Privacy Policy

We collect the following categories of personal data in connection with your use of the Platform:

• Full legal name as it appears on official identification documents
• Date of birth (for age verification purposes)
• Residential address, including state and postcode
• Email address and preferred contact details
• Username and encrypted password hash
• Nationality and country of residence

• Copies of government-issued identity documents (Malaysian MyKad, Driver's Licence, or Passport)
• Proof of address documentation (utility bills, bank statements issued within 3 months)
• Selfie photographs taken for identity confirmation purposes
• Payment method verification documents where applicable

• Deposit and withdrawal records including amounts, timestamps, and payment method used
• Betting and gaming history including wager amounts, game selections, and outcomes
• Bonus and promotion claim history
• Partial payment identifier information (e.g., partial bank account or e-wallet reference numbers)

• IP address and approximate geographic location derived therefrom
• Device type, operating system, and browser version
• Session data including login timestamps, session duration, and pages visited
• Referral source data (how you arrived at the Platform)
• Cookie identifiers and similar tracking data (see Section 8)

• Records of live chat conversations with customer support
• Email correspondence between you and the Platform
• Feedback, complaints, and survey responses where submitted

Personal data is collected through the following mechanisms:

• Direct Provision: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated Collection: Technical data collected automatically when you visit the Platform, including IP address, device identifiers, and session data, via server logs and cookies.
• Payment Processors: Confirmation data returned by payment processors (such as DuitNow, Touch 'n Go eWallet, Boost, Maybank, and CIMB) upon completion of a transaction, limited to transaction reference numbers, timestamps, and status confirmations.
• Identity Verification Providers: Where we use third-party KYC verification services, data shared with and returned by such services in connection with identity checks.
• Fraud Prevention Systems: Data received from fraud detection and risk management tools that help us identify and prevent unauthorised account activity.

The table below sets out the specific purposes for which we process your personal data, together with the lawful basis relied upon for each processing activity:

CashCity99 does not sell, rent, or trade personal data to third parties for commercial purposes. Personal data is shared with third parties only in the circumstances described below, and only to the extent necessary for the specified purpose:

We share transaction reference data and identity confirmation details with our licensed payment processing partners — including providers facilitating DuitNow, Touch 'n Go eWallet, Boost,rabPay, FPX, Maybank, CIMB, Public Bank, and Hong Leong Bank transactions — solely to process your deposits and withdrawals. These providers operate under their own privacy frameworks and are bound by contractual data protection obligations with us.

Where we use third-party KYC verification technology, identity documents and verification data are shared with these providers solely for the purpose of completing verification process. KYC providers are engaged under binding data processing agreements and are prohibited from using shared data for any other purpose.

Technical and transaction data may be shared with fraud detection and cybersecurity service providers to protect the Platform and its members from fraudulent activity, identity theft, and security breaches.

We may be required to disclose personal data to relevant regulatory authorities, law enforcement agencies, courts, or other public bodies where we are under a legal obligation to do so, or where such disclosure is necessary to protect the rights and safety of the Platform, its members, or the public.

Personal data may be shared with our legal advisers, auditors, and compliance consultants on a strictly need-to-know basis in connection with professional advisory services. All such parties are bound by confidentiality obligations.

The Platform uses cookies and similar tracking technologies to enhance your experience, maintain session continuity, improve Platform performance, and support our security and fraud prevention measures.

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies that keep you logged in during an active session. These cookies cannot be disabled without affecting core Platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the Platform, including pages visited, session duration, and navigation paths. This data informs Platform improvement decisions.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and previously selected payment methods to provide a more personalised experience.
• Security Cookies: Support our fraud detection and account security systems by identifying unusual access patterns or concurrent sessions from multiple devices.

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, or to receive a notification before a cookie is stored. Please note that disabling certain cookies may affect the functionality of the Platform. Detailed cookie management instructions are available in your browser's help documentation.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of the active account relationship and for a minimum of five (5) years following account closure, in compliance with standard anti-money laundering record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with regulatory requirements.
• Transaction Records: Retained for a minimum of five (5) years following the date of the transaction for regulatory, audit, and dispute resolution purposes.
• Customer Support Communications: Retained for up to three (3) years from the date of the interaction, or longer where the matter is subject to an active complaint or legal proceeding.
• Technical & Usage Data: Standard server log data retained for up to twelve (12) months. Aggregated analytics data may be retained indefinitely in anonymised form.
• Marketing Preferences: Retained until you withdraw your consent or update your preferences through account settings or by contacting support.

Where data is no longer required and no legal basis for extended retention exists, it will be securely deleted or anonymised in accordance with our data disposal procedures.

CashCity99 implements a comprehensive range of technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes:

1. Encryption in Transit: All data transmitted between your device and our servers is protected by256-bit SSL/TLS encryption. HTTPS is enforced across the entire Platform.
2. Encryption at Rest: Sensitive data stored on our servers — including identity information and financial records — is encrypted using AES-256 encryption.
3. Access Controls: Access to personal data within our organisation is strictly limited on a need-to-know basis. All staff with data access undergo mandatory data protection training and are bound by confidentiality obligations.
4. Infrastructure Security: Our servers are hosted on enterprise-grade cloud infrastructure with multiple redundancy layers, intrusion detection systems, and regular security patching.
5. Regular Audits: We conduct periodic internal security reviews and commission independent third-party security assessments to identify and address vulnerabilities.
6. Incident Response: We maintain a documented incident response plan. In the event of a data breach that poses a risk to your rights, we will notify affected members without undue delay.

Notwithstanding the above measures, no data transmission or storage system can be guaranteed to be 100% secure. You are responsible for maintaining the confidentiality of your own account credentials and for notifying us immediately if you suspect any unauthorised access to your account.

Subject to applicable law and any overiding legitimate interests or legal obligations on our part, you have the following rights in respect of your personal data held by CashCity99:

To exercise any of the above rights, please contact our support team via live chat on the Platform or in writing at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) days. Where a request is complex or numerous, this period may be extended by a further sixty (60) days with notice provided to you.

The Platform is strictly for individuals aged21 years and above. CashCity99 does not knowingly collect or process personal data from persons under the age of 21. Age verification is enforced as part of our mandatory KYC process.

If we become aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a minor has registered an account on the Platform, please contact us immediately at [email protected] so that we can investigate and take appropriate action.

In the course of operating the Platform, personal data may be transferred to and processed in countries outside Malaysia, including countries where our server infrastructure, payment processors, or KYC verification providers are located. Such transfers may involve jurisdictions that do not have data protection laws equivalent to those applicable in Malaysia.

Where personal data is transferred internationally, CashCity99 takes appropriate steps to ensure that such transfers are conducted under adequate safeguards. These safeguards may include: contractual clauses requiring the recipient to protect data to a standard equivalent to our obligations; binding corporate rules where applicable; or specific consent where required.

By using the Platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside Malaysia, subject to the safeguards described in this section.

CashCity99 reserves the right to update or amend this Privacy Policy at any time. Material changes — those that significantly affect how we process your personal data or that alter your rights — will be communicated to you in advance via the email address registered to your account or through a prominent notice on the Platform.

The date of the most recent revision is displayed at the top of this Policy. We recommend that members review this Policy periodically to remain informed of any updates. The current version of this Policy is always available at cashcity99.cam/privacy-policy.

Your continued use of the Platform following the notification of any material changes constitutes your acknowledgment of the updated Policy. If you do not agree to the revised Policy, you must cease using the Platform and may request account closure in accordance with the account closure procedure set out in our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us through the following channels: