Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how citinow ("we", "us", "our", or "citinow"), the operator of the online gaming platform at citinow.cam, collects, uses, stores, shares, and protects the personal data of individuals ("you", "User", "Player") who access or use the citinow Platform.

citinow is committed to handling all personal data responsibly, transparently, and in a manner consistent with internationally recognised privacy principles. This Policy applies to all Users of the citinow Platform, including registered account holders and visitors who have not yet created an account.

This Privacy Policy forms part of citinow's overall legal framework alongside the Terms & Conditions. By registering an account, depositing funds, or otherwise using the Platform, you agree to the terms of this Policy. If you do not agree with any aspect of this Policy, you must cease using the Platform and may request account closure.

citinow operates primarily to serve players in Malaysia, including players located in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, Kota Kinabalu, Ipoh, and other Malaysian cities and states.

02 Definitions

For the purposes of this Policy, the following definitions apply:

• "Personal Data" — any information that identifies or could reasonably be used to identify a natural person, directly or indirectly, including name, identification number, contact details, financial data, and location data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data; in this context, citinow acts as the Data Controller for User data.
• "Data Processor" — a third party that processes Personal Data on behalf of citinow, under citinow's instructions and pursuant to a data processing agreement.
• "KYC Data" — identity verification documents submitted by Users as part of the Know Your Customer process, including MyKad copies and verification photographs.
• "Technical Data" — automatically collected information about a User's device, network, browser, and interaction with the Platform, including IP addresses and session logs.
• "Cookie" — a small text file placed on a User's device by the Platform to enable certain functionality and facilitate analytics.
• "Retention Period" — the duration for which citinow stores Personal Data before deletion or anonymisation.

03 Personal Data We Collect

citinow collects the following categories of Personal Data:

04 How We Collect Personal Data

citinow collects Personal Data through the following channels:

• Direct submission: Data you actively provide during account registration, KYC verification, deposit and withdrawal requests, and when contacting support.
• Automated collection: Technical Data collected automatically when you access the Platform, including via cookies, server logs, and analytics tools.
• Third-party sources: Identity and fraud screening data received from KYC verification service providers and payment processors operating in Malaysia (e.g., FPX network, DuitNow infrastructure operators, e-wallet platforms).
• Gameplay and transaction systems: Gaming activity and financial records generated automatically as a result of your use of citinow services.

05 Purposes of Data Processing

citinow processes your Personal Data for the following specific purposes:

1. Account creation and management — registering your account, maintaining account records, and managing account settings;
2. Identity verification and KYC compliance — verifying your identity, age (21+ policy enforcement), and eligibility to use the Platform under applicable law;
3. Payment processing — facilitating deposits and withdrawals in MYR via Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and supported bank transfers;
4. Anti-money laundering (AML) and fraud prevention — monitoring transactions and account activity for indicators of financial crime, fraudulent conduct, or abuse of the Platform;
5. Customer support — responding to queries, resolving disputes, and maintaining records of support interactions;
6. Platform security — detecting and responding to security incidents, unauthorised account access, and technical vulnerabilities;
7. Responsible gambling compliance — monitoring gaming behaviour for indicators of problem gambling and enforcing player-set limits, self-exclusion, and cooling-off periods;
8. Legal and regulatory compliance — fulfilling obligations under applicable law, including responding to lawful requests from authorities;
9. Service improvement — analysing aggregated, anonymised usage data to improve Platform functionality and user experience;
10. Marketing communications — sending promotional communications to Players who have consented to receive them (opt-out available at any time).

06 Lawful Basis for Processing

citinow processes Personal Data on the following lawful bases:

• Contractual necessity: Processing required to perform the contract between citinow and the User (account management, payments, KYC);
• Legal obligation: Processing required to comply with applicable law (AML obligations, regulatory reporting, data retention requirements);
• Legitimate interests: Processing necessary for citinow's legitimate business interests, where these are not overridden by the User's privacy rights (fraud prevention, Platform security, analytics);
• Consent: Processing based on explicit consent provided by the User (marketing communications, optional analytics cookies). Consent may be withdrawn at any time without detriment to the User's account status.

