vcity33 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

1.Introduction

vcity33 ("the Platform," "we," "us," "our") is committed to protecting the privacy and personal data of all users who access vcity33.org and use our gaming services ("the Services"). This Privacy Policy ("Policy") explains what personal information we collect, why we collect it, how we use and protect it, with whom we may share it, and what rights you have regarding your data.

This Policy applies to all users of the vcity33 platform, including registered account holders and visitors who browse the site without creating an account. By using the Services, you acknowledge that you have read and understood this Policy and consent to the data practices described herein. This Policy should be read in conjunction with our Terms & Conditions.

2.Data Controller

vcity33 acts as the data controller in respect of personal data collected through vcity33.org and the associated Services. As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with applicable data protection law.

For data protection enquiries, including requests to exercise your data subject rights, please contact our support team. Our contact email is displayed in plain text format: [email protected] — this is not a clickable link and should not be used as such.

3.Personal Data We Collect

vcity33 collects personal data in the following categories:

• Identity Data: Full legal name, date of birth, nationality, and identity document details (MyKad number, passport number, or driving licence number) collected during KYC verification.
• Contact Data: Email address, phone number, and correspondence records (including support chat and email exchanges).
• Financial Data: Payment method details, transaction history, deposit and withdrawal records, and wallet balance history. We do not store full card numbers; payment instrument data is tokenised through our payment processor.
• Account Data: Username, encrypted password hash, account registration date, login timestamps, device identifiers used for login, and IP addresses.
• Gameplay Data: Game session records, bet amounts and outcomes, game history, bonus usage, and responsible gaming settings (deposit limits, session limits, self-exclusion status).
• Technical Data: Browser type and version, operating system, referring URLs, pages visited on vcity33.org, session duration, and device type. This data is collected automatically via server logs and analytics tools.
• KYC Documentation: Copies of identity documents and proof of address submitted during verification. These are stored securely and used solely for verification and regulatory compliance purposes.

We do not knowingly collect sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric identifiers) except where explicitly required by our regulatory obligations.

4.How We Use Your Personal Data

vcity33 uses your personal data for the following purposes:

• Account Management: To create, maintain, and manage your vcity33 player account, including processing your registration, verifying your identity through KYC, and maintaining your account security.
• Service Delivery: To provide access to the gaming platform, process deposits and withdrawals, credit bonuses, display your gameplay history, and deliver all features of the Services you use.
• Legal and Regulatory Compliance: To comply with anti-money laundering (AML) obligations, gaming authority requirements, age verification mandates, and any other applicable law. This includes retaining transaction and identity records for the periods required by law.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, unauthorised access, collusion, and other prohibited conduct. We may use automated systems for anomaly detection as part of this process.
• Responsible Gaming: To administer and enforce responsible gaming tools including deposit limits, session reminders, and self-exclusion periods. We may use gameplay data to identify players who may be exhibiting signs of problem gambling.
• Customer Support: To respond to your support queries, complaints, and correspondence, and to maintain records of communications where required for dispute resolution.
• Platform Improvement: To analyse aggregated, anonymised usage data to improve platform performance, game selection, user experience, and the quality of our Services.
• Marketing Communications: To send you promotional offers and platform updates where you have opted in to receive such communications. You may opt out at any time by updating your communication preferences in your account settings.

5.Legal Basis for Processing

Under applicable data protection law, vcity33 processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract between you and vcity33 (i.e., to provide the Services you have registered to use).
• Legal Obligation: Processing required to comply with AML regulations, gaming authority requirements, age verification law, tax reporting obligations, and other applicable legal requirements.
• Legitimate Interests: Processing necessary for our legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and business analytics, where those interests are