Privacy Policy City888 — How We Protect Your Personal Data

City888 takes our responsibility to every member's privacy seriously. This policy is written so you know exactly what happens to your information — not in convoluted legal language, but in plain English that everyone can understand.

We operate under the principle that your personal data belongs to you. We only borrow access to that information for specific purposes, for as long as necessary, and with appropriate safeguards in place. Once the purpose is no longer relevant, the data will be deleted or anonymised.

This Privacy Policy applies to all use of the platform City888 — the website at city888.bio, the Android and iOS mobile apps, and all related services we provide. This also applies to all forms of interaction with our team, including communication via live chat and support email.

The type of data we collect depends on how you interact with the city888 platform. In general, there are three main categories:

Every piece of data we collect has a clear purpose. We do not use your data for any purpose other than those stated below:

• Account management — verifying your identity, creating and maintaining your city888 account
• Transaction processing — processing deposits, withdrawals, and payments accurately and securely
• KYC Verification — fulfilling anti-money laundering (AML) compliance requirements
• Platform security — detecting and preventing fraud, account abuse, and suspicious activity
• Customer support — helping resolve issues and enquiries you raise
• Platform improvements — analysing usage patterns to improve the user experience
• Service communications — sending important notifications about your account, transactions, and platform updates
• Legal compliance — meeting reporting obligations to relevant authorities when required

For marketing communications such as promotional offers, City888 will request your separate consent. You may withdraw this consent at any time without affecting your use of the platform.

City888 processes your personal data based on one or more of the following valid legal grounds:

• Contract — processing required to fulfil the service agreement with you
• Legal obligation — processing required to comply with applicable laws in Malaysia
• Legitimate interest — processing for security purposes, fraud prevention, and service improvement
• Consent — processing for marketing communications based on your explicit consent

City888 does not sell your personal data to anyone. However, in the course of delivering our services, there are situations where data needs to be shared with certain parties:

• Payment providers — banks, e-wallet operators (DuitNow, Touch 'n Go, Boost) to process financial transactions
• KYC service providers — approved identity verification partners to process KYC checks
• Cloud computing providers — for secure data storage and processing under strict data protection agreements
• Legal authorities — only when required by court order or official authority request

All third parties we work with are bound by confidentiality and data protection agreements. They are only permitted to use your data for the specific purposes defined in those agreements.

City888 retains your personal data for as long as necessary for the stated purposes. General retention periods are as follows:

• Active account data — retained for the duration your account is active at city888
• Financial transaction records — retained for a minimum of 7 years for financial compliance purposes
• KYC records — retained for a minimum of 5 years after account closure
• Technical and security logs — retained for 12 months
• Support communication logs — retained for 3 years

Once the retention period expires or upon your request for data deletion (subject to legal requirements), your data will be permanently deleted or anonymised so it can no longer be linked to your identity.

Data security is something we take very seriously at city888. Below are some of the technical and organisational measures we have implemented:

• 256-bit SSL Encryption for all data communications between the platform and users
• Data at-rest encryption for data stored on servers
• Layered access control — only authorised staff may access personal data
• 24/7 security monitoring with an automated alert system for suspicious activity
• Penetration testing conducted periodically by independent third parties
• Secure data backup stored at geographically separate locations
• Staff security training mandatory for all staff handling personal data

While we implement all reasonable security measures, no system is 100% immune. That is why we also recommend enabling two-factor authentication (2FA) on your city888 account for an additional layer of protection on your end.

As a city888 member, you have the following rights regarding your personal data. All requests can be submitted to our support team via live chat on the platform:

City888 will respond to all data rights requests within 30 working days. In complex cases, we may extend this period to a maximum of 60 days by providing notice to you.

City888 uses cookies and similar tracking technologies to enhance your experience on our platform. We use several types of cookies:

• Essential cookies — required for core platform functions such as login verification and session security. This cannot be disabled.
• Performance cookies — collecting information about how you use the platform to help us improve it. All such data is anonymised.
• Preference cookies — remembering your settings and preferences to deliver a more personalised experience.

You can manage cookie settings through your browser preferences. However, disabling certain cookies may affect the functionality of some parts of the City888 platform. We do not use third-party cookies for advertising purposes.

City888 reserves the right to update this Privacy Policy from time to time. When material changes occur that affect how we handle your data, we will notify you via:

• In-platform notification on city888 upon login
• Email to the address registered in your account
• Prominent notice on the website homepage

The "Updated" date at the top of this page will always reflect the latest version of the Privacy Policy. It is your responsibility to review this page periodically. Continued use of the platform after an update is published constitutes acceptance of those changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact the city888 team:

• Live Chat — available 24/7 within the city888 platform, the fastest way to get a response
• Privacy email — [email protected] with the subject line "Data Privacy Request"

We take every privacy-related enquiry seriously. Our team will respond within 3 business days for general enquiries, and within 10 business days for more complex data rights requests.