Privacy Policy cita33 — Player Personal Data Protection

1. Introduction and Scope of Privacy Policy

This Privacy Policy is published by cita33, an online casino platform operating under the domain cita33.bet. This document clearly and transparently explains how we collect, process, use, store and protect your personal data when you visit, register or use any services provided by our platform.

By registering an account on cita33 or continuing to use this platform, you agree to the data collection and usage practices described in this document. If you do not agree with any aspect of this Privacy Policy, you are advised not to use our platform.

2. Personal Data We Collect

Cita33 collects various types of personal data to ensure our services can operate securely, smoothly, and in accordance with legal requirements. The data we collect falls into several main categories:

2.1 Personal Identity Information

• Full name as per official identification documents.
• Date of birth for age verification purposes (minimum 18 years).
• National identity card number (MyKad) or passport number.
• Your full current residential address.
• Nationality and country of residence.

2.2 Contact Information

• An active and valid email address used for official communications.
• Mobile phone number for two-factor authentication (2FA) and account notifications.

2.3 Financial and Transaction Data

• Bank account or e-wallet details (Touch 'n Go, GrabPay, DuitNow) that have been registered.
• Deposit and withdrawal transaction history.
• Records of wagering and gaming activity on the platform.
• Supporting documents for proof of source of funds verification, if required.

2.4 Technical and Usage Data

• Your IP address, browser type and device operating system.
• Login data including the date, time and location of access.
• Device information used to access the platform.
• Cookie data and similar tracking technologies (see Section 8).
• Records of interactions with our customer support team.

3. Purposes of Personal Data Use

Every piece of data we collect is used for a clear and legitimate purpose. Below is a complete list of the purposes for which cita33 uses your personal data:

• Account Registration and Management — Process registration applications, verify identities, and manage player accounts.
• KYC and AML Compliance — Fulfil identity verification (Know Your Customer) and Anti-Money Laundering requirements.
• Transaction Processing — Facilitate deposits, withdrawals, and other financial transactions securely and accurately.
• Platform Security — Detect and prevent fraud, unauthorised access, account abuse, and suspicious activity.
• Customer Service — Provide support, respond to enquiries, and resolve technical or financial issues.
• Experience Personalisation — Personalise content, promotions, and game recommendations based on your preferences and activity history.
• Marketing Communications — Send promotional offers, bonuses, and platform updates (subject to your preferences).
• Legal Compliance — Meet reporting obligations to relevant authorities when required by law.
• Platform Enhancement — Analyse usage patterns to improve platform performance, usability, and overall experience.

4. Legal Basis for Data Processing

Cita33 only processes your personal data on a valid legal basis. Depending on the type of processing involved, the applicable legal bases are as follows:

5. Data Sharing With Third Parties

Cita33 does not sell, rent, or disclose your personal data to third parties for their own commercial purposes. However, there are certain situations where data must be shared with selected third parties to enable us to deliver our services effectively:

5.1 Authorised Service Providers

We work with trusted and certified third-party service providers, including payment gateway providers (FPX, DuitNow, Touch 'n Go, GrabPay), identity verification service providers, secure cloud infrastructure providers, and analytics companies to enhance platform performance. All these providers are bound by strict confidentiality agreements and are only permitted to use your data for purposes we have specified.

5.2 Legal Requirements

Cita33 may be required to disclose your personal data to government authorities, law enforcement bodies, or judicial tribunals when lawfully mandated by applicable law. In such situations, we will disclose only the minimum information required and will endeavour to notify you in advance, unless prohibited by law.

5.3 Business Transfers

If cita33 is involved in any merger, acquisition, or sale of business assets, players' personal data may be transferred as part of that transaction. In such situations, you will be notified in advance and your data will continue to be protected under a privacy policy of equivalent or stricter standards.

6. Cross-Border Data Transfers

In the course of its operations, cita33 may store or process your personal data on servers located outside Malaysia. When this occurs, we ensure that such data transfers are carried out with adequate safeguards, including the use of recognised standard contractual clauses and ensuring that the recipient country maintains an equivalent level of data protection.

We always ensure that any cross-border data transfers comply with applicable privacy legal requirements and that your data consistently receives the same level of protection regardless of the physical location of the servers.

