Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how vcity188 ("Platform", "we", "us", or "our") collects, uses, stores, processes, and protects personal data provided by or obtained from users ("User", "Player", "you") who access or use the vcity188 website located at https://vcity188.cam, including all associated subdomains, mobile applications, APIs, and related services (collectively, the "Platform").

vcity188 is committed to protecting the privacy and personal data of all players who use our platform. We operate primarily for the benefit of players in Malaysia — including those based in Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and beyond — and we process all personal data in accordance with applicable data protection principles, including those enshrined in the Malaysian Personal Data Protection Act 2010 (PDPA) where applicable.

This Policy applies to all personal data collected in connection with your use of the Platform, including data submitted during account registration, KYC verification, deposit and withdrawal transactions, customer support interactions, and your general browsing activity on our website. By creating an account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

Definitions

For the purposes of this Policy, the following terms carry the meanings assigned below:

Personal Data We Collect

vcity188 collects personal data from Users across several touchpoints throughout the lifecycle of their account and use of the Platform. The categories of personal data we collect include:

• Full legal name as it appears on your national identification document.
• Date of birth (used to verify compliance with our 21+ age requirement).
• Gender (optional, for personalisation purposes).
• Email address used to create and manage your account.
• Mobile phone number for account security notifications and, where opted into, promotional messages.
• Username and encrypted password hash.
• Residential address including city, state, and postcode (e.g., Kuala Lumpur, Penang, Johor Bahru).

• Scanned or photographed copy of your Malaysian identity card (MyKad), passport, or driver's licence.
• Proof of residential address such as a utility bill (TNB, Syabas, Unifi, Maxis) or bank statement dated within three months.
• Selfie or liveness verification photograph where requested for enhanced identity confirmation.

• Deposit and withdrawal records including amounts, timestamps, and payment method identifiers.
• Payment method details — e-wallet identifiers (Touch 'n Go, Boost, GrabPay), DuitNow registered mobile or IC number, bank account details for FPX transactions (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency wallet addresses for USDT transactions.
• Account balance history and transaction ledger entries.
• Bonus claim records and wagering activity logs.

• IP address and approximate geolocation derived therefrom.
• Browser type, version, and operating system.
• Device type, model, and unique device identifiers.
• Session duration, page views, and navigation paths on the Platform.
• Referral source data where applicable.

• Contents of customer support interactions via live chat, WhatsApp, or email correspondence with [email protected].
• Records of promotional communications sent to you and your response or engagement data.
• Complaints, feedback, and dispute correspondence.

How We Collect Your Data

vcity188 collects personal data through the following means:

• Direct submission: Data you voluntarily provide during account registration, KYC submission, deposit or withdrawal requests, support enquiries, and participation in promotional activities.
• Automated collection: Data collected automatically via cookies, web beacons, server logs, and similar tracking technologies as you interact with the Platform. See Section 8 for details on our cookies policy.
• Third-party sources: Identity and fraud-check data received from KYC verification partners; payment confirmation data received from payment processors (Touch 'n Go, DuitNow, FPX, etc.); fraud prevention signals from our risk management partners.
• Inferred data: Behavioural and preference data inferred from your gaming activity, betting history, and engagement patterns on the Platform, used for responsible gambling monitoring and personalised experience delivery.

Data Processing — How and Why We Use Your Data

vcity188 processes your personal data for the following specific and legitimate purposes:

We do not process your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis for the new processing activity.

Legal Basis for Processing

vcity188 relies on the following legal bases to process your personal data, consistent with data protection principles applicable in Malaysia and internationally recognised standards:

• Contractual necessity: Processing required to perform the contract between you and vcity188 — including account management, game provision, payment processing, and customer support.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) obligations, KYC/identity verification requirements, and fraud prevention duties.
• Legitimate interests: Processing carried out in pursuit of vcity188's legitimate business interests, including platform security, fraud detection, responsible gambling monitoring, and analytics — provided such interests do not override your fundamental privacy rights.
• Consent: Processing based on your explicit opt-in consent, specifically for promotional and marketing communications. You may withdraw this consent at any time by contacting our support team or using the unsubscribe mechanism in any promotional communication.

Data Sharing and Third-Party Disclosure

vcity188 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share personal data with third parties only in the circumstances described below, and only to the minimum extent necessary for the specific purpose:

We engage trusted third-party service providers who process personal data strictly on our behalf and under formal data processing agreements. These include:

• Payment processing providers (Touch 'n Go eWallet, DuitNow, GrabPay, Boost, Maybank, CIMB, FPX network operators, and USDT processing partners).
• KYC and identity verification service providers.
• Fraud detection and anti-money laundering (AML) screening providers.
• Cloud infrastructure and data hosting providers.
• Customer support platform providers (live chat and ticketing system operators).
• Email and SMS communication service providers.

vcity188 may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other competent authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, property, or safety of vcity188, our players, or the public. Any such disclosure will be made to the minimum extent required by law.

