cita66 Privacy Policy – How We Handle Your Personal Data

1. Who We Are / Data Controller

1.1 This Privacy Policy is issued by the operating entity behind the cita66 brand and the cita66.asia website (collectively referred to as "cita66," "we," "us," "our"). cita66 is the data controller in respect of personal data collected through its Platform.

1.2 cita66 operates as an online casino and sports betting platform targeting Malaysian players and holds international gaming authorisation. Our registered operations are conducted in accordance with applicable data protection standards under the jurisdiction of our authorising regulatory body.

1.3 References to "you," "your," "Player" in this Policy refer to any individual who accesses, browses, registers on, or uses the cita66 Platform in any capacity.

2. Personal Data We Collect

2.1 cita66 collects personal data that is necessary to provide the Platform services, comply with legal obligations, and maintain account security. The categories of personal data we may collect include:

2.2 cita66 does not collect sensitive personal data categories (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless specifically required for regulatory compliance in limited circumstances.

3. How We Collect Your Data

3.1 cita66 collects personal data through the following means:

• Direct provision: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawal requests, or contacting cita66 Support.
• Automated collection: Technical and behavioural data collected automatically when you access the Platform via cookies, log files, and similar tracking technologies (see Section 5).
• Third-party sources: Identity verification data from KYC service providers; fraud and sanctions screening data from compliance partners; payment data from payment processors.
• Publicly available sources: Where relevant for compliance purposes, information from public records or databases.

4. Purposes and Legal Basis for Processing

4.1 cita66 processes personal data for the following purposes and on the following legal bases:

• Contract performance: Processing necessary to provide the Platform services you have registered for, including account management, game access, deposits, and withdrawals.
• Legal obligation: Processing required to comply with applicable laws including anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, tax reporting, and regulatory directions.
• Legitimate interests: Processing to detect and prevent fraud, unauthorised access, and bonus abuse; to improve Platform security and performance; to conduct analytics for Platform development; to manage our relationship with you as a customer.
• Consent: Where you have given specific consent, such as opting in to marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

4.2 cita66 does not use automated decision-making in a way that produces legally significant or similarly significant effects on Players without human review where such decisions are challenged.

5. Cookies and Tracking Technologies

5.1 The cita66 Platform uses cookies and similar technologies to enable core functionality, improve the user experience, and collect analytics data. The types of cookies used include:

• Essential cookies: Required for the Platform to function. These include session cookies that maintain your login state and security cookies that protect against cross-site request forgery. These cannot be disabled without preventing Platform use.
• Analytics cookies: Used to understand how Players interact with the Platform — which pages are visited, where sessions start and end, and which features are used. This data is aggregated and does not identify individual users.
• Preference cookies: Store your Platform preferences such as language selection and notification settings across sessions.

5.2 cita66 does not use third-party advertising tracking cookies or share cookie data with advertising networks. Non-essential cookies may be declined via your browser settings, though this may affect Platform functionality.

5.3 Session cookies are deleted when you close your browser. Persistent cookies expire after a defined period or may be cleared through your browser settings.

6. Data Sharing and Third Parties

6.1 cita66 does not sell personal data to third parties. We share personal data only in the following circumstances:

• Service providers: Third-party vendors who process data on cita66's behalf to provide Platform services, including payment processors (Touch n Go, Boost, Maybank, CIMB Bank), game software providers, KYC verification services, and cloud infrastructure providers. All service providers are contractually bound to process data only as directed by cita66 and to maintain appropriate security standards.
• Legal and regulatory bodies: Where cita66 is required to disclose data to comply with applicable laws, court orders, regulatory directions, or to cooperate with law enforcement investigations including AML and financial crime investigations.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. Players will be notified of any such transfer and any change in data controller.
• With your consent: In any other circumstances where you have given explicit prior consent to the sharing.

6.2 When cita66 shares data with third parties, we take reasonable steps to ensure those parties maintain appropriate data protection standards consistent with this Policy.

7. International Data Transfers

7.1 As cita66 operates under international gaming authorisation and uses global service providers, your personal data may be transferred to and processed in countries outside Malaysia. Such transfers are conducted using appropriate safeguards including contractual data protection terms with recipient parties.

