Privacy Policy

This Privacy Policy ("Policy") sets out how Citi88 ("the Platform", "we", "us", "our") collects, processes, stores, shares, and protects the personal data of individuals ("you", "User", "Player") who access or use the website at citi88.cam and all associated services.

Citi88 operates as an online gaming platform serving Malaysian players and other users in permitted jurisdictions with live casino games, sports betting, slots, esports wagering, and related financial services. The protection of your personal data is a core operational commitment, not an afterthought. We handle personal information responsibly, transparently, and in accordance with internationally recognised data protection principles.

By registering an account on Citi88, accessing the Platform, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and that you consent to the collection and processing of your personal data as described herein.

In this Policy, the following terms carry the meanings set out below unless the context otherwise requires:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, email address, phone number, payment details, device identifiers, and browsing behaviour on the Platform.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, disclosure, transmission, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is Citi88.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller under a binding contractual arrangement.
• "KYC Data" — documentation collected during the Know Your Customer identity verification process, including government-issued identification, proof of address, and source-of-funds evidence.
• "Cookies" — small text files placed on your device by a website to store information about your session, preferences, and browsing behaviour.
• "Sensitive Data" — a sub-category of personal data that warrants heightened protection, including financial account details, identity document numbers, and data revealing health or vulnerability status (e.g., responsible gambling self-declarations).

Citi88 acts as the Data Controller in relation to all personal data collected through the Platform at citi88.cam. As Data Controller, Citi88 determines the purposes for which personal data is collected and the manner in which that data is processed.

Citi88 operates under international online gaming licensing. While no Malaysian-specific data protection legislation is directly cited as the governing framework for this Policy, Citi88 applies data protection principles consistent with widely recognised international standards, including principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, and integrity.

For any data protection enquiries or to exercise your rights as described in this Policy, please contact our Data Protection point of contact using the details provided in Section 16 (Contact Us).

Citi88 collects personal data through several channels depending on how you interact with the Platform. The categories of personal data we may collect include:

We do not collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health data) except where you voluntarily disclose health-related information in the context of a responsible gambling self-declaration, in which case such data is processed solely for the purpose of providing appropriate player protection support.

Citi88 processes your personal data on one or more of the following legal bases depending on the specific processing activity:

• Contractual Necessity: Processing required to perform the contract between Citi88 and the User — including account registration, processing deposits and withdrawals, and delivering gaming services.
• Legal Obligation: Processing required to comply with applicable legal and regulatory obligations, including anti-money laundering (AML) requirements, Know Your Customer (KYC) verification, and age verification mandates.
• Legitimate Interests: Processing where Citi88 has a legitimate business interest that is not overridden by your fundamental rights — including fraud prevention, platform security, analytics to improve the user experience, and responsible gambling monitoring.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for non-essential cookies, marketing communications, and optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Citi88 uses the personal data we collect for the following purposes:

• Account Management: Creating and maintaining your registered account; verifying your identity; processing login authentication and two-factor authentication requests.
• Transaction Processing: Processing deposits via DuitNow, FPX (Maybank, CIMB, Public Bank, Hong Leong), Touch 'n Go eWallet, Boost, GrabPay, and USDT; processing withdrawal requests; maintaining transaction records.
• Regulatory Compliance: Completing KYC verification; fulfilling AML monitoring obligations; responding to regulatory requests or court orders from competent authorities.
• Security & Fraud Prevention: Detecting and investigating suspicious account activity, bonus abuse, multi-accounting, and other prohibited conduct; protecting the integrity of the Platform.
• Customer Support: Responding to support enquiries submitted via live chat, email, or WhatsApp; resolving account disputes; documenting support interactions.
• Responsible Gambling: Monitoring gameplay patterns to identify indicators of problem gambling behaviour; administering deposit limits, loss limits, self-exclusion, and cool-off periods; connecting at-risk players with appropriate support resources.
• Platform Improvement: Analysing aggregate usage data to improve game selection, navigation, performance, and user experience across Malaysian and other markets.
• Communications: Sending transactional communications (account notifications, payment confirmations, security alerts); sending promotional communications where you have provided consent or where permitted under applicable law.

Citi88 does not sell, rent, or trade your personal data to third parties. We may disclose personal data to the following categories of recipients only where necessary and under appropriate data protection safeguards:

• Payment Service Providers: Financial institutions and payment processors that facilitate your deposit and withdrawal transactions — including Malaysian e-wallet operators, banks (Maybank, CIMB, Public Bank, Hong Leong), DuitNow/FPX infrastructure providers, and cryptocurrency payment processors. These processors operate under binding data processor agreements.
• KYC & Identity Verification Providers: Third-party identity verification services that assist with MyKad and passport validation, biometric checks, and document authentication as required for KYC compliance.
• Game Studio Partners: Game content providers may receive anonymised session data necessary to deliver game functionality. These parties do not receive personally identifiable information beyond what is technically necessary for game delivery.
• Fraud Prevention & Security Services: Third-party services that assist in detecting fraud, money laundering, multi-accounting, and other security threats to the Platform.
• Regulatory & Legal Authorities: Competent governmental, judicial, or regulatory bodies where disclosure is required by applicable law, court order, or to protect the legal rights of Citi88 or its users.
• Professional Advisers: Legal counsel, auditors, and accountants where necessary for the conduct of legitimate business activities, subject to professional confidentiality obligations.

