Vcity33 Privacy Policy – Malaysian Player Data Protection

1 Scope and Purpose of This Privacy Policy

This Privacy Policy explains how vcity33 ("we", "the platform") collects, uses, stores, discloses, and protects your personal data when you use the vcity33.best platform — whether during account registration, making transactions, interacting with support services, or simply browsing our website.

By registering an account or using any part of the vcity33 platform, you confirm that you have read and understood this Privacy Policy, and that you agree to the data collection and processing practices described herein. If you do not agree, please do not use the vcity33 platform.

This Policy applies to all registered members and users browsing vcity33.best from Malaysia. It forms part of your overall agreement with vcity33, together with Terms & Conditions and Responsible Gambling Policy ours.

2 Types of Personal Data We Collect

Vcity33 only collects data that is necessary for legitimate, clearly stated purposes. The data we collect can be grouped into the following categories:

Data You Provide Directly:

• Full name as shown on your Malaysian identity card.
• Identity card number (MyKad) or passport number for age verification and identity authentication (KYC).
• A valid email address and active Malaysian mobile number.
• Date of birth to verify age eligibility (21 years and above).
• Payment method details such as bank account numbers and phone numbers linked to Touch 'n Go or DuitNow — stored in encrypted format.
• Written communications you have sent to our customer support team.

Automatically Collected Data:

• IP address and geographical location information (state within Malaysia).
• The type and version of your web browser and your device's operating system.
• Activity log of your gaming sessions — games played, bets placed, winnings, and session duration.
• Complete records of all deposit and withdrawal transactions.
• Cookie and session token data to ensure a smooth user experience.
• Platform interaction data — pages visited, time spent, and navigation flow.

3 How vcity33 Uses Your Data

Every piece of data vcity33 collects has a clear and lawful purpose. We do not collect data "just in case" without a genuine need. The following table outlines how we use your data:

Specifically regarding data use for the vcity33 VIP Rewards programme, your gaming activity and monthly deposit records are automatically processed by our system to determine your VIP tier (Bronze, Silver, Gold, Platinum, Diamond, or Elite Platinum) and calculate the weekly cashback to be credited to your account. This is a fully automated process and does not involve manual review except in cases requiring additional verification.

4 Disclosure of Data to Third Parties

Vcity33 maintains a strict policy on the disclosure of data to third parties. We never sell or rent members' personal data to advertisers or marketing companies. Disclosure only occurs in limited, legitimate circumstances as outlined below:

• Payment Service Providers: Touch 'n Go, DuitNow, GrabPay, Boost, ShopeePay, FPX (Maybank2u, CIMB Clicks) — only the information required to process your transaction is shared, and these providers are bound by strict confidentiality agreements.
• Game Providers: PG Soft, Pragmatic Play, Evolution, and other providers — only anonymised session IDs are used to ensure game integrity, not your personal identifying information.
• Malaysian Authorities: Where required by a valid court order, directives from the Inland Revenue Board (LHDN), the Royal Malaysia Police (PDRM), or any Malaysian government authority acting under applicable law.
• Audit & Compliance: Independent third-party auditors who verify our compliance with security and fair gaming standards — bound by a strict confidentiality agreement.
• Fraud Prevention: Limited information sharing with other platforms within the industry security network to identify and block coordinated fraudulent activity.

In all of the above cases, vcity33 ensures that only the minimum necessary data is disclosed, and all recipients are bound by confidentiality obligations that meet our own standards.

5 vcity33 Data Security Measures

Protecting your data is not merely a legal obligation for vcity33 — it is our moral responsibility to every member who entrusts us with their personal information. We continually invest in the following security infrastructure:

• 256-bit SSL Encryption: All communication between your browser and vcity33's servers is fully encrypted — no one can intercept and read the data being transmitted.
• Encrypted Data Storage: Sensitive data such as payment information and identification numbers are stored in encrypted databases with separately managed encryption keys.
• 24-Hour Monitoring: The vcity33 security team monitors all system activity around the clock using intrusion detection tools (IDS) and automated alert systems.
• Periodic Penetration Testing: vcity33 engages independent security specialists to conduct penetration testing at least twice a year, identifying and closing any vulnerabilities before they can be exploited.
• Strict Access Controls: Only vcity33 staff who require access to specific data to carry out their assigned duties are granted permission — with the principle of least privilege applied across the organisation.
• Secure Backups: Critical data is regularly backed up to a secure, separate location, fully encrypted, to ensure rapid recovery in the event of any incident.

