Privacy Policy

This Privacy Policy ("Policy") describes how cita66 ("Platform", "we", "us", "our") — the operator of the online gaming platform accessible at cita66.cam — collects, processes, stores, shares, and protects the personal data of individuals ("you", "Member", "User") who access or use our services.

cita66 is committed to handling personal data responsibly and in accordance with internationally recognised data protection principles. This Policy is intended to give you a clear and transparent account of our data practices so that you can make informed decisions about your use of the Platform.

By registering an account, accessing the Platform, or otherwise interacting with our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy. In the event of any conflict between this Policy and any other document, this Policy shall prevail with respect to the processing of personal data.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, whether automated or manual, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Controller" refers to cita66, which determines the purposes and means of processing your Personal Data.
• "Data Processor" refers to any third-party entity that processes Personal Data on behalf of cita66 under a written data processing agreement.
• "KYC Data" refers to the identity verification documents and supporting information collected as part of the Know Your Customer process, including government-issued identification, proof of address, and proof of payment method ownership.
• "Cookies" refers to small text files placed on your device by the Platform or third-party analytics and advertising partners, used to maintain session state, analyse usage patterns, and deliver relevant content.
• "Sensitive Data" refers to categories of Personal Data requiring heightened protection, including financial information, identity documents, and data relating to responsible gambling measures taken by or on behalf of a Member.

cita66 collects Personal Data through a variety of means, including directly from you at the point of registration, through your ongoing use of the Platform, and through automated technical systems. The categories of data we collect are described in the table below:

cita66 does not intentionally collect data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning health beyond what is strictly necessary for responsible gambling compliance purposes.

cita66 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing that is necessary to perform our contractual obligations to you as a registered Member — including operating your Account, processing deposits and withdrawals, settling bets, and providing customer support.
• Legitimate Interests: Processing that is necessary to pursue cita66's legitimate business interests, including fraud prevention, security monitoring, platform analytics, and responsible gambling risk assessment, provided such interests are not overridden by your fundamental rights and freedoms.
• Legal Obligation: Processing that is required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and Know Your Customer (KYC) regulations under our licensing framework.
• Consent: Where we rely on your consent for specific processing activities — such as sending promotional communications — you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.

cita66 uses the Personal Data it collects for the following specific purposes:

• Account Management: Creating and maintaining your Member Account, authenticating your identity at login, and managing account settings and preferences.
• Payment Processing: Facilitating deposits via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, and supported cryptocurrencies (BTC, ETH, USDT, LTC), and processing withdrawal requests to verified payment methods.
• Identity Verification & KYC: Verifying your identity and age (minimum 21 years) prior to processing withdrawals, and fulfilling AML/CTF screening obligations under our licensing requirements.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent activity, money laundering, bonus abuse, account takeover attempts, and other forms of Platform misuse.
• Customer Support: Responding to enquiries, resolving account issues, and maintaining records of support interactions for quality and dispute resolution purposes.
• Responsible Gambling: Monitoring gaming behaviour for indicators of problem gambling, enforcing self-imposed limits and self-exclusion decisions, and triggering responsible gambling interventions where appropriate.
• Platform Improvement: Analysing aggregated usage data, testing new features, diagnosing technical issues, and optimising the Platform experience for Malaysian users.
• Marketing Communications: Sending promotional emails, bonus notifications, and platform updates to Members who have consented to receive such communications. You may unsubscribe at any time.
• Legal Compliance: Retaining transaction and identity records as required by applicable law and responding to lawful requests from regulatory or law enforcement authorities.

cita66 does not sell your Personal Data to third parties. We share Personal Data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: We share necessary financial and identity data with authorised payment processors — including Malaysian banking gateways (Maybank, CIMB, Public Bank, Hong Leong, DuitNow, FPX), e-wallet providers (Touch 'n Go, Boost, GrabPay), and cryptocurrency payment processors — to facilitate deposits and withdrawals. Each provider operates under its own applicable regulatory framework.
• KYC & Identity Verification Providers: We use third-party identity verification services to authenticate government-issued documents (such as MyKad or passport) and conduct facial liveness checks. These providers are contractually prohibited from using your identity data for any purpose other than verification on behalf of cita66.
• Fraud & AML Screening Providers: We share transaction data with licensed fraud detection and anti-money laundering screening services to identify and prevent financial crime.
• Game Studio Partners: Your anonymised gaming activity data (bet amounts, game selections, session data) may be shared with our licensed game studio partners for the purpose of game performance analytics. These partners do not receive your name, contact details, or payment information.
• Legal & Regulatory Authorities: We may disclose Personal Data to regulatory bodies, law enforcement agencies, or courts of competent jurisdiction where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of cita66, our Members, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of cita66's assets, your Personal Data may be transferred to the successor entity. You will be notified of any such transfer in advance via email or prominent notice on the Platform.

All third-party Data Processors engaged by cita66 are required to execute data processing agreements that impose confidentiality obligations, purpose limitation, and security requirements equivalent to those applied by cita66 itself.

cita66 retains Personal Data for the minimum period necessary to fulfil the purpose for which it was collected, subject to any longer retention periods required by applicable law or our licensing obligations. The following indicative retention periods apply:

• Account and Registration Data: Retained for the duration of your active membership plus a minimum of five (5) years following account closure, to satisfy AML record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission or from the date of account closure, whichever is later, in compliance with anti-money laundering regulations.
• Transaction and Financial Records: Retained for a minimum of seven (7) years from the date of the relevant transaction to satisfy financial record-keeping obligations.
• Customer Support Communications: Retained for three (3) years from the date of the relevant interaction, or longer where relevant to an ongoing dispute or regulatory investigation.
• Technical and Device Data (Logs): Retained for twelve (12) months from collection, unless relevant to an ongoing security investigation.
• Marketing Preferences: Retained until you withdraw your consent to receive marketing communications, after which a suppression record is maintained to prevent re-subscription without your express consent.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Anonymised aggregated data may be retained indefinitely for statistical and analytical purposes.

