data protection principles. This Policy applies to all personal data processed by cita888 in connection with your use of the Platform, including data collected through the website, account registration process, customer support interactions, and transactional records.

By registering an account on the cita888 Platform, you acknowledge that you have read this Privacy Policy and consent to the collection and use of your personal data as described herein. This Policy should be read in conjunction with the Terms & Conditions which govern your use of the Platform.

2. Personal Data We Collect

2.1 Registration and Identity Data

When you create a cita888 account, we collect the following information that you provide directly:

• Full legal name (as it appears on your identity document);
• Date of birth (for age verification purposes — you must be 21 or older);
• Email address;
• Malaysian mobile telephone number;
• Chosen username;
• Residential address.

2.2 KYC Verification Data

To comply with our international gaming licence obligations regarding Know Your Customer ("KYC") verification, we collect and process:

• Copy of Malaysian National Identity Card (MyKad) or valid passport;
• Proof of residential address document (utility bill, bank statement, or official correspondence dated within three months);
• Proof of payment method ownership where required (e.g., screenshot of registered e-wallet or online banking account);
• Where required by enhanced due diligence procedures: source of funds documentation.

2.3 Transactional Data

We automatically record transactional data generated by your use of the Platform, including deposit amounts, withdrawal requests, game session records, bet histories, win/loss records, bonus credits and wagering progress, and payment method identifiers (partial — we do not store full payment credentials).

2.4 Technical and Usage Data

We collect technical data automatically when you access the Platform:

• IP address and derived geographic location;
• Browser type and version;
• Device type, operating system, and screen resolution;
• Pages visited, time spent, and navigation path;
• Session timestamps and duration;
• Referral source (where applicable).

2.5 Communications Data

When you contact cita888 via live chat, email, or any other support channel, we retain records of those communications including the content of messages, timestamps, and any resolutions reached. This data is used for quality assurance, dispute resolution, and to maintain continuity of support service.

3. How We Use Your Personal Data

Purpose	Data Categories Used
Account creation and management	Registration data, identity data
Age and identity verification (KYC)	KYC documents, date of birth, registration data
Processing MYR deposits and withdrawals	Transactional data, payment method identifiers
Fraud detection and prevention	Technical data, transactional data, identity data
Anti-money laundering (AML) compliance	Transactional data, KYC data
Customer support and dispute resolution	Communications data, account data, transactional data
Responsible gaming monitoring and intervention	Usage data, transactional data, account data
Platform security and access control	Technical data, login records
Service improvement and analytics	Usage data, technical data (aggregated/anonymised)
Legal and regulatory compliance	All categories as required by applicable obligations
Marketing communications (with consent only)	Email address, preferences data

cita888 does not use personal data to make fully automated decisions that produce legal or similarly significant effects on players without human review, except where such processing is required for security or fraud prevention and is subject to appropriate safeguards.

4. Legal Basis for Processing

cita888 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the agreement between you and cita888, including account management, game provision, and payment processing;
• Legal obligation: Processing required to comply with our international gaming licence obligations, including KYC verification, AML monitoring, and responsible gaming requirements;
• Legitimate interests: Processing necessary for fraud prevention, platform security, service improvement, and dispute resolution, where those interests are not overridden by your rights;
• Consent: Processing for direct marketing communications, where we have obtained your explicit consent. You may withdraw this consent at any time by updating your communication preferences in account settings or by contacting support.

5. Cookies and Tracking Technologies

The cita888 Platform uses cookies and similar technologies to operate core platform functions, maintain your login session, detect fraud and abuse patterns, and analyse aggregate usage to improve the service. The following categories of cookies are in use:

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled without impacting service availability. They include session management, authentication tokens, and security cookies.
• Functional cookies: Store your preferences such as language settings, display options, and last-visited game sections to improve your experience across sessions.
• Analytics cookies: Collect aggregated and anonymised data about how players interact with the Platform. This data is used to identify usability improvements and measure feature performance. No individual player is identified in analytics reports.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to use the Platform. Disabling functional and analytics cookies will not prevent access but may reduce the quality of your experience.