6 Data Retention Period

Vcity33 retains your personal data for as long as your account remains active, and for the period required following account closure in accordance with our legal obligations. More specifically:

• Active Account Data: Retained for the duration your account remains active, and used for operational, support, and VIP purposes.
• Financial Transaction Records: Retained for a minimum of 7 years from the date of the transaction — a legal requirement under Malaysian law relating to financial records and anti-money laundering.
• KYC Records (Identity Verification): Retained for a minimum of 5 years after the business relationship ends, in accordance with Malaysia's Anti-Money Laundering Act.
• Support Communication Logs: Retained for 2 years to allow for historical reference and resolution of any disputes that may arise.
• Marketing Data: Retained until you withdraw consent — once you unsubscribe, your marketing data is deleted within 30 days.
• Technical Data (Server Logs): Retained for 90 days for security and incident investigation purposes, then automatically deleted.

Once the retention period has ended and there is no longer a legal basis to keep the data, vcity33 will securely delete or anonymise it in accordance with established procedures.

7 Your Rights Regarding Personal Data

As a vcity33 member and an individual protected under Malaysia's Personal Data Protection Act 2010, you have the following rights regarding the personal data we hold about you:

To exercise any of the above rights, please submit a written request to privacy@vcity33.best by stating the right you wish to exercise and providing sufficient information to verify your identity. We will respond within 30 business days. Some requests may not be fulfilled in full if they conflict with our legal obligations relating to PDPA compliance, anti-money laundering prevention, or other regulatory requirements.

8 Cookies, Supercookies & Tracking Technologies

Vcity33 uses cookies and similar tracking technologies to enhance the user experience, ensure platform security, and understand how members interact with our services. Below are the categories of cookies we use:

You can manage cookie settings through your web browser preferences. However, disabling mandatory cookies will affect the login functionality and security of the vcity33 platform. For optional cookies, you may opt out without affecting your basic use of the platform.

9 Marketing & Promotional Communications

Vcity33 sends marketing communications — including new promotional updates, exclusive VIP offers, tournament notifications, and platform news — via email and SMS to members who have given their consent during registration or at a later stage through their account settings.

You have full control over the marketing communications you receive:

• Unsubscribe from marketing emails by clicking the "Unsubscribe" link at the bottom of any vcity33 promotional email.
• Manage your notification preferences directly in your vcity33 account settings under the "Communication Preferences" section.
• Contact support@vcity33.best to request a manual opt-out from all marketing communications.

Please note that unsubscribing from marketing communications does not mean you will stop receiving important account-related emails — such as withdrawal notifications, security alerts, Terms & Conditions updates, or other critical account information. These communications are distinct from marketing and cannot be opted out of while your account remains active.

10 Cross-Border Data Transfers

In the course of operating the vcity33 platform, some data may be processed or stored on servers located outside Malaysia — particularly in connection with services provided by our technology infrastructure partners and international game providers.

When such data transfers take place, vcity33 ensures that:

• Transfers are made only to countries or entities that maintain data protection standards equivalent to or exceeding those of Malaysia.
• Binding data processing agreements (DPAs) are signed with all third-party providers who receive vcity33 member data.
• All data transferred remains encrypted both in transit and at rest, using the same standards we apply internally.
• Third-party providers are prohibited from using vcity33 member data for any purpose other than those specified in their service agreements with us.

This cross-border data transfer is necessary for the vcity33 platform to operate smoothly — including processing games from international providers and conducting global security checks. Without this capability, many of the popular games you enjoy would not be accessible.

11 Children's Privacy Protection

The vcity33 platform is exclusively for individuals aged 21 and above. We do not knowingly collect personal data from individuals below this minimum age.

During registration, vcity33 performs an age check based on the date of birth provided and, where necessary, verifies identity through valid identification documents. Should we discover that personal data belonging to an individual under the age of 21 has been collected inadvertently, we will take immediate steps to delete that data and close the account in question.

12 How to Contact the vcity33 Privacy Officer

If you have any questions, concerns, or complaints regarding how vcity33 handles your personal data, or if you wish to exercise any of your privacy rights as described in Section 7, please contact our Privacy Officer through the following channels:

• Privacy Email: privacy@vcity33.best — for all enquiries relating to data protection and privacy rights.
• General Support Email: support@vcity33.best — for general enquiries not specifically related to privacy.
• Response Time: We are committed to responding to all privacy enquiries within 7 business days, and to processing data rights requests within 30 business days.

When reaching out, please clearly state your name, your vcity33 account number (if applicable), and the details of your query or request. This helps us process your request more quickly and accurately.

If you are not satisfied with our response, you have the right to lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP), under the Ministry of Communications and Digital.