7. Data Retention Period

Cita33 retains your personal data only for as long as necessary to fulfil the original purpose of collection or in accordance with applicable statutory requirements. General data retention guidelines are as follows:

• Active Account Data — Retained for the duration your account is active, plus any additional period required by law following account closure.
• Financial Transaction Records — Retained for a minimum of 7 years from the transaction date in line with financial and tax reporting requirements.
• KYC Documents — Retained for a minimum of 5 years after account closure to meet AML compliance requirements.
• Security Logs — Retained for 2 years for the purpose of security incident investigation if required.
• Support Communications — Retained for 3 years as a record of issue resolution and staff training.

Upon expiry of the designated retention period, your data will be securely deleted or anonymised using methods that ensure the data cannot be recovered.

8. Use of Cookies and Tracking Technologies

The cita33 platform uses cookies and similar tracking technologies to enhance user experience, maintain session security, and enable platform analytics. The types of cookies we use include:

• Essential Cookies — Required for core platform functions such as login authentication, game session management, and security. These cookies cannot be disabled.
• Performance Cookies — Collect information on how you use the platform (pages visited, time spent) to help us improve the user experience.
• Functional Cookies — Save your preferences such as language, display settings, and game choices for a smoother return experience.
• Marketing Cookies — Used to display relevant promotions based on your interests and activity on the platform. You may choose to disable these cookies.

You can manage cookie settings through your browser preferences. However, disabling essential cookies may affect your ability to access or use certain platform features properly.

9. Your Rights as a Data Subject

As a registered cita33 player, you have certain rights regarding your personal data. We are committed to ensuring these rights can be exercised easily and at no additional cost in most situations:

• Right of Access — You have the right to request a copy of the personal data we hold about you.
• Right to Rectification — You have the right to request correction of any inaccurate or incomplete data.
• Right to Erasure — In certain situations, you have the right to request that your personal data be deleted.
• Right to Restrict Processing — You have the right to request that we restrict the processing of your data in situations permitted by law.
• Right to Data Portability — You have the right to receive your data in a structured, machine-readable format for transfer to another service provider.
• Right to Object — You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent — Where processing is based on your consent, you have the right to withdraw that consent at any time.

10. Data Security and Incident Response

Cita33 continually invests in cybersecurity infrastructure to protect your personal data from unauthorised access, loss, alteration, or unintended disclosure. The security measures we practise include:

• Data encryption during transmission (in-transit) and at rest using the latest industry standards.
• Role-based access control (RBAC) ensuring that only authorized personnel can access sensitive data.
• 24/7 security monitoring by our in-house cybersecurity team.
• Regular penetration testing conducted by independent third-party security experts.
• Two-factor authentication (2FA) for access to internal systems and player accounts.
• Regular data backups with tested disaster recovery procedures.

In the event of a data breach affecting the security of your personal data, cita33 will notify you via your registered email or in-platform notification within a reasonable timeframe in accordance with applicable legal obligations. We will also take immediate steps to contain the incident and prevent recurrence.

11. Children's Privacy

The cita33 platform is restricted to individuals aged 18 and above. We do not knowingly collect personal data from minors. Should we discover that data from a minor has been collected, we will take immediate steps to delete that data and close the relevant account. If you are aware that someone under the age of 18 has registered on our platform, please contact our support team immediately.

12. Links to Third-Party Websites

The cita33 platform may contain links to third-party websites or services in certain contexts. This Privacy Policy applies solely to the cita33 platform. cita33 is not responsible for the privacy practices of third-party websites, and we encourage you to read their respective privacy policies before providing any personal information to them.

13. Amendments to the Privacy Policy

Cita33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technological developments. Any material amendments will be communicated to you via your registered email or a prominent in-platform notification at least 7 days before the amendment takes effect.

The "Last Updated" date shown at the top of this page reflects the date of the most recent amendment. Continued use of the platform after an amendment takes effect constitutes acceptance of the updated Privacy Policy terms.

14. Contact Us Regarding Privacy

If you have any questions, concerns, or complaints regarding how cita33 handles your personal data, or wish to exercise any of your data subject rights, please contact our customer support team through the following channels:

• Live Chat 24/7 — Available directly within the cita33 platform for immediate assistance.
• Support Email — [email protected] (displayed as text only, not clickable).
• FAQ Page — Visit FAQ page us for frequently asked questions related to privacy and your account.

We are committed to responding to all privacy-related inquiries within 5 business days. For more complex matters such as data access or erasure requests, the processing period is up to 30 business days.