In the event of a merger, acquisition, corporate restructuring, or sale of assets involving vcity188, personal data held by us may be transferred to the acquiring entity. We will notify affected Users of any such transfer via a prominent notice on the Platform prior to the transfer taking effect, and your data will remain protected under terms no less protective than this Policy.

Cookies and Tracking Technologies

vcity188 uses cookies and similar tracking technologies to operate, improve, and personalise the Platform experience. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies: Required for the Platform to function correctly. These enable session management, login authentication, and security features. They cannot be disabled without impairing Platform functionality.
• Functional cookies: Allow the Platform to remember your preferences such as language, game history, and display settings, providing a more personalised experience.
• Performance and analytics cookies: Collect anonymised data about how visitors interact with the Platform, such as pages visited, time spent, and error reports. This data helps us improve the Platform's performance and usability.
• Security and fraud-prevention cookies: Used to detect and prevent fraudulent activity, multi-accounting, and bot traffic on the Platform.

You may manage or disable non-essential cookies via your browser settings. Please note that disabling certain cookies may affect the availability and functionality of some Platform features. vcity188 does not use third-party advertising or cross-site tracking cookies.

Data Retention

vcity188 retains your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention principles apply:

• Active account data: Retained for the duration of your account's active status plus a minimum of five (5) years following account closure, in accordance with applicable AML and record-keeping obligations.
• KYC documents: Retained for a minimum of five (5) years following the end of the business relationship, consistent with standard financial record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required for audit and compliance purposes.
• Support communications: Retained for up to three (3) years from the date of the last interaction, or longer if the communication forms part of an active dispute or legal proceeding.
• Cookie and analytics data: Retained for up to thirteen (13) months from the date of collection.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents identification or reconstruction of the original data.

Data Security

vcity188 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and our servers.
• Encryption at rest for all sensitive personal data stored on our infrastructure.
• Role-based access controls limiting internal access to personal data to personnel who require it to perform their specific job functions.
• Regular penetration testing and independent security audits of Platform systems and infrastructure.
• Multi-factor authentication requirements for Platform administrative access.
• Continuous monitoring and intrusion detection systems for real-time threat identification.
• Formal incident response procedures with defined notification timelines in the event of a data security breach.

While we take all reasonable steps to protect your personal data, no transmission over the internet or method of electronic storage is completely secure. In the unlikely event of a data breach that affects your personal data, we will notify you promptly in accordance with our obligations under applicable data protection law.

Your Rights as a Data Subject

As a User of the vcity188 Platform, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at the details provided in Section 14 of this Policy. We will respond to all valid requests within thirty (30) days.

Children's Privacy and the 21+ Age Policy

vcity188 enforces a strict minimum age requirement of twenty-one (21) years for all Platform users. The Platform and all its gaming services are not directed at, marketed to, or intended for use by any person under the age of 21. We do not knowingly collect personal data from individuals below this age threshold.

We apply mandatory KYC age verification to all accounts before withdrawal processing is permitted, and we reserve the right to request age verification documentation at any point. In cases where we discover that personal data has been collected from a User who did not meet the 21+ requirement at the time of collection, we will take immediate steps to delete that data, close the associated account, and refund deposited amounts in accordance with our Terms and Conditions.

If you are a parent or guardian and believe your child has registered an account on vcity188 without your knowledge, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

Updates to This Privacy Policy

vcity188 reviews and updates this Privacy Policy periodically to reflect changes in our data processing activities, applicable legal requirements, or Platform functionality. When we make material changes to this Policy, we will notify you through one or more of the following channels: a prominent notice displayed within the Platform, an email notification to your registered email address, or a revised effective date shown at the top of this page.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes and your acceptance of the revised terms. We recommend that you review this page each time you access the Platform after an extended absence to ensure you are familiar with the current version.

Where a proposed update would involve a materially different use of your personal data compared to the purpose for which it was originally collected, we will seek your affirmative consent before applying the new processing activity to your existing data.

Contact Us — Data and Privacy Enquiries

If you wish to exercise any of your data subject rights, make a privacy-related enquiry, or raise a complaint about how we have handled your personal data, please contact our support team using the details below. All privacy and data-related requests will be handled by our designated team with priority.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your concern to the relevant data protection authority in your jurisdiction. In Malaysia, the supervisory authority for personal data protection matters is the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) under the Ministry of Communications and Digital.