6. Data Sharing and Third Parties

cita888 does not sell, rent, or trade your personal data to third parties. We share personal data only in the following circumstances and only to the extent strictly necessary for the stated purpose:

• Payment processors: Malaysian payment service providers (including Touch 'n Go eWallet, Boost, Maybank, CIMB, DuitNow, and FPX infrastructure operators) receive transactional data necessary to process your deposits and withdrawals. These processors are bound by their own privacy and security standards and applicable Malaysian financial regulations;
• Game software providers: Game providers whose titles are available on the cita888 Platform receive game session data (bets, outcomes, session duration) for the purposes of game operation, RNG auditing, and jackpot pool management. Personal identity data is not shared with game providers beyond an anonymised player identifier;
• KYC and AML verification services: Third-party identity verification and document authentication services used to fulfil our licence obligations. These services are subject to data processing agreements with cita888 and process data solely for verification purposes;
• Regulatory and law enforcement authorities: Where required by our gaming licence conditions, applicable law, or valid legal process, cita888 may disclose personal data to regulatory bodies or law enforcement agencies. cita888 will notify affected players of such disclosures where permitted by law;
• Professional advisers: Legal, accounting, and compliance advisers engaged by cita888, subject to professional confidentiality obligations.

7. International Data Transfers

cita888 operates under an international gaming licence and its infrastructure, service providers, and data processors may be located outside Malaysia. Where personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that afforded in Malaysia, cita888 implements appropriate safeguards including contractual data protection clauses with the recipient entity. By using the cita888 Platform, you consent to the transfer of your personal data in accordance with this Policy.

8. Data Retention

cita888 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods driven by our legal and regulatory obligations:

• Account and identity data: Retained for the duration of the account relationship and for a minimum of 5 years following account closure, as required by AML and gaming licence record-keeping obligations;
• KYC documents: Retained for a minimum of 5 years following the completion of the business relationship;
• Transactional records: Retained for a minimum of 5 years following each transaction, as required for financial record-keeping and regulatory inspection purposes;
• Communications records: Retained for 3 years following the close of the relevant support case or dispute;
• Technical and usage data: Retained in identifiable form for 12 months; aggregated and anonymised thereafter for analytics purposes with no retention limit.

Where retention beyond these minimum periods is required by specific legal proceedings or regulatory investigation, data will be retained until those proceedings are concluded.

9. Your Data Rights

Subject to applicable law and the limitations arising from our regulatory obligations, you have the following rights in respect of your personal data held by cita888:

• Right of access: You may request a copy of the personal data cita888 holds about you. We will respond within 30 days of a verified request;
• Right of rectification: You may request correction of inaccurate or incomplete personal data. Some data changes (e.g., registered name) may require supporting documentation;
• Right of erasure ("right to be forgotten"): You may request deletion of your personal data in certain circumstances. This right is subject to our legal obligation to retain data for minimum regulatory periods — we cannot delete data we are required by law or licence to retain;
• Right to restrict processing: You may request that we limit processing of your data in specific circumstances, such as while the accuracy of data is under dispute;
• Right to data portability: You may request a structured, machine-readable copy of personal data you have provided to us for portability purposes;
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, contact cita888 via live chat or by emailing [email protected] with your verified account details and a clear description of your request.

10. Security Measures

cita888 implements technical and organisational security measures proportionate to the risk associated with processing your personal data. These measures include: TLS/HTTPS encryption for all data in transit between your device and the Platform; encryption of sensitive personal data at rest; access controls limiting employee access to personal data on a strict need-to-know basis; regular security audits and vulnerability assessments; and incident response procedures for detecting, containing, and notifying of data security incidents.

No data transmission over the internet or electronic storage system can be guaranteed as unconditionally secure. While cita888 takes all reasonable precautions, you acknowledge that data security cannot be guaranteed absolutely. If you become aware of any security vulnerability affecting the Platform, please report it to our support team immediately.

11. Minors

The cita888 Platform is strictly not available to persons under 21 years of age. cita888 does not knowingly collect personal data from individuals under 21. If we become aware that personal data has been collected from a minor, we will immediately close the relevant account, delete the associated data, and reverse any transactions where possible. If you have reason to believe a minor has accessed the Platform using false information, please contact us immediately via live chat or at [email protected].

12. Changes to This Privacy Policy

cita888 may update this Privacy Policy periodically to reflect changes in our data processing practices, operational requirements, or applicable legal obligations. Material changes will be communicated to registered Players by email to the address on file not less than 14 days before the revised Policy takes effect. The revised Policy will be published at cita888.net/privacy-policy with an updated effective date. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

13. Contact and Complaints

For privacy-related enquiries, data access requests, or complaints, contact cita888 via:

• Live Chat: Available 24/7 through the Platform — select "Privacy / Data" as the enquiry category;
• Email: [email protected] — include "Privacy Request" in the subject line along with your registered username.

cita888 aims to acknowledge all privacy-related requests within 5 business days and to resolve them within 30 days. If you are not satisfied with our response to a privacy complaint, you may raise the matter with the dispute resolution mechanism provided by our gaming licence authority, details of which are available upon request.