7.2 By using the cita66 Platform, you acknowledge and consent to such international transfers in connection with the provision of Platform services to you.

8. Data Retention

8.1 cita66 retains personal data for as long as your Account is active and for such additional period as may be required or permitted by law. Specific retention periods include:

• Account and identity data: Retained for the duration of the Account relationship plus a minimum of five (5) years following Account closure, in accordance with AML record-keeping obligations.
• Transaction and gaming records: Retained for a minimum of five (5) years from the date of the relevant transaction or gaming session.
• Support communications: Retained for a minimum of two (2) years from the date of the communication, or longer if the communication relates to an unresolved dispute.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter as evidence of the consent.

8.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

9. Your Data Rights

9.1 Subject to applicable law and cita66's legitimate interests and legal obligations, you have the following rights in respect of your personal data:

• Right of access: The right to request a copy of the personal data cita66 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to cita66's legal record-keeping obligations (which may mean certain data must be retained regardless of a deletion request).
• Right to restriction: The right to request that cita66 restricts processing of your personal data in certain circumstances.
• Right to data portability: The right to receive personal data you have provided to cita66 in a structured, machine-readable format where technically feasible.
• Right to object: The right to object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting prior lawful processing.

9.2 To exercise any of these rights, contact cita66 Support via live chat or email at the address provided in Section 14. cita66 will respond to valid requests within a reasonable timeframe. Verification of identity will be required before any data is disclosed or modified.

10. Marketing Communications

10.1 cita66 may send promotional communications about offers, bonuses, new games, and Platform updates to Players who have opted in to receive such communications.

10.2 You may opt out of marketing communications at any time by updating your notification preferences in Account Settings or by contacting cita66 Support. Opting out of marketing communications does not affect the receipt of transactional communications (e.g., deposit confirmations, withdrawal notifications, Account security alerts).

10.3 cita66 will not send marketing communications to any Player who is subject to an active self-exclusion or cooling-off period under our Responsible Gaming Policy.

11. Children and Minors

11.1 The cita66 Platform is strictly for persons aged 21 years and above. cita66 does not knowingly collect personal data from individuals under the age of 21. Any Account found to belong to a person under 21 will be closed immediately and personal data will be deleted subject to any legal retention requirements.

11.2 If you believe a minor has accessed or registered on the cita66 Platform, please contact cita66 Support immediately so that we can take appropriate action.

12. Security Measures

12.1 cita66 implements technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the cita66 Platform;
• Encrypted storage of personal data at rest;
• Role-based access controls limiting personnel access to personal data on a need-to-know basis;
• Two-factor authentication available for all Player accounts;
• Regular security assessments and vulnerability testing of the Platform;
• Incident response procedures for data breach scenarios, including notification obligations where applicable.

12.2 While cita66 takes all reasonable steps to protect your data, no system is entirely immune to security incidents. In the event of a breach affecting your personal data, cita66 will notify you and relevant authorities as required by applicable law.

13. Changes to This Policy

13.1 cita66 reserves the right to update this Privacy Policy at any time. Material changes will be communicated via a notice on the Platform and/or to your registered email address, with reasonable advance notice where practicable.

13.2 Continued use of the Platform following notification of changes constitutes acceptance of the revised Privacy Policy. The "Last Updated" date at the top of this document indicates when the Policy was most recently revised.

13.3 We encourage you to review this Policy periodically to stay informed about how cita66 handles your personal data.

14. Contact and Complaints

14.1 For questions, concerns, or to exercise your data rights, please contact cita66 through the following channels:

14.2 cita66 aims to respond to all privacy-related enquiries and data rights requests within ten (10) business days. Complex requests requiring additional verification or third-party coordination may take longer, and you will be informed of the expected timeline.

14.3 If you are not satisfied with cita66's response to a privacy complaint, you may be entitled to escalate your complaint to the relevant data protection authority or the dispute resolution mechanism provided by cita66's international gaming regulator. Details of applicable mechanisms are available upon request from cita66 Support.

This Privacy Policy was last reviewed and updated in June 2026. cita66 reserves the right to update this document at any time in accordance with Section 13 above.