Privacy Policy — cilli88 Online Gaming Platform

1. Controller Identity

This Privacy Policy is issued by cilli88 ("cilli88", "the Company", "we", "our", "us"), the operator of the online gaming platform accessible at cilli88.org. cilli88 acts as the data controller in respect of personal data collected from Members and visitors to the cilli88 platform.

For all data protection enquiries, including the exercise of your data subject rights, please contact our Data Protection team using the contact details provided in Section 13 of this Policy.

By registering an account with cilli88 or otherwise using our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Privacy Policy, you must not use the cilli88 platform.

2. Data We Collect

cilli88 collects personal data in the following categories:

Identity Data: Full legal name; date of birth; nationality; government-issued identification number (Malaysian IC or passport number); copies of identity documents submitted during KYC verification.

Contact Data: Email address; Malaysian mobile telephone number; residential address.

Financial Data: Payment method details (e-wallet identifiers such as Touch 'n Go eWallet, Boost, GrabPay, or DuitNow account references; FPX bank account identifiers; partial bank account numbers as required for withdrawal processing); transaction history including deposit and withdrawal records.

Account Data: Username; account ID; account status; communication preferences; self-imposed gaming limits; self-exclusion status.

Technical Data: IP address; device identifiers; browser type and version; operating system; session data; pages visited; features accessed; time and duration of platform use.

Gaming Activity Data: Betting history; game session records; wagering patterns; win/loss records across all cilli88 products (Sportsbook, Live Casino, Slots, Lottery, Toto 4D).

Communications Data: Records of communications between you and cilli88 customer support, including live chat transcripts and email correspondence.

cilli88 does not knowingly collect special categories of sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where this is incidentally disclosed in identity documents submitted for KYC purposes, in which case such data is used solely for identity verification.

3. How We Use Your Data

cilli88 uses your personal data for the following purposes:

• Account Registration and Management: To create, administer, and maintain your cilli88 account, verify your identity, and communicate essential account information.
• KYC Verification: To verify your age (21+), identity, and source of funds in compliance with our licensing obligations and anti-money laundering requirements.
• Payment Processing: To process deposits and withdrawals via your chosen Malaysian payment method, and to verify that payment methods are registered in your own name.
• Service Delivery: To provide access to cilli88's Sportsbook, Live Casino, Slots, Lottery, and Toto 4D products; to record and settle bets; and to manage your account balance.
• Responsible Gaming: To monitor gaming patterns for indicators of problem gambling; to apply and enforce deposit limits, session limits, and self-exclusion requests; and to facilitate referrals to responsible gaming support services.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, and other prohibited conduct on the cilli88 platform.
• Legal and Regulatory Compliance: To comply with applicable laws, gaming authority licensing requirements, anti-money laundering regulations, and responding to lawful requests from regulatory authorities.
• Customer Support: To respond to your enquiries and resolve complaints via live chat or email.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve cilli88's products, features, and user experience.
• Marketing Communications: Where you have opted in to receive marketing communications, to send you information about cilli88 promotions, offers, and new product features. You may opt out at any time.

4. Legal Basis for Processing

cilli88 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and cilli88 — including account creation, KYC, payment processing, and delivery of gaming services.
• Legal Obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering legislation, gaming licensing requirements, and lawful regulatory requests.
• Legitimate Interests: Processing carried out for cilli88's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided such processing is proportionate and does not override your fundamental rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.

5. Data Sharing

cilli88 does not sell your personal data. We share your data with third parties only in the following circumstances and only to the extent necessary:

• Payment Processors: Financial data is shared with payment service providers (including e-wallet operators, FPX network providers, and Malaysian banks) solely for the purpose of processing transactions.
• KYC and Identity Verification Providers: Identity documents and verification data may be shared with third-party KYC service providers engaged by cilli88 to perform identity and age verification checks.
• Gaming Software Providers: Game session data is shared with the relevant certified game provider (e.g., live casino studio operators, slot software providers) to the extent required to deliver and settle game outcomes.
• Regulatory and Law Enforcement Authorities: Personal data will be disclosed to gaming authority regulators, financial intelligence units, or law enforcement agencies where required by applicable law or a lawful order.
• Professional Advisers: Legal, accounting, and auditing advisers engaged by cilli88 may access personal data to the extent required to provide professional services, subject to duties of confidentiality.

All third parties with whom cilli88 shares personal data are required to process such data only for the specified purpose and in accordance with contractual data processing obligations consistent with this Privacy Policy.

6. Cookies & Tracking Technologies

cilli88 uses cookies and similar tracking technologies on the cilli88.org website to support platform functionality, analyse usage patterns, and improve user experience. The following cookie categories are used:

• Strictly Necessary Cookies: Essential for platform operation — including session authentication, security token management, and load balancing. These cannot be disabled without impairing platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Members navigate and use the cilli88 platform — for example, which pages are visited most frequently and how long sessions last. This data is used exclusively for internal platform improvement purposes.
• Preference Cookies: Used to remember your account preferences and settings (such as language and display preferences) to personalise your cilli88 experience.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to log in to or use the cilli88 platform. cilli88 does not use advertising cookies or share tracking data with ad networks.

7. Data Retention

cilli88 retains personal data for the following periods:

• Active Account Data: Retained throughout the period your account remains active and for a minimum of 5 years following account closure, in compliance with anti-money laundering and gaming licensing record-keeping obligations.
• KYC Documents: Retained for the minimum period required by applicable AML legislation from the date of submission or account closure, whichever is later.
• Transaction Records: Retained for a minimum of 5 years following the date of the transaction for legal and regulatory compliance purposes.
• Customer Support Communications: Retained for 3 years following the closure of the relevant support ticket or enquiry, or longer where required in connection with ongoing legal or regulatory proceedings.
• Technical and Log Data: Typically retained for 12 months unless extended retention is required for security investigation or legal purposes.
• Marketing Preferences: Opt-in consent records are retained for the duration of your consent and for a reasonable period thereafter for compliance purposes.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised.

8. Security Measures

cilli88 implements comprehensive technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including:

• TLS 1.3 encryption for all data transmitted between your device and the cilli88 platform;
• AES-256 encryption for personal and financial data stored at rest;
• Role-based access controls limiting employee access to personal data to those with a legitimate operational need;
• Multi-factor authentication required for all administrative access to systems holding personal data;
• Regular penetration testing and vulnerability assessments by qualified third-party security professionals;
• Documented incident response procedures enabling prompt identification, containment, and notification of personal data breaches where required by law.

You are responsible for maintaining the security of your own cilli88 account credentials. cilli88 strongly recommends enabling two-factor authentication on your account. Never share your password with any third party, including persons claiming to represent cilli88 — our support team will never ask for your password.

9. Your Rights

Subject to applicable data protection law, you have the following rights in respect of your personal data held by cilli88:

• Right of Access: To request a copy of the personal data we hold about you and information about how it is processed.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where we no longer have a lawful basis to retain it (subject to our legal and regulatory retention obligations).
• Right to Restriction: To request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data you have disputed is verified.
• Right to Data Portability: To receive a copy of personal data you have provided to cilli88 in a structured, machine-readable format.
• Right to Object: To object to processing based on legitimate interests, including profiling for responsible gaming monitoring purposes, where you believe your fundamental rights override cilli88's legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing communications), to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact cilli88 using the details in Section 13. We will respond to all valid requests within 30 calendar days. Identity verification may be required before your request is processed.

10. International Data Transfers

Some of cilli88's service providers, including KYC verification partners and gaming software providers, may be located outside Malaysia or the jurisdiction in which cilli88 is licensed. Where personal data is transferred to third countries, cilli88 ensures that adequate safeguards are in place — such as standard contractual clauses, adequacy decisions, or equivalent mechanisms — to protect the rights of data subjects consistent with this Privacy Policy.

By registering an account with cilli88, you acknowledge that your personal data may be transferred and processed in jurisdictions outside Malaysia. cilli88 will only authorise such transfers where appropriate safeguards have been implemented.

11. Children's Privacy

The cilli88 platform is strictly prohibited for use by persons under the age of 21 years. cilli88 does not knowingly collect personal data from individuals under 21. Age verification is a mandatory part of the KYC process for all new accounts.

If cilli88 becomes aware that personal data has been collected from a person under 21 without appropriate age verification having been completed, we will immediately suspend the relevant account and take steps to delete the associated personal data, subject to any legal retention obligations.

If you believe a person under 21 may have accessed or used the cilli88 platform, please contact our support team immediately at [email protected].

12. Changes to This Privacy Policy

cilli88 reserves the right to update this Privacy Policy at any time. The date of the most recent revision is displayed at the top of this page. Where changes are material, cilli88 will notify Members via the email address registered to their account or via a prominent notice on the cilli88 platform prior to the changes taking effect.

Your continued use of the cilli88 Services following the publication of a revised Privacy Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

13. Contact & Data Protection

For all data protection enquiries, requests to exercise your data subject rights, or questions regarding this Privacy Policy, please contact cilli88 using the following details:

• Email: [email protected] — please include "Data Privacy" in the subject line
• Live Chat: Available 24/7 via the cilli88 platform
• Response Time: We acknowledge all privacy requests within 5 business days and aim to resolve them within 30 calendar days

If you are dissatisfied with our handling of your personal data or our response to a data subject request, you have the right to lodge a complaint with the relevant data protection supervisory authority in the applicable jurisdiction. cilli88 encourages Members to contact us directly in the first instance so that we can attempt to resolve concerns promptly.

For general enquiries about your cilli88 account, responsible gaming support, or other platform matters, our customer support team is available 24/7 via live chat. Refer to our FAQ page for answers to common questions about your account and our services.