All third parties receiving personal data from Citi88 are required to process such data only for the specific purposes for which it was shared, and to maintain appropriate technical and organisational security measures.

Citi88 uses cookies and similar tracking technologies on the Platform to ensure proper functionality, analyse usage patterns, and maintain platform security. The following categories of cookies are used:

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary or security cookies may prevent you from using certain features of the Platform, including secure login and payment processing. Instructions for managing cookies are available in the help documentation of all major browsers.

Citi88 implements technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or app and Citi88's servers is protected by industry-standard encryption — the same level used by major Malaysian banking institutions including Maybank and CIMB.
• Data at Rest Encryption: Personal data stored in Citi88's database systems is encrypted at rest using AES-256 encryption.
• Access Controls: Personal data is accessible only to Citi88 personnel who require it to perform their job functions. Access is granted on a need-to-know basis and is logged for audit purposes.
• Two-Factor Authentication: Players are encouraged to enable 2FA on their accounts. Citi88 internal staff with access to personal data are required to use 2FA.
• Regular Security Audits: The Platform undergoes periodic security assessments, penetration testing, and vulnerability scanning to identify and remediate potential weaknesses.
• Incident Response: In the event of a data breach that is likely to affect your rights, Citi88 will notify affected users without undue delay, providing details of what occurred and the steps taken in response.

Whilst Citi88 takes all reasonable steps to protect your personal data, no system is entirely immune from risk. You are responsible for maintaining the security of your own account credentials and for notifying us promptly if you suspect unauthorised access to your account.

Citi88 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods generally apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following permanent account closure, as required for AML compliance and potential dispute resolution.
• KYC Documentation: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later.
• Transaction Records: Financial transaction records retained for seven (7) years for accounting and regulatory compliance purposes.
• Technical and Usage Data: Retained in aggregated or anonymised form for up to two (2) years for analytics purposes. Personally identifiable technical data is retained for up to twelve (12) months.
• Customer Support Communications: Support transcripts and correspondence retained for three (3) years for quality assurance and dispute resolution purposes.
• Responsible Gambling Data: Self-exclusion records and responsible gambling disclosures retained for the duration of any self-exclusion period plus three (3) years thereafter.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in a manner that prevents reconstruction of identifiable information.

Subject to applicable law and certain exceptions, you have the following rights in relation to the personal data Citi88 holds about you. To exercise any of these rights, please contact us using the details in Section 16.

Citi88 operates globally and may transfer your personal data to servers or service providers located outside of Malaysia. Where such transfers occur, Citi88 implements appropriate safeguards to ensure your data receives a comparable level of protection to that which it receives within Malaysia, including:

• Contractual data transfer agreements that impose equivalent data protection obligations on recipient organisations.
• Transfers to jurisdictions that provide adequate data protection standards under internationally recognised frameworks.
• Technical security measures (encryption, access controls) applied to data in transit across international networks.

Payment processing data shared with Malaysian payment service providers (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong) is processed within Malaysia and is subject to the data protection policies of those respective providers.

The Citi88 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Age verification is a mandatory step in our KYC process and is enforced before any withdrawal is permitted.

If Citi88 becomes aware that personal data has been collected from a person under the age of 21 without verifiable parental consent, we will take immediate steps to delete that data and close the associated account. Any balance in such an account will be subject to investigation prior to any refund determination.

The Citi88 Platform may contain references to third-party services such as payment processors, identity verification providers, and responsible gambling support organisations. This Privacy Policy applies solely to the data collected and processed by Citi88 directly.

Citi88 is not responsible for the privacy practices of third-party services. Where you interact with a third-party service accessed through or in connection with the Platform, you should review that party's privacy policy independently to understand how your data is handled.

Citi88 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page indicates when the Policy was most recently revised.

Where material changes are made to this Policy — changes that affect your rights or significantly alter how we handle your data — Citi88 will provide notice through one or more of the following channels: email to your registered address, in-Platform notification, or a prominent notice on the homepage.

Your continued use of the Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of and consent to the updated terms. If you do not agree to any updated version of this Policy, you should cease using the Platform and may request account closure.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how Citi88 handles your personal data, please contact us through any of the following channels:

• Email: [email protected] — please include "Privacy Policy Enquiry" or "Data Rights Request" in the subject line. We respond within 4 business hours for general enquiries and within 30 days for formal data rights requests.
• Live Chat: Available 24/7 on the Platform — average response time under 5 minutes. Suitable for general privacy questions and informal data correction requests.
• WhatsApp: Available in English, Bahasa Melayu, and Chinese — 24 hours a day, 7 days a week, including Malaysian public holidays.

For formal data rights requests (access, erasure, portability), please contact us via email for a secure, documented interaction. We will verify your identity before processing any request to protect your data from unauthorised disclosure.

Effective Date: 1 January 2026  |  Version: 2.0  |  Platform: citi88.cam