citi88 Privacy Policy

1 Who We Are / Data Controller

citi88 is the operator of the online casino and sportsbook platform accessible at citi88.app. citi88 acts as the data controller in respect of personal data collected directly through the Platform.

For the purposes of this Privacy Policy, "data controller" means the entity that determines the purposes and means of processing personal data. citi88 is responsible for the personal data it collects and the manner in which it is processed, stored, and shared.

citi88 operates under international gaming licensing. Our data handling practices comply with the data protection requirements imposed by our licensing framework.

2 Personal Data We Collect

citi88 collects personal data through various channels and at different stages of your interaction with the Platform. The categories of personal data collected are described below.

2.1 Registration Data. When you create a citi88 account, we collect:

• Full legal name;
• Date of birth (to verify you are 21 years of age or older);
• Mobile phone number;
• Username and encrypted password;
• Country and state of residence.

2.2 KYC Verification Data. Before processing your first withdrawal, citi88 is required to verify your identity. This involves collecting:

• A copy of a valid government-issued identity document (Malaysian MyKad, passport, or equivalent);
• A selfie or live photograph for identity confirmation, where required;
• Proof of address documentation, in some cases.

2.3 Financial Data. When you make deposits or withdrawals, citi88 collects:

• Payment method identifiers (e.g., the last four digits of a bank account, a Touch n Go eWallet account reference, or similar partial payment identifiers);
• Transaction amounts, dates, and status;
• Bank or payment provider name.

citi88 does not store full payment card numbers or banking credentials on its servers.

2.4 Gameplay & Betting Data. citi88 records all gaming activity on the Platform, including:

• Games played, bets placed, and outcomes;
• Session start and end times;
• Bonus activations and wagering progress;
• Sportsbook bet selections, odds, stakes, and settlement outcomes.

2.5 Technical & Device Data. When you access the citi88 Platform, our systems automatically collect:

• IP address;
• Device type, operating system, and browser;
• Session duration and navigation patterns;
• Referring URL (where applicable).

2.6 Communications Data. If you contact citi88 support, we retain records of:

• Live chat transcripts;
• Email correspondence;
• The nature and resolution of any complaint or query.

3 How We Use Your Personal Data

citi88 uses the personal data described in Section 2 for the following purposes:

• Account creation and management: To register your account, authenticate your identity at login, and manage your account settings;
• Service delivery: To provide access to games, the sportsbook, and all other Platform features;
• Payment processing: To process deposits, withdrawals, and refunds through your selected payment method;
• KYC and age verification: To verify that you meet the 21+ age requirement and satisfy our licensing obligations regarding identity verification;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover, and other prohibited conduct;
• Responsible gaming: To monitor gameplay for signs of problem gambling, apply self-imposed limits, and enforce account restrictions where required;
• Customer support: To respond to queries, resolve disputes, and improve the quality of our support services;
• Regulatory compliance: To comply with obligations imposed by citi88's gaming licence, applicable anti-money laundering laws, and any other applicable regulatory requirements;
• Platform improvement: To analyse usage patterns, diagnose technical issues, and improve the functionality and user experience of the citi88 Platform;
• Marketing communications: To send promotional offers and updates, where you have consented to receive such communications.

4 Legal Bases for Processing

citi88 processes personal data only where a valid legal basis exists. The legal bases applicable to citi88's processing activities are:

• Contractual necessity: Processing required to fulfil our contract with you — including account registration, payment processing, and service delivery;
• Legal obligation: Processing required to comply with KYC, AML, licensing, and other regulatory obligations;
• Legitimate interests: Processing for fraud prevention, platform security, and improving the citi88 Platform, where those interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and optional analytics, where you have provided explicit consent. You may withdraw consent at any time.

5 Data Sharing & Third Parties

5.1 Service Providers. citi88 shares personal data with third-party service providers who process data on our behalf and under our instructions. These include:

• Payment processors and eWallet operators (e.g., Touch n Go, Boost, GrabPay, Maybank, CIMB);
• Game content providers (e.g., Pragmatic Play, PG Soft, Evolution Gaming) — limited to the game session data required to run the games;
• KYC and identity verification service providers;
• Fraud detection and cybersecurity service providers;
• Cloud hosting and infrastructure providers.

All third-party processors are bound by data processing agreements requiring them to maintain data confidentiality and security standards consistent with citi88's own standards.

5.2 Regulatory & Legal Disclosure. citi88 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required by law, a court order, or our licensing obligations. citi88 will notify affected users of such disclosures where legally permitted to do so.

5.3 No Sale of Personal Data. citi88 does not sell, rent, or trade personal data to any third party for their own independent marketing or commercial purposes.