As a data subject, you hold a range of rights in relation to your Personal Data held by cita66. These rights are subject to applicable legal limitations and may, in certain circumstances, be restricted where exercising them would conflict with our legal obligations or legitimate fraud prevention activities.

To exercise any of the rights listed above, please submit a written request to [email protected], clearly identifying the right you wish to exercise and providing sufficient information to verify your identity. We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where additional time is required due to the complexity or volume of a request, we will notify you accordingly.

cita66 uses cookies and similar tracking technologies to operate the Platform, maintain session security, analyse user behaviour, and deliver a personalised experience. The following categories of cookies are in use:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These cookies maintain your login session, enforce security controls, and enable core Platform functions. They cannot be disabled without materially affecting your ability to use cita66.
• Analytical / Performance Cookies: Used to collect aggregated data about how Members navigate and use the Platform — including pages visited, time spent, error rates, and entry/exit paths. This data is used to improve the Platform experience. Data collected is anonymised or pseudonymised where possible.
• Functional Cookies: Used to remember your preferences — such as preferred language, region settings, and notification preferences — to deliver a more personalised experience across sessions.
• Responsible Gambling Cookies: Used to enforce session time limits, reality check notifications, and other responsible gambling settings you have configured on your Account.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair Platform functionality. For guidance on managing cookies in your specific browser (Chrome, Firefox, Safari, or the default browser on your Android or iOS device), please refer to your browser's help documentation.

cita66 does not deploy third-party advertising cookies or share cookie data with external advertising networks for behavioural targeting purposes.

cita66 implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and cita66's servers.
• Encryption at rest for all sensitive Personal Data stored in our databases, including KYC documents, payment details, and authentication credentials.
• Password hashing using industry-standard cryptographic algorithms. cita66 does not store plaintext passwords.
• Role-based access controls ensuring that only authorised personnel can access Personal Data, and only to the extent necessary for their specific job function.
• Regular third-party security audits and penetration testing of Platform infrastructure and application layers.
• Intrusion detection and prevention systems monitoring for anomalous access patterns or unauthorised activity.
• Multi-factor authentication available to Members and mandatory for internal administrative access.

While cita66 takes reasonable and appropriate steps to protect your Personal Data, no security system is completely impenetrable. In the event of a data breach that is likely to result in a risk to your rights and freedoms, cita66 will notify affected Members without undue delay and will take immediate remedial action to mitigate the impact of the breach.

You are responsible for maintaining the security of your own Account credentials. cita66 will never ask for your password via email, live chat, or any other communication channel.

cita66 is an online gaming platform intended exclusively for adults. The minimum age for Account registration and use of the Platform is 21 years. We do not knowingly collect Personal Data from individuals under the age of 21.

As part of our KYC process, all Members are required to provide government-issued identification confirming that they are aged 21 or above prior to the processing of any withdrawal. Where cita66 becomes aware — through KYC review or any other means — that a Member's Account is held by an individual under the age of 21, the Account will be immediately suspended, all balances and winnings will be voided, and the matter will be handled in accordance with our responsible gambling policy.

As an internationally operated platform, cita66 may transfer Personal Data to, and process it in, jurisdictions outside of Malaysia, including jurisdictions where the data protection laws may differ from those applicable in Malaysia. Such transfers may occur in connection with the use of cloud hosting infrastructure, payment processing services, KYC verification providers, and fraud screening systems.

Where Personal Data is transferred outside of Malaysia, cita66 takes reasonable steps to ensure that appropriate safeguards are in place to protect your information, including:

• Transferring data only to third parties who are contractually bound to maintain data protection standards equivalent to those set out in this Policy.
• Using data processing agreements that incorporate standard contractual clauses where required.
• Assessing the data protection laws of recipient jurisdictions and implementing additional safeguards where those laws do not provide adequate protection.

By using cita66's services, you acknowledge and consent to the transfer of your Personal Data to jurisdictions outside Malaysia as described in this Policy.

cita66 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform functionality. The date of the most recent revision is displayed at the top of this page.

Where amendments are material — for example, changes that affect how we use your Personal Data or the rights available to you — we will provide reasonable advance notice via a prominent notice on the Platform and/or by email to the address registered on your Account.

Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. If you do not agree with the amended terms, you should cease using the Platform and may request account closure by contacting our support team.

We encourage you to review this Policy periodically to stay informed of how cita66 handles your Personal Data.

If you have any questions, concerns, or complaints regarding this Privacy Policy or cita66's handling of your Personal Data, please contact us using the following channels:

• Email: [email protected] — for data rights requests, privacy enquiries, and data breach reports. Please use the subject line "Privacy Enquiry" to ensure prompt routing to our data protection team. Responses within 2 business hours during standard operating hours.
• Live Chat: Available 24/7 via the on-site live chat function for general privacy questions and initial guidance on exercising your data rights.

When submitting a data rights request, please include your registered email address, Account username, and a clear description of the right you wish to exercise. For verification purposes, we may ask you to provide a copy of your government-issued identification before processing access or deletion requests.

cita66 is committed to resolving all privacy-related concerns promptly and transparently. We aim to acknowledge all privacy enquiries within 5 business days and provide a substantive response within 30 calendar days. For urgent matters — including suspected unauthorised access to your Account — please contact our live support team immediately.