🔒 city888 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") is published by city888 ("city888", "we", "us", "our") and applies to all personal data processed in connection with the city888 website (city888.win), the city888 mobile application, and all related services (collectively, the "Services").

city888 is committed to protecting the privacy and personal data of every player who uses our platform. We recognise that Malaysian players entrust us with sensitive personal and financial information, and we take that responsibility seriously. This Policy explains in plain terms what data we collect, why we collect it, who we share it with, and how you can exercise your rights over that data.

This Policy should be read alongside the city888 Terms & Conditions and Responsible Gaming Policy. By creating or using a city888 account, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

2. Data We Collect

city888 collects personal data in the following categories, depending on how you interact with our Services:

city888 does not collect special categories of sensitive personal data (such as racial origin, political opinions, health data, or biometric data) unless specifically required for regulatory compliance, in which case explicit consent will be obtained.

3. How We Use Your Data

city888 uses your personal data for the following purposes:

• Account Management: To create, maintain, and secure your city888 account; to verify your identity and age; to process login and authentication requests.
• Service Delivery: To enable gameplay, process deposits and withdrawals in MYR, settle bets, and deliver all platform features you use.
• Regulatory Compliance: To fulfil our Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations; to respond to lawful requests from regulatory authorities or law enforcement.
• Responsible Gaming: To monitor for indicators of problem gambling, apply responsible gaming restrictions where applicable, and comply with self-exclusion obligations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraud, abuse, unauthorised access, and other prohibited activities on the city888 platform.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance.
• Marketing Communications: To send promotional offers, bonuses, and platform updates to players who have opted in to receive such communications. You may opt out at any time.
• Platform Improvement: To analyse usage patterns and performance data to improve the city888 platform, resolve bugs, and enhance user experience.

4. Legal Basis for Processing

city888 processes your personal data on one or more of the following lawful bases:

• Contract Performance: Processing necessary to fulfil our contractual obligations to you under the city888 Terms & Conditions — including account creation, gameplay, deposits, and withdrawals.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including KYC, AML, and responsible gaming requirements imposed by our licensing authority.
• Legitimate Interests: Processing for fraud detection, platform security, and service improvement, where such processing does not override your fundamental rights and interests.
• Consent: Processing for direct marketing and optional analytics features, where your consent has been explicitly obtained. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing & Disclosure

5.1 Service Providers

city888 shares personal data with carefully selected third-party service providers who process data on our behalf and under our instruction, including: payment processors and eWallet providers (Touch n Go, Boost, Maybank, CIMB, Public Bank), game studio partners, identity verification and KYC service providers, cloud infrastructure and hosting providers, and fraud detection services. All service providers are contractually bound to process data only as instructed by city888 and to maintain appropriate security standards.

5.2 Regulatory & Legal Disclosure

city888 may disclose your personal data to licensing authorities, financial intelligence units, law enforcement agencies, or other regulatory bodies where required by applicable law or where city888 is compelled to do so by a valid legal order.

5.3 No Sale of Data

city888 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes under any circumstances.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of city888's business assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected players will be notified of any such transfer where practicable.

6. Cookies & Tracking Technologies

city888 uses cookies and similar tracking technologies on its website and mobile application. Cookies are small text files stored on your device that help city888 deliver a personalised and secure experience.

6.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for platform functionality including login session management, security tokens, and load balancing. These cannot be disabled without impairing the Services.
• Functional Cookies: Remember your preferences such as language settings, last-played games, and display settings.
• Analytics Cookies: Help city888 understand how players navigate the platform, which features are used most, and where technical errors occur. Data is aggregated and anonymised where possible.
• Marketing Cookies: Used only where you have consented, to deliver relevant city888 promotions. No third-party advertising networks are used to target city888 players.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may prevent certain city888 features from functioning correctly.

7. Data Retention

city888 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by applicable regulations:

• Account and Identity Data: Retained for a minimum of five (5) years following account closure, as required by AML regulations.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction.
• Communications Data: Retained for three (3) years or for the duration required to resolve any open dispute, whichever is longer.
• Technical and Usage Data: Retained for up to two (2) years for platform improvement and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with city888's data destruction procedures.

8. Data Security

city888 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption on all data in transit between your device and city888 servers
• AES-256 encryption for sensitive data stored at rest, including financial records and identity documents
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Multi-factor authentication required for all city888 staff accessing production systems
• Regular penetration testing and vulnerability assessments by independent security auditors
• Dedicated security incident response procedures with defined escalation and notification timelines
• Hashed and salted password storage — city888 employees cannot view your password in any form

Notwithstanding these measures, no data transmission over the internet can be guaranteed as completely secure. city888 strongly recommends that all players enable two-factor authentication on their city888 account and use a strong, unique password not shared with any other service.

9. Your Rights

As a city888 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact city888 at [email protected] with your full name and registered account details:

• Right of Access: You may request a copy of the personal data city888 holds about you and information about how it is processed.
• Right of Rectification: You may request correction of any inaccurate or incomplete personal data held about you.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations.
• Right to Restrict Processing: You may request that city888 restrict the processing of your data in certain circumstances.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you may request a machine-readable copy of your data.
• Right to Object: You may object to processing based on legitimate interests, including profiling. You have an absolute right to object to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

city888 will respond to all data rights requests within thirty (30) days of receipt. In complex cases this may be extended by a further two (2) months, with notice to you of the extension.

10. Children's Privacy

city888 is strictly an adults-only platform. Our Services are not directed at, and are not intended for use by, individuals under the age of 21. city888 does not knowingly collect personal data from anyone under 21 years of age. If you believe that a minor has provided personal data to city888, please contact us immediately at [email protected] and we will take prompt steps to delete such data and close any associated account.

city888 implements age verification procedures during registration to enforce this restriction. Notwithstanding these measures, city888 encourages parents and guardians to maintain appropriate controls over their children's internet usage and to take steps to prevent minors from accessing gambling-related websites.

11. International Data Transfers

city888's primary servers are hosted in data centres that maintain internationally recognised security certifications. In the course of providing the Services, your personal data may be processed by service providers located in jurisdictions outside Malaysia, including game studio partners, payment processors, and cloud infrastructure providers.

Where personal data is transferred internationally, city888 ensures that appropriate safeguards are in place, including contractual data processing agreements incorporating standard clauses consistent with recognised data protection frameworks. city888 will not transfer your personal data to a jurisdiction that does not provide an adequate level of data protection without implementing appropriate compensating safeguards.

12. Changes to This Policy

city888 may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or platform features. Material changes will be communicated to registered players via email or a prominent notice on the city888 platform at least 14 days before the changes take effect, where practicable.

The "Last Updated" date at the top of this page indicates when the most recent revision was published. Your continued use of the city888 Services following publication of an updated Privacy Policy constitutes your acceptance of the changes. We recommend reviewing this Policy periodically.

13. Contact & Complaints

For any privacy-related questions, data rights requests, or complaints, please contact the city888 Data Protection team. We take all privacy concerns seriously and will respond promptly.

If you are not satisfied with city888's response to a privacy complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. city888 will cooperate fully with any such investigation.