6 Cookies & Tracking Technologies

citi88 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function — including session management, authentication, and security features. These cannot be disabled without affecting Platform functionality;
• Functional cookies: Remember your preferences such as language settings and game lobby display options;
• Analytics cookies: Collect anonymised data about how players navigate the Platform to help us identify areas for improvement. No personally identifiable information is included in analytics data;
• Fraud detection: Device fingerprinting and behavioural analytics used to detect account compromise and fraudulent activity.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to log in or use core Platform features.

7 Data Retention

citi88 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods driven by legal and regulatory obligations:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, as required by anti-money laundering regulations;
• Transaction records: Retained for a minimum of five (5) years for financial compliance and audit purposes;
• Gameplay data: Retained for three (3) years following the relevant game session;
• Support communications: Retained for two (2) years following resolution of the relevant query or complaint;
• Technical/device data: Retained for twelve (12) months for security analysis purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymised. Anonymised data (from which no individual can be identified) may be retained for statistical analysis without time limit.

8 Data Security

citi88 employs a range of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• SSL 256-bit encryption on all data in transit between your device and citi88's servers;
• AES-256 encryption for sensitive data stored at rest;
• Strict access controls — personal data is accessible only to citi88 personnel with a documented and approved business need;
• Multi-factor authentication required for all internal administrative access to production systems;
• Regular independent security audits and penetration testing;
• Incident response procedures for detecting, containing, and notifying data breaches within required timeframes.

Notwithstanding these measures, no internet-based platform can guarantee absolute security. Players are encouraged to use strong, unique passwords for their citi88 Account and to enable two-factor authentication.

9 Your Privacy Rights

Subject to applicable law and our regulatory obligations, you have the following rights in respect of your personal data held by citi88:

• Right of access: You may request a copy of the personal data citi88 holds about you;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data in certain circumstances — note that regulatory retention obligations (Section 7) may limit this right;
• Right to restrict processing: You may request that citi88 restricts its processing of your data in specified circumstances;
• Right to data portability: You may request a structured, machine-readable copy of personal data you have provided to citi88;
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes;
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact citi88 support via live chat or at the email address listed in Section 14. citi88 will respond within 30 days of receiving a valid request. We may need to verify your identity before fulfilling a data rights request.

10 Marketing Communications

citi88 may send you promotional offers, bonus announcements, and Platform updates by SMS or email where you have provided explicit consent to receive such communications during or after registration.

You may opt out of marketing communications at any time by:

• Updating your communication preferences in your citi88 Account settings;
• Contacting citi88 support and requesting removal from marketing lists.

Opting out of marketing communications will not affect transactional or account communications (such as withdrawal confirmation messages, security alerts, or account verification messages), which citi88 is required to send as part of providing its services.

11 Children's Privacy / Age Restriction

The citi88 Platform is strictly restricted to individuals aged 21 years and above. citi88 does not knowingly collect personal data from individuals under 21 years of age. If citi88 becomes aware that personal data has been provided by or on behalf of a person under 21, the relevant account will be immediately suspended, all associated data will be reviewed and deleted where appropriate, and any deposited funds will be returned to the source payment method.

Account holders who become aware that a person under 21 has accessed their citi88 Account should contact support immediately. See our Responsible Gaming page for further guidance on preventing underage access.

12 International Data Transfers

citi88's servers and primary data infrastructure are located in the jurisdiction of our gaming licence. Some personal data may be processed by third-party service providers whose infrastructure is located in other countries. Where personal data is transferred internationally, citi88 ensures that appropriate safeguards are in place — including contractual data protection obligations — to maintain the same level of protection that applies within citi88's primary jurisdiction.

Players in Malaysia should be aware that their personal data may be processed in jurisdictions outside Malaysia. By using the citi88 Platform and accepting this Privacy Policy, you acknowledge and consent to such transfers where necessary for the provision of citi88's services.

13 Changes to This Privacy Policy

citi88 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform functionality. The current version of this Privacy Policy, with its date of last amendment, is always available at citi88.app/privacy-policy.

Material changes — those that significantly affect your rights or how your data is processed — will be notified to registered players via in-account notification or email at least 7 days before the change takes effect. Continued use of the citi88 Platform after a policy update constitutes acceptance of the revised terms.

14 Contact & Data Rights Requests

For all privacy-related queries, data rights requests, or complaints regarding citi88's data handling practices, please contact us through the following channels:

• Live Chat: Available 24/7 on the citi88 Platform. Response within 3 minutes.
• Email: [email protected]

When submitting a data rights request, please include your account username and a clear description of your request so we can process it efficiently. citi88 will respond to all privacy requests within 30 days. Complex requests may require additional time, in which case we will notify you of the extended timeframe.

If you are not satisfied with citi88's response to a privacy complaint, you may escalate the matter to the relevant data protection authority or dispute resolution body under citi88's licensing framework.