Privacy Policy — cici100

This Privacy Policy ("Policy") describes how cici100 ("the Company", "we", "us", "our"), operator of the online gaming platform at cici100.cam, collects, processes, stores, shares, and protects the personal data of individuals ("you", "the User", "the Player") who visit, register on, or otherwise interact with the Platform.

This Policy applies to all personal data collected through the Platform, including but not limited to data provided during account registration, identity verification (KYC), payment processing, customer support interactions, and general platform usage. It should be read alongside our Terms and Conditions, which govern the overall contractual relationship between you and cici100.

By registering an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.

The following definitions apply throughout this Policy:

• "Personal Data" — any information that identifies or can be used to identify a natural person, directly or indirectly. This includes name, identification number, contact details, financial information, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, use, disclosure, transmission, erasure, or destruction.
• "Data Controller" — the Company, as the entity that determines the purposes and means of processing personal data.
• "Data Processor" — a third party that processes personal data on behalf of the Company under contractual instruction.
• "KYC" — Know Your Customer; the identity and age verification process required before a Player can complete financial transactions on the Platform.
• "Cookie" — a small text file placed on a User's device by the Platform for purposes described in Clause 8 of this Policy.
• "Platform" — the website cici100.cam, its mobile-optimised interface, and all associated services operated by the Company.

cici100 collects the following categories of personal data in the course of providing its services:

We do not collect sensitive personal data such as race, religion, health information, or political opinions unless specifically required by law enforcement or regulatory order. We do not store full payment card numbers or full bank account credentials — financial transactions are handled through third-party payment processors who are bound by their own data security standards.

cici100 collects personal data through the following channels:

• Direct Submission: Information you provide when creating an account, completing the KYC process, making a deposit or withdrawal, contacting support, or responding to a survey or promotion. This includes data submitted through registration forms, identity upload tools, and live chat.
• Automated Technical Collection: Data gathered automatically when you access and use the Platform, including IP address, device identifiers, browser fingerprinting data, and session logs. This is collected through standard web server logs, session tracking, and analytics tools.
• Payment Processors: Transaction confirmation data received from Malaysian payment service providers including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency processing gateways. The payment processors themselves may collect and process additional data under their own privacy policies.
• Cookies and Tracking Technologies: Data collected through cookies, web beacons, and similar technologies as described in Clause 8 of this Policy.
• Third-Party Verification Services: Identity and document verification data returned by third-party KYC service providers engaged by the Company to validate identity documents and cross-reference databases for fraud and AML screening purposes.

cici100 processes personal data only for documented, legitimate purposes. The specific purposes for which each category of data is processed are as follows:

• Account Management: To create, maintain, and manage your Player Account, including authentication, account settings, and communication preferences.
• Identity Verification (KYC): To verify your age (21+ requirement), identity, and address in compliance with the Company's anti-fraud, anti-money laundering, and responsible gambling obligations. This is a mandatory requirement and cannot be opted out of.
• Payment Processing: To facilitate deposit and withdrawal transactions via supported Malaysian payment methods, including verification of transaction source and destination accounts.
• Service Delivery: To provide access to the Platform's gaming services, including live casino, sports betting markets (Liga Super Malaysia, EPL, UFC, etc.), and slot games, and to track game history and betting records.
• Customer Support: To respond to queries, resolve disputes, investigate complaints, and maintain records of support interactions for quality assurance purposes.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, multi-account abuse, bonus abuse, and unauthorised access to accounts.
• Regulatory Compliance: To fulfil obligations under the Company's international gaming licence, including record-keeping, reporting to licensing authorities, and cooperation with lawful requests from competent authorities.
• Marketing Communications: To send promotional emails, SMS messages, and in-platform notifications about bonuses, promotions, and new features — only where you have provided explicit consent or where permitted under applicable law. You may withdraw consent at any time through your account settings.
• Platform Improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall platform experience.

