Privacy Policy — cita888

Introduction

This Privacy Policy ("Policy") describes how cita888 ("we", "us", "our", "the Company") collects, processes, stores, and protects personal data relating to individuals ("you", "your", "the User") who access or use the cita888 online gaming platform at https://cita888.cam ("the Platform").

cita888 is committed to safeguarding your privacy and handling your personal data in a transparent, fair, and lawful manner. This Policy is designed to help you understand precisely what information we hold about you, why we hold it, how we use it, and what choices and rights you have in relation to it.

By registering an account on the Platform or continuing to use our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the data practices described herein, you must cease using the Platform immediately.

We may update this Policy from time to time. The "Last Updated" date at the top of this document reflects when the most recent version was published. Your continued use of the Platform following any update constitutes acceptance of the revised Policy.

Definitions

For the purpose of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information that relates to an identified or identifiable natural person, including name, identification number, contact details, financial information, and online identifiers.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" means cita888, the entity that determines the purposes and means of processing your personal data.
• "Data Processor" means any third party that processes personal data on behalf of cita888 under contractual instruction.
• "KYC" means Know Your Customer — the identity and age verification process required for account activation and withdrawal processing.
• "Cookie" means a small data file placed on your device by the Platform to enable certain functionality and personalisation features.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.

Data We Collect

cita888 collects personal data from you through several means, including information you provide directly during registration, data generated through your use of the Platform, and information received from third-party payment and verification providers. The categories of personal data we collect are as follows:

We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs, political opinions, health data, or biometric data beyond what is necessary for identity verification purposes under our KYC obligations.

Legal Basis for Processing

cita888 processes your personal data on the following legal grounds, depending on the type of data and the purpose for which it is processed:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you as an account holder — including account creation, KYC verification, deposit and withdrawal processing, and customer support.
• Legal Obligation: Processing required to comply with applicable anti-money laundering regulations, age verification requirements, licensing obligations, and law enforcement requests.
• Legitimate Interests: Processing carried out in the legitimate business interests of cita888 — such as fraud detection, platform security monitoring, and service improvement analytics — where these interests are not overridden by your data protection rights.
• Consent: Processing carried out on the basis of your explicit consent, such as the use of non-essential cookies or receipt of marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

How We Use Your Data

cita888 uses your personal data only for specific, clearly stated purposes. We do not use your data in ways that are incompatible with the purpose for which it was originally collected. Our primary uses are:

5.1 Account Management

Your identity and contact data are used to create and manage your player account, authenticate your login, and communicate important account-related information such as security alerts, deposit confirmations, and withdrawal processing updates.

5.2 KYC & Age Verification

We use identity documents and KYC data to verify that you are aged 21 or above and that you are who you claim to be. This is a regulatory obligation for all online gaming operators. Failure to complete KYC will result in withdrawal restrictions being applied to your account.

5.3 Payment Processing

Financial data is used to process deposits and withdrawals via your chosen payment method (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, or supported cryptocurrency). Transaction records are retained for audit and regulatory compliance purposes.

5.4 Fraud Prevention & Security

Technical and gameplay data are analysed to detect and prevent fraudulent activity, bonus abuse, money laundering, account takeover attempts, and other violations of our Terms and Conditions. This processing is carried out in the legitimate interests of cita888 and our player community.

5.5 Customer Support

Communications data is used to provide effective customer support across our 24/7 live chat channel and email. Support interaction records are retained for quality assurance and dispute resolution purposes.

5.6 Platform Improvement

Aggregated and anonymised technical and gameplay data is used to analyse platform performance, identify areas for improvement, and develop new features and game offerings that better serve our Malaysian player base.

5.7 Responsible Gambling Monitoring

Gameplay and transaction data is monitored to identify patterns that may indicate problem gambling behaviour. Where such patterns are identified, our responsible gambling team may make contact to offer support resources. Please refer to our Responsible Gambling page for full details.

5.8 Marketing Communications

With your prior consent, we may use your contact data to send you promotional offers, bonus announcements, and platform news. You may unsubscribe from marketing communications at any time via your account settings or by contacting our support team. Withdrawal of consent for marketing does not affect your account status.

Data Sharing & Disclosure

cita888 does not sell, rent, or trade your personal data to third parties. We may share your data only in the following carefully defined circumstances:

6.1 Service Providers

We engage trusted third-party service providers to assist in operating the Platform. These include KYC verification technology providers, payment gateway operators (including those facilitating DuitNow, FPX, and e-wallet transactions), cloud hosting providers, cybersecurity services, and customer support platforms. These providers process your data solely under our instruction and are contractually bound to protect it.

6.2 Game Studio Partners

To deliver our game library, certain technical gameplay data is transmitted to our licensed international game studio partners. This data is used exclusively for game delivery and session authentication purposes and does not include your identity or financial information beyond what is strictly required.

6.3 Legal & Regulatory Authorities

We may disclose personal data to law enforcement agencies, regulatory bodies, or judicial authorities where we are legally required to do so — for example, in response to a court order, anti-money laundering investigation, or licensing audit. We will notify you of any such disclosure where permitted by law.

6.4 Corporate Transactions

In the event of a merger, acquisition, asset sale, or similar corporate transaction, your personal data may be transferred as part of the transaction. You will be notified of any such change in data controller via the email address registered to your account.

Payment Data Processing

Payment transactions on cita888 are handled through a combination of our internal payment infrastructure and third-party payment gateway providers. The processing of payment data is subject to the following specific provisions:

• Full card numbers, CVV codes, and online banking credentials are never stored on cita888's servers. Such data is transmitted directly to and processed by the relevant payment provider.
• Deposit and withdrawal transaction records — including amounts, timestamps, and payment method type — are retained by cita888 for a minimum of five (5) years for regulatory and audit purposes.
• Payment data is encrypted in transit using TLS 1.2 or higher. At rest, financial records are stored in AES-256 encrypted database environments.
• cita888 complies with applicable Payment Card Industry Data Security Standards (PCI-DSS) where relevant to our payment processing activities.
• Transactions involving Malaysian Ringgit (MYR) via FPX, DuitNow, and domestic bank transfers comply with Bank Negara Malaysia's applicable payment system guidelines.

Cookies & Tracking Technologies

cita888 uses cookies and similar tracking technologies to improve your experience on the Platform, maintain your session, and gather analytics data. The types of cookies we use are as follows:

• Essential Cookies: Required for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without affecting core platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings, last game played, and notification preferences. These enhance your experience but are not strictly necessary.
• Analytics Cookies: Used to collect aggregated data about how players use the Platform — including pages visited, session duration, and features used. This data is anonymised and used solely for platform improvement purposes.
• Marketing Cookies: Used only with your prior consent to deliver relevant promotional content on the Platform. You may withdraw consent for marketing cookies at any time via your account settings.

Most modern browsers allow you to control cookie settings, including blocking or deleting cookies. Please note that disabling essential cookies may prevent you from logging in or using core platform features. For full cookie management guidance, consult your browser's help documentation.

Data Retention

cita888 retains personal data only for as long as is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law. Our general retention schedules are as follows:

• Active Account Data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, in compliance with anti-money laundering and gaming licence record-keeping requirements.
• KYC Documentation: Retained for a minimum of five (5) years after the conclusion of the business relationship, as required by applicable regulations.
• Transaction Records: Retained for a minimum of five (5) years for financial audit and regulatory compliance purposes.
• Support Communications: Retained for up to three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Analytics Data: Aggregated, anonymised analytics data may be retained indefinitely as it cannot be used to identify individual players.
• Marketing Consent Records: Retained for as long as the consent is active, plus one (1) year following withdrawal of consent.

Following the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

Data Security

cita888 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the cita888 Platform is encrypted using industry-standard TLS 1.2 or higher protocols.
• AES-256 Encryption at Rest: Stored personal and financial data is encrypted using AES-256 encryption on all production database environments.
• Access Controls: Strict role-based access controls limit internal access to personal data to authorised personnel only, on a need-to-know basis.
• Penetration Testing: The Platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities before they can be exploited.
• Incident Response: We maintain a documented data breach response protocol. In the event of a significant data breach affecting your personal data, we will notify affected players and relevant authorities in accordance with applicable legal requirements.
• Staff Training: All cita888 employees with access to personal data receive regular data protection and security awareness training.

Your Rights

As a player on the cita888 Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, contact our support team via live chat or at [email protected]. We will respond to all valid requests within 30 days.

Minors & Age Gating

cita888 is strictly an adult platform intended for players aged 21 years and above. We do not knowingly collect, process, or store personal data belonging to individuals under the age of 21.

Age verification is conducted as a mandatory step in our KYC process. Where we discover — through our verification procedures or any other means — that an account has been created by a person under the age of 21, we will immediately:

• Suspend the account and cease processing any further data from that account;
• Securely delete all personal data associated with the underage user, subject to any mandatory legal record-keeping obligations;
• Return any deposited funds to the originating payment method, net of any applicable processing fees, in accordance with our Terms and Conditions.

International Data Transfers

As an online platform serving players across Malaysia and operating with international licensed game studio partners and service providers, some of your personal data may be transferred to and processed in countries outside of Malaysia. These may include jurisdictions in Europe, Southeast Asia, and other regions where our service providers operate.

When we transfer personal data internationally, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection standards. These safeguards include:

• Contractual data processing agreements with all third-party processors that include provisions equivalent to applicable data protection standards;
• Transfers to countries that have been recognised as providing an adequate level of data protection;
• Implementation of technical security measures (encryption, access controls) regardless of the jurisdiction in which processing occurs.

By using the cita888 Platform, you acknowledge and consent to the transfer of your personal data to the jurisdictions described above for the purposes set out in this Policy.

Policy Amendments

cita888 reserves the right to update or modify this Privacy Policy at any time. When we make changes, we will update the "Last Updated" date at the top of this page. For significant changes that materially affect your rights or how we handle your personal data, we will endeavour to provide prominent notice on the Platform and, where appropriate, notify you via your registered email address.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated Policy, you should cease using the Platform and may request account closure by contacting our support team.

We recommend that you review this Policy periodically to stay informed of any updates to our data practices.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact cita888's privacy team through any of the following channels:

• 24/7 Live Chat: Available directly on the cita888 Platform — the fastest way to reach our team for any privacy-related query, with typical response times under 3 minutes.
• Email: [email protected] — for formal data subject access requests, deletion requests, or written privacy enquiries. We aim to respond to all written requests within 30 days.

When submitting a data access or deletion request, please provide your registered username or account email address and a brief description of your request. We may need to verify your identity before processing certain types of requests to prevent unauthorised access to your data.

For further information about the Platform's legal framework, please refer to our Terms & Conditions. For information about responsible gambling tools and support resources, please visit our Responsible Gambling page. For answers to common questions, see our FAQ.