mcity888 Privacy Policy

1. Data Controller

For the purposes of this Privacy Policy, the data controller responsible for processing your personal information is mcity888 ("mcity888", "We", "Us", or "Our"), the operator of the online gaming platform accessible at mcity888.co. mcity888 is operated under an international gaming authority licence, the terms of which impose data protection obligations that are incorporated into this Policy.

References to "You", "Member", or "User" in this Policy refer to any individual who registers an account on, accesses, or otherwise interacts with the mcity888 Platform, whether as a registered member or as an anonymous visitor.

2. Data We Collect

mcity888 collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the Platform, and from third parties where permitted by applicable law.

2.1 Registration & Identity Data. When you create a mcity888 account, we collect your legal full name, date of birth, nationality, residential address, email address, and phone number. For KYC (Know Your Customer) verification required under our gaming licence obligations, we also collect copies of government-issued identification documents such as your Malaysian MyKad, passport, or equivalent identity document.

2.2 Financial Data. mcity888 collects data necessary to process deposits and withdrawals, including payment method identifiers (e.g., Touch n Go eWallet account reference, Boost account reference, bank account details), transaction amounts, dates, and reference numbers. We do not store full payment card numbers on our systems; card transactions are tokenised through our payment service providers.

2.3 Gaming Activity Data. We record all gaming transactions on the Platform, including games played, bets placed, amounts wagered, outcomes, bonuses applied, and session durations. This data is retained for regulatory compliance, dispute resolution, and responsible gaming monitoring purposes.

2.4 Technical & Device Data. When you access the Platform, we automatically collect your IP address, browser type and version, operating system, device identifiers, screen resolution, referring URL, and session timestamps. This data is used for security monitoring, fraud prevention, and platform optimisation.

2.5 Communications Data. We retain records of communications between you and mcity888 support, including live chat transcripts, email correspondence, and any documents you submit in connection with a support request or dispute.

2.6 Responsible Gaming Data. If you use self-exclusion, deposit limit, or cooling-off features on your mcity888 account, we record these elections and the dates they were applied. This data is processed to fulfil our responsible gaming obligations under the Platform's licence conditions.

3. How We Use Your Data

4. Legal Basis for Processing

mcity888 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to provide you with the services you have registered for, including account creation, payment processing, and gameplay services.
• Legal obligation: Processing required to comply with mcity888's obligations under its international gaming authority licence, including KYC verification, AML monitoring, and regulatory reporting.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and improving the Platform's services, where these interests are not overridden by your data protection rights.
• Consent: Where you have given explicit consent to specific processing activities, such as receiving marketing communications. You may withdraw consent at any time by contacting support or updating your account communication preferences.

5. Data Sharing & Disclosure

mcity888 does not sell your personal data to third parties. We share your data only in the following circumstances:

5.1 Service Providers. We engage third-party service providers to support Platform operations, including payment processors (e.g., e-wallet operators, banking partners), KYC verification service providers, IT infrastructure providers, and customer support platforms. These providers are bound by data processing agreements that restrict them from using your data for any purpose other than providing the contracted service to mcity888.

5.2 Regulatory and Legal Requirements. mcity888 may disclose your personal data to its gaming licence authority, relevant Malaysian regulatory bodies, law enforcement agencies, or courts where required by law, regulation, or a valid legal order. mcity888 will notify you of such disclosure where legally permitted to do so.

5.3 Anti-Money Laundering. Transactions and account data may be shared with financial intelligence units or reporting bodies as required by applicable AML legislation and our licence obligations. mcity888 will not typically be permitted to notify you when such a report has been made.

5.4 Business Transfers. In the event of a merger, acquisition, or sale of all or a material portion of mcity888's business, your personal data may be transferred to the successor entity as part of that transaction. You will be notified of any such transfer and of any resulting change to this Privacy Policy.

6. Cookies & Tracking Technologies

mcity888 uses cookies and similar tracking technologies on the Platform to maintain session integrity, remember your login state (where "Remember me" is enabled), detect fraudulent activity, and analyse aggregate platform usage patterns.

Session cookies are temporary and are deleted when you close your browser. Persistent cookies remain on your device for a defined period and are used for functions such as maintaining login state on trusted devices. Analytics cookies collect anonymised data about how pages are used, which helps mcity888 improve the Platform experience.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. However, disabling session cookies will prevent you from logging in to your mcity888 account, as session management depends on cookie functionality. mcity888 does not use third-party advertising cookies or share browsing data with advertising networks.