The Company processes personal data on the following legal grounds, depending on the category of data and the purpose of processing:

• Contractual Necessity: Processing required to perform the contract between you and cici100, including account management, payment processing, and the provision of gaming services.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements, including KYC verification, AML screening, and record-keeping obligations under the Company's licensing framework.
• Legitimate Interests: Processing for purposes that are in the legitimate business interests of the Company and are not overridden by your rights and interests, including fraud prevention, platform security, and internal analytics.
• Consent: Processing for optional purposes — primarily marketing communications — where you have given explicit, informed consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

cici100 does not sell, rent, or trade personal data. We share data only in the following limited circumstances, and only to the extent necessary for each purpose:

• Payment Service Providers: Transaction data is shared with Malaysian payment processors — including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX operators, and cryptocurrency gateways — to facilitate financial transactions. These providers are contractually bound to protect your data and are prohibited from using it for their own marketing purposes.
• KYC and AML Service Providers: Identity documents and verification data may be shared with third-party KYC verification platforms and AML screening services engaged by the Company for compliance purposes. These providers operate under strict data processing agreements.
• Gaming Software Providers: Certain game outcome and session data may be shared with the third-party software providers who supply the games available on the Platform, for the purpose of game record maintenance and dispute resolution.
• Licensing Authorities: The Company may be required to submit player data to its licensing authority as part of its regulatory obligations. Such disclosures are governed by the terms of the Company's licence.
• Law Enforcement and Legal Proceedings: The Company may disclose personal data to law enforcement agencies, courts, or regulatory bodies where required to do so by applicable law, court order, or other lawful legal process. Where permitted, the Company will notify the affected Player of such a request.
• Corporate Transactions: In the event of a merger, acquisition, or transfer of business operations, personal data held by the Company may be transferred to the acquiring or successor entity, subject to the same obligations set out in this Policy.

cici100 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device by your browser when you visit the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged into your account, security tokens, and load-balancing cookies. These cannot be disabled without significantly impairing your ability to use the Platform.
• Functional Cookies: Used to remember your preferences, such as language settings, display preferences, and game session states. These improve your experience but are not essential to core functionality.
• Analytics Cookies: Used to collect aggregated, anonymised information about how Players use the Platform — such as which pages are visited most frequently and how long sessions last. This data is used solely for internal platform improvement purposes.
• Security Cookies: Used to detect and prevent fraudulent activity, bot access, and account takeover attempts.

You may manage cookie preferences through your browser settings. Note that disabling certain categories of cookies may affect the functionality of the Platform. The Company does not use third-party advertising cookies or behavioural tracking cookies for cross-site advertising purposes.

cici100 implements a range of technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL (Secure Sockets Layer) encryption for all data transmitted between the Player's device and the Platform's servers.
• Encrypted storage of sensitive personal data, including identity document images and financial transaction records.
• Strict access controls limiting to personal data to authorised personnel only, on a need-to-know basis.
• Two-factor authentication options for Player accounts and mandatory multi-factor authentication for internal staff access to data systems.
• Regular security assessments and penetration testing of the Platform's infrastructure.
• Segregated storage of Player funds, maintained in accounts separate from operational finances.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. Players are also responsible for maintaining the security of their own account credentials. The Company cannot be held liable for security breaches arising from a Player's failure to protect their own login information.

cici100 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal regulatory, or contractual obligations.

• Active Accounts: Personal data is retained for the duration of the Player's account being active on the Platform.
• Closed Accounts: Following account closure, the Company retains identity data, transaction records, and KYC documentation for a minimum period of five (5) years from the date of account closure, in compliance with anti-money laundering record-keeping obligations under the Company's licensing framework.
• Marketing Data: Marketing consent records and communication preferences are retained for as long as you maintain an account. If you withdraw consent, we will cease sending marketing communications promptly, but may retain a record of your preference for compliance purposes.
• Support Records: Customer support interaction records are retained for a period of three (3) years from the date of the interaction, for dispute resolution and quality assurance purposes.
• Technical Logs: Server logs, access records, and session data are typically retained for a period of twelve (12) months, after which they are anonymised or deleted.

When personal data is no longer required for its stated purpose and no legal retention obligation applies, it is securely deleted or anonymised in manner that prevents re-identification.

Subject to applicable law and certain limitations, you have the following rights in relation to your personal data held by cici100: