Cili88 Privacy Policy – Data Protection & Privacy for Malaysian Players

1 Introduction & Scope of this Privacy Policy

This Privacy Policy applies to all users who access or use the cili88 platform — whether through the cili88.im website, the mobile app (if available), or any services associated with the cili88 platform. It covers all personal information collected during the registration process, day-to-day platform use, financial transactions, and communications with our support team.

"Personal information" in the context of this Privacy Policy refers to any information that can be used to identify you, directly or indirectly — including your name, email address, phone number, bank account or e-wallet details, IP address, and platform usage history. cili88 acts as the responsible data controller for all personal information collected through this platform.

2 Personal Data We Collect

Cili88 collects your personal information across several key categories. Below is a comprehensive table outlining the types of data, how they are collected, and the purpose behind each:

There are also categories of data that we do not collect and does not require: full credit or debit card numbers (we use PCI-DSS certified third-party payment gateways for processing), biometric data, or any information not relevant to the provision of cili88 platform services.

3 How cili88 Uses Your Data

Cili88 uses collected personal data solely for the purposes set out below. We do not use your data for any purpose not listed here without first obtaining your additional consent:

• Platform service delivery — registering and managing your account, processing deposits and withdrawals via DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, or FPX, and providing access to all games and features on the cili88 platform.
• Identity verification (KYC) — verifying that you meet the minimum age requirement of 18 years, confirming ownership of your payment method, and ensuring compliance with applicable anti-money laundering (AML) legal requirements.
• Platform security — detecting and preventing fraud, bot usage, bonus abuse, and suspicious activity that could compromise the integrity of the platform or the safety of other players.
• Customer support — handling inquiries, complaints, and support requests you submit via live chat, email, or WhatsApp.
• VIP Program & Promotions — calculating VIP points, determining eligibility for cili88 promotions, and automatically crediting rewards based on your account activity.
• Platform improvements — analyzing usage patterns in aggregate (not individually) to improve platform design, speed, and overall user experience.
• Service communications — sending important account-related notifications such as transaction confirmations, policy updates, or security alerts. These are not marketing communications and cannot be unsubscribed from.
• Legal compliance — maintaining records required to meet statutory reporting obligations, responding to enquiries from competent authorities, and defending cili88's legal rights when necessary.

4 Data Sharing with Third Parties

Cili88 does not sell, rent, or disclose your personal data to third parties for their own marketing purposes. However, in the normal course of platform operations, there are specific situations in which your data may be shared with a limited number of third parties, namely:

• Payment service providers — payment gateways that process DuitNow, Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and FPX transactions. They receive only the information necessary to process each transaction and are bound by strict confidentiality agreements and PCI-DSS standards.
• Game providers — platforms such as Evolution Gaming or Pragmatic Play may receive your player ID and session data as required to deliver games to you. They do not receive your full identity information or financial data.
• Technical service providers — cloud infrastructure companies, fraud detection services, and analytics tools that help cili88 operate — all bound by strict data processing agreements and permitted to use your data only in accordance with cili88's instructions.
• Legal authorities — cili88 will disclose personal information where required to do so by a court order, warrant, or lawful request from Malaysian government authorities or relevant international regulatory bodies. In such circumstances, cili88 will endeavour to notify you in advance unless prohibited by law.

In all of the data-sharing cases described above, cili88 ensures that recipient parties maintain data protection standards equivalent to or higher than those we ourselves adhere to. Binding data processing agreements are signed with all third parties that handle cili88 user data.

5 cili88 Data Security Measures

Protecting your personal data is a non-negotiable technical and operational priority at cili88. The following are the security measures we apply on an ongoing basis:

• Data encryption in transit: All communications between your device and cili88's servers use TLS 1.3 with 256-bit encryption. This ensures no third party can read the data transmitted, including when you make deposits or withdrawals.
• Stored data encryption: Sensitive data stored in cili88's databases — including account information and transaction records — is encrypted using AES-256 before being written to disk.
• Two-factor authentication (2FA): cili88 offers two-factor authentication for all accounts. We encourage all players to enable this feature as an added layer of security.
• 24/7 security monitoring: An automated monitoring system continuously watches platform traffic to detect unauthorized access attempts, brute force attacks, and suspicious patterns.
• Regular penetration testing: cili88 conducts regular security assessments by independent cybersecurity teams to identify and address potential vulnerabilities before they can be exploited.
• Controlled internal access: Our role-based access control (RBAC) system ensures that only staff who require access to specific data to carry out their duties are permitted to do so — and every access instance is logged for audit purposes.