07 Data Sharing & Third-Party Disclosure

citinow does not sell, rent, or disclose Personal Data to unaffiliated third parties for marketing or commercial purposes. Personal Data is shared only in the following circumstances:

7.1 Payment Processors

To facilitate MYR deposits and withdrawals, citinow shares necessary financial and identity data with regulated payment service providers including FPX network operators, DuitNow infrastructure, and e-wallet platforms (Touch 'n Go, Boost, GrabPay) operating in Malaysia. Data shared is limited to what is strictly required to execute the transaction.

7.2 KYC and Identity Verification Providers

citinow engages certified third-party identity verification services to process KYC submissions. These providers act as Data Processors under binding data processing agreements and are prohibited from using KYC data for any purpose beyond the verification service they provide to citinow.

7.3 Regulatory and Legal Authorities

citinow may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or courts where required by applicable law, court order, or to protect the rights, property, or safety of citinow, its Users, or the public.

7.4 Technology and Infrastructure Providers

citinow uses cloud infrastructure and technology service providers to operate the Platform. These providers process data only under citinow's instructions and pursuant to data processing agreements consistent with this Policy.

08 Your Data Rights

As a User of citinow, you have the following rights with respect to your Personal Data:

To exercise any of the above rights, submit a written request to citinow at [email protected]. citinow will respond within 30 days of receipt. Where a request requires identity verification before processing, citinow will request reasonable supporting documentation.

09 Data Retention

citinow retains Personal Data for the following periods:

Following the expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in accordance with citinow's internal data lifecycle procedures.

10 Data Security

citinow implements the following technical and organisational security measures to protect User Personal Data:

• Encryption in transit: All data transmitted between your device and citinow servers is protected by 256-bit SSL/TLS encryption. HTTP connections are automatically redirected to HTTPS.
• Encryption at rest: Sensitive personal data, including KYC documents and financial records, is encrypted at rest using industry-standard algorithms.
• Access control: Access to Personal Data is restricted to authorised citinow personnel on a strict need-to-know basis, enforced through role-based access control systems.
• Two-factor authentication: citinow's internal systems and User account access incorporate two-factor authentication to reduce the risk of unauthorised access.
• Continuous monitoring: citinow operates automated security monitoring systems that detect and alert on anomalous access patterns, potential breaches, and suspicious transaction activity.
• Third-party security audits: citinow engages independent security assessors to conduct periodic audits of its data security infrastructure.

11 Cookies & Tracking Technologies

citinow uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that help citinow deliver a functional and personalised experience.

11.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for core Platform functionality including session management, security, and authentication. These cannot be disabled.
• Functional Cookies: Remember your preferences (language, currency display) to personalise your experience on the Platform.
• Analytics Cookies: Collect aggregated, anonymised data about how Users interact with the Platform to help citinow improve performance. These are enabled by default but may be disabled.
• Security Cookies: Used for fraud prevention and security monitoring, including detecting unusual login patterns and cross-site request forgery protection.

11.2 Cookie Management

You may manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please be aware that disabling certain cookies may impair Platform functionality, particularly session management and security features. For instructions on managing cookies in your specific browser, consult your browser's help documentation.

12 Minors and Age Restrictions

The citinow Platform is strictly for users aged 21 years and above. citinow does not knowingly collect or process Personal Data from individuals under the age of 21. Age verification is a mandatory component of the KYC process, and any account found to belong to a person under 21 will be immediately suspended and all associated data reviewed in accordance with our legal obligations.

If you believe that citinow has inadvertently collected data from a person under 21, please contact us immediately at [email protected] so that the situation can be investigated and remedied promptly.

13 International Data Transfers

citinow's primary data processing operations are designed to serve Malaysian users. Where data is processed by third-party service providers operating infrastructure outside Malaysia (for example, cloud hosting or KYC verification platform providers), citinow ensures that appropriate data transfer safeguards are in place.

Such safeguards include contractual data processing agreements that require recipient third parties to apply data protection standards equivalent to or exceeding those applied by citinow. By using the Platform, Users acknowledge and consent to such international transfers where necessary for the provision of citinow's services.

14 Amendments to This Privacy Policy

citinow reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or platform functionality. Where changes are material, citinow will notify registered Users by email to their registered account address, and will update the "Effective Date" shown at the top of this page.

Continued use of the Platform following publication of an updated Policy constitutes acceptance of the revised terms. Users who do not agree to a material change may close their account in accordance with the Terms & Conditions.

15 Contact Us — Privacy Enquiries

For any questions, concerns, or requests relating to this Privacy Policy, including requests to exercise your data rights, please contact citinow through the following channels: