Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how city888 ("city888", "we", "us", "our"), the operator of the online gambling platform accessible at https://city888.buzz (the "Platform"), collects, processes, stores, discloses, and protects the personal data of individuals who access or use our Platform ("User", "you", "your").

city888 is committed to protecting your privacy and handling your personal data with transparency, integrity, and respect. We process personal data in accordance with applicable data protection principles and take all reasonable technical and organisational measures to ensure your data is kept secure.

By registering an account with city888, accessing the Platform, or submitting any personal information to us, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree with the terms of this Policy, you must not access or use the Platform.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — Any information relating to an identified or identifiable natural person. This includes your name, email address, identification number, IP address, device identifiers, and transaction history.
• "Processing" — Any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transmission, or deletion.
• "Data Controller" — city888, the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — Any third party engaged by city888 to process Personal Data on our behalf (e.g., payment processors, cloud hosting providers, fraud detection services).
• "Consent" — A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.
• "KYC Data" — Identity and address verification documents submitted by a User in compliance with city888's Know Your Customer requirements.
• "Cookies" — Small text files placed on your device by the Platform to enable certain functionalities and collect analytical data.
• "Sensitive Data" — A subset of Personal Data warranting heightened protection, including financial information, government-issued identity documents, and biometric data.

3 Personal Data We Collect

city888 collects personal data through several channels, including your account registration, ongoing use of the Platform, customer support interactions, and automatic technical data collection. The categories of data we collect are set out below.

3.1 Registration & Account Data

When you create a city888 account, we collect the following information:

• Full legal name (as it appears on your government-issued identity document)
• Date of birth (for age verification — minimum age 21 years)
• Residential address (including city and postcode — Malaysian addresses accepted)
• Email address
• Contact telephone number
• Chosen username and encrypted password
• Preferred language and currency (MYR as default for Malaysian players)

3.2 KYC Verification Data

To comply with anti-money laundering (AML) regulations and to verify your identity before processing withdrawals, city888 may collect:

• Copy of a valid Malaysian government-issued identity document (MyKad, Driver's Licence, or Passport)
• Proof of residential address (utility bill, bank statement, or official correspondence dated within three months)
• Selfie photograph holding your identity document
• Payment method verification documents (where applicable)

3.3 Financial & Transaction Data

city888 records all financial transactions associated with your account, including:

• Deposit and withdrawal amounts and timestamps
• Payment method details (partial account or card numbers, e-wallet identifiers for Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong)
• Betting history and wagering activity
• Bonus and promotional credit records
• Account balance history

3.4 Technical & Usage Data

When you access the Platform, city888 automatically collects certain technical information, including:

3.5 Communications Data

When you contact city888 via live chat, email, or any other support channel, we collect and retain records of those communications, including the content of messages, timestamps, and resolution outcomes.

4 Legal Basis for Processing

city888 processes your personal data on one or more of the following legal grounds:

• Contractual Necessity: Processing necessary for the performance of the contract between you and city888 — including account management, processing deposits and withdrawals, and providing access to Platform services.
• Legal Obligation: Processing required to comply with applicable legal requirements, including Anti-Money Laundering (AML) regulations, Know Your Customer (KYC) obligations, and financial record-keeping requirements.
• Legitimate Interests: Processing necessary for city888's legitimate business interests where those interests are not overridden by your fundamental rights — including fraud prevention, security monitoring, and Platform improvement analytics.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for direct marketing communications. You may withdraw consent at any time without affecting prior processing.

5 How We Use Your Personal Data

city888 uses your personal data for the following purposes:

5.1 Account Operations

• Creating, verifying, and managing your city888 account
• Processing deposits and withdrawals via your chosen payment methods (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, BTC/USDT)
• Providing access to all Platform features including sports betting, live casino, slots, and live football
• Administering bonuses, promotions, and the VIP Loyalty Programme

5.2 Compliance & Legal Obligations

• Verifying your age and identity to comply with minimum age (21+) requirements
• Conducting ongoing AML monitoring and transaction screening
• Reporting to competent authorities where required by applicable law
• Maintaining financial records in accordance with applicable regulations

5.3 Security & Fraud Prevention

• Detecting, investigating, and preventing fraudulent transactions and prohibited conduct
• Monitoring account activity for signs of problem gambling and applying responsible gambling interventions where appropriate
• Protecting the integrity of the Platform against hacking, bots, and abuse

5.4 Platform Improvement

• Analysing aggregate, anonymised usage data to improve Platform features and user experience
• Conducting internal research and analytics on betting patterns (on an anonymised basis)
• Testing and debugging new features before release

5.5 Marketing Communications

With your consent, city888 may send you promotional emails, in-Platform notifications, or SMS messages about offers, bonuses, and new features. You may opt out of these communications at any time by updating your account notification settings or contacting [email protected]. Opting out of marketing will not affect your ability to receive service-critical notifications (e.g., withdrawal confirmations, security alerts, KYC requests).

6 Data Sharing & Disclosure

city888 does not sell, rent, or trade your personal data to unaffiliated third parties for their own independent marketing or commercial purposes. We may, however, share your personal data with the following categories of recipients under the conditions stated:

• Payment Processors: We share transaction data with payment service providers necessary to process deposits and withdrawals (e.g., DuitNow operators, FPX gateways, e-wallet providers, cryptocurrency exchange services). These providers receive only the data strictly necessary to complete the transaction.
• KYC & Identity Verification Services: We may use third-party identity verification providers to assist with the KYC process. These providers act as data processors under our instruction and are contractually bound to maintain the confidentiality of your data.
• Fraud Detection & Security Providers: We use specialist third-party services to detect suspicious activity, prevent fraud, and ensure Platform integrity. These providers process technical and behavioural data on our behalf.
• Cloud Infrastructure Providers: Platform data is hosted on secure third-party cloud infrastructure. These providers have no independent right to access or use your personal data beyond providing hosting services.
• Regulatory & Law Enforcement Authorities: city888 will disclose personal data to competent regulatory authorities, law enforcement agencies, or courts of law where required by applicable law, a valid court order, or to protect the rights and safety of city888, its employees, or its users.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or substantially all of city888's assets, your personal data may be transferred to the acquiring entity, subject to that entity honouring the commitments of this Privacy Policy.

7 Data Security

city888 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and city888 servers is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Data Encryption at Rest: Sensitive personal data stored in city888 databases — including financial records and KYC documents — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is strictly limited to city888 employees and authorised contractors who require it to perform their job functions. All access is logged and subject to regular review.
• Two-Factor Authentication: city888 strongly recommends that all users enable two-factor authentication (2FA) on their accounts. This provides an additional layer of protection against unauthorised access.
• Regular Security Audits: city888 conducts periodic internal and third-party security assessments of its Platform and data processing infrastructure.
• Incident Response: city888 maintains a documented data breach response procedure. In the event of a data breach that is likely to result in a risk to your rights, city888 will notify affected users without undue delay.

Notwithstanding these measures, no data transmission over the internet or electronic storage system is 100% secure. You use the Platform at your own risk, and you are responsible for maintaining the security of your own account credentials.

8 Cookies & Tracking Technologies

The city888 Platform uses cookies and similar tracking technologies (including local storage and session tokens) to operate the Platform and provide certain features. The following types of cookies are used:

city888 does not use third-party advertising cookies or allow ad networks to place tracking cookies on the Platform. You may manage cookie settings through your browser preferences; however, disabling essential cookies will impair your ability to use the Platform.

9 Data Retention

city888 retains personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following retention periods apply:

• Account Data: Retained for the duration of your account's active status, plus a period of five (5) years following permanent account closure, in compliance with financial record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission, as required by applicable AML regulations.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Customer Support Communications: Retained for three (3) years from the date of the last interaction, unless the subject matter requires longer retention (e.g., dispute records).
• Technical & Log Data: Retained for up to twelve (12) months for security and fraud analysis purposes, after which it is anonymised or deleted.
• Marketing Data: Retained until you withdraw consent or opt out of marketing communications, after which it is promptly deleted.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with city888's data deletion procedures.

10 Your Rights

Subject to applicable law, you have the following rights with respect to the personal data city888 holds about you. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within 30 days.

11 Protection of Minors

The city888 Platform is strictly intended for adults aged 21 years and above. city888 does not knowingly collect personal data from individuals under 21 years of age. Age verification is conducted during the KYC process for all registered members.

If city888 becomes aware that it has inadvertently collected personal data from a person under 21, we will immediately:

• Suspend the associated account pending investigation;
• Delete all personal data collected from or related to the underage individual, except where retention is required by applicable law; and
• Refund any deposits made to the account via the original payment method.

12 International Data Transfers

city888 operates primarily from Malaysia and processes the majority of user data within the country. Where personal data is transferred to, or processed in, jurisdictions outside Malaysia — for example, by cloud infrastructure providers or international payment processors — city888 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that described in this Policy.

Such safeguards may include contractual data processing agreements with transferee parties, standard contractual clauses, or transfers to jurisdictions recognised as providing an adequate level of data protection. By using the Platform and providing your personal data, you consent to such transfers where they are necessary for the performance of the contract between you and city888.

13 Third-Party Services & Links

The city888 Platform may contain references to, or integrations with, third-party services including payment gateways (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong) and game content providers. These third parties have their own privacy policies which govern the processing of any data you provide directly to them.

city888 is not responsible for the privacy practices or content of third-party services accessed via or in connection with the Platform. We recommend that you review the privacy policies of any third-party services you interact with through the Platform.

14 Changes to This Privacy Policy

city888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. The date of the most recent revision is displayed at the top of this page.

Where changes are material — for example, where we introduce a new purpose for processing your data — city888 will notify registered users by email or by displaying a prominent notice on the Platform prior to the changes taking effect. Your continued use of the Platform after a revised Policy takes effect constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically to stay informed about how city888 protects your personal data.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by city888, please contact us using the following details:

• Email: [email protected]
• Subject Line for Data Requests: "Data Rights Request" or "Privacy Enquiry"
• Live Chat: Available 24 hours a day, 7 days a week via the Platform
• Support Hours: 9:00 AM – 11:00 PM MYT (UTC+8) for customer service team responses

city888 aims to respond to all data-related enquiries within 30 calendar days of receipt. For complex requests, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.