6 Cookies & Tracking Technologies

The cili88 platform uses cookies and similar tracking technologies to deliver a better, faster, and more secure experience. Cookies are small text files stored on your device when you visit cili88.im.

Cili88 uses four main types of cookies:

• Essential Cookies: Required for core platform functionality — including login session verification, CSRF security, and language preferences. These cookies cannot be disabled as the platform will not function without them.
• Functional Cookies: Saving your preferences — such as favourite games, display settings, and notification choices — so you do not have to reconfigure them each time you log in.
• Analytics Cookies: Helping us understand how players use the platform — which pages are visited most frequently, where players tend to drop off, and which features are most popular. This data is used in aggregate form to improve the cili88 platform and is not used to identify any individual.
• Security Cookies: Used by the fraud detection system to identify suspicious patterns and protect your account from unauthorized access.

You can control or block cookies through your web browser settings. Please note, however, that blocking essential cookies may affect the functionality of the cili88 platform, including your ability to log in and process transactions. For more information on managing cookies in your browser, refer to your browser's help documentation.

7 Data Retention & Deletion

Cili88 retains your personal data for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal obligations. The following are general retention guidelines for each data category:

• Active account data: Retained for the duration your account is active on cili88, plus an additional 5 years after account closure for AML legal compliance and financial record-keeping purposes.
• Financial transaction records: Retained for 7 years from the date of the transaction, in compliance with financial reporting and audit requirements.
• Support communication logs: Retained for 2 years after case resolution, or longer if the communication is connected to an ongoing legal matter.
• Technical and access logs: Retained for 12 months for security and audit purposes, then automatically deleted.
• Marketing data (if you have consented): Retained until you withdraw your consent to receive marketing communications.

Once the retention period expires, data is securely deleted using methods that ensure it cannot be recovered. For data held in backup form, deletion may take up to an additional 90 days after the active record has been removed.

If you request the closure of your cili88 account, your personal data will be anonymised or deleted within 30 days, unless a legal obligation requires us to retain certain information for a longer period (for example, transaction records for tax reporting and AML purposes).

8 Your Personal Data Rights

As a cili88 user, you have the following rights regarding your personal data. We fully respect and support the exercise of these rights:

To exercise any of the rights above, contact the cili88 privacy team via support@cili88.im with the email subject line "Privacy Rights Request", specifying the right you wish to exercise along with your account details for identity verification. cili88 will process your request within 14 business days from the date your identity is successfully verified.

9 Children's Data Protection

The cili88 platform is exclusively for individuals aged 18 years and above. cili88 does not accept registrations from children or minors and does not knowingly collect any personal data from them.

All cili88 registration processes include strict age verification. Should cili88 find that we have collected data from individuals under the age of 18 without our knowledge, we will take immediate action to:

• Closing the account in question immediately.
• Permanently deleting all personal data collected from that individual.
• Returning any funds remaining in the account to the original payment method.

10 Changes to this Privacy Policy

Cili88 reserves the right to amend or update this Privacy Policy at any time to reflect changes in our data practices, new legal requirements, or added platform features. The policy will be updated with a new "Updated" date at the top of this page.

For material changes — that is, changes that significantly alter how we use or share your personal data — cili88 will:

• Sending a notification via email to your registered address at least 14 days before the changes take effect.
• Displaying a clear notice on the cili88 platform homepage about upcoming changes.
• In certain cases, seeking your consent again where a change requires a new consent basis.

Continued use of the cili88 platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account and request data deletion in accordance with the procedure outlined in Section 8.

11 Contact Us About Privacy

If you have any questions, concerns, or complaints regarding how cili88 handles your personal data, our privacy team is ready to assist through the following channels:

• Privacy Email: support@cili88.im — use the subject line "Privacy Inquiry" for faster processing. We respond within 2 to 6 hours.
• Live Chat: Available on the cili88 platform 24 hours a day, 7 days a week — for immediate privacy-related enquiries.
• WhatsApp: Number available after logging in to your cili88 account.

All privacy-related enquiries and complaints are handled by cili88's dedicated data compliance team, not general customer support. We are committed to acknowledging receipt of your enquiry within 24 hours and providing a full response within 14 business days.

If you are not satisfied with cili88's response to your privacy complaint after going through our internal process, you have the right to escalate the matter to the relevant regulatory body or authority in your jurisdiction. cili88 will cooperate fully with any investigation conducted by a lawful authority.