7. Data Retention

mcity888 retains your personal data for the periods set out below. Where multiple retention obligations apply, the longer period takes precedence:

• Account and identity data: Retained for the duration of your account plus a minimum of 5 years following account closure, in accordance with AML and gaming licence record-keeping requirements.
• Financial transaction data: Retained for a minimum of 7 years following the transaction date, in accordance with financial record-keeping obligations under applicable law.
• Gaming activity data: Retained for a minimum of 5 years following the relevant gaming session, for regulatory reporting and dispute resolution purposes.
• Support communications: Retained for 3 years following the closure of the relevant support case, unless the case relates to a dispute that remains unresolved, in which case data is retained until resolution plus 2 years.
• Self-exclusion records: Retained permanently to prevent re-registration by self-excluded individuals, in accordance with responsible gaming obligations.
• Technical and device data: Typically retained for 12 months, unless required for longer periods in connection with an active fraud or security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with mcity888's data destruction procedures.

8. Data Security

mcity888 implements technical and organisational security measures appropriate to the risk profile of the personal data processed on the Platform. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption of sensitive data at rest, including identity document images and financial data.
• Access controls ensuring that employee access to personal data is restricted on a need-to-know basis, with all access logged and auditable.
• Two-factor authentication requirements for all administrative access to production systems.
• Intrusion detection systems and continuous security monitoring of Platform infrastructure.
• Regular third-party security audits and penetration testing.

Notwithstanding these measures, no internet-based system can guarantee absolute security. You should take appropriate steps to protect your own credentials, including using a strong unique password for your mcity888 account and enabling two-factor authentication in your account settings.

In the event of a personal data breach that presents a risk to your rights, mcity888 will notify affected members and relevant authorities within the timeframes required by applicable data protection law.

9. Your Rights

Subject to applicable data protection law and our licence obligations, you have the following rights in relation to your personal data held by mcity888:

• Right of access: You may request a copy of the personal data we hold about you. Requests will be responded to within 30 days.
• Right to rectification: You may request correction of inaccurate or incomplete personal data. Identity data corrections require supporting documentation.
• Right to erasure: You may request deletion of your personal data in certain circumstances. Note that this right is subject to our legal retention obligations — we cannot erase data we are required by law to retain.
• Right to restrict processing: You may request that we restrict the processing of your data in certain circumstances, such as where you dispute its accuracy.
• Right to data portability: Where processing is based on your consent or a contract, you may request your data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to object: You may object to processing based on legitimate interests, including profiling for marketing purposes.

To exercise any of these rights, contact the mcity888 data team via [email protected] (plain text — not a link) with the subject line "Data Subject Request". We may require identity verification before processing your request.

10. International Data Transfers

mcity888 may transfer your personal data to servers or service providers located outside Malaysia in the course of operating the Platform. Where such transfers occur, mcity888 ensures that appropriate safeguards are in place, including standard contractual clauses approved by relevant data protection authorities, or transfers to jurisdictions that provide an adequate level of data protection as recognised under applicable law.

By using the mcity888 Platform, you acknowledge that your data may be processed in jurisdictions outside Malaysia. Regardless of where your data is processed, mcity888 applies the protections described in this Privacy Policy.

11. Minors

The mcity888 Platform is strictly restricted to individuals aged 21 years and above. mcity888 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account. All deposited funds attributable to an underage account will be returned to the payment source.

If you have reason to believe that a minor has registered on the mcity888 Platform, please contact our support team immediately via live chat.

12. Changes to This Policy

mcity888 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or Platform features. Material changes will be communicated to registered members via the email address on file or via a prominent notice on the Platform, no less than 7 days before the changes take effect.

The current version of this Privacy Policy is always accessible at mcity888.co/privacy-policy. The "Last updated" date at the top of this page indicates the most recent revision. Your continued use of the Platform after the effective date of any update constitutes your acknowledgement of the revised Policy.

13. Contact & Data Enquiries

For privacy-related enquiries, data subject requests, or to report a concern about how mcity888 handles your personal data, please contact us via the 24/7 live chat available on the Platform, or by email at the address below. Email responses may take up to 10 business days.

Email: [email protected]

Please include "Privacy" or "Data Subject Request" in the subject line of any email enquiry to ensure prompt routing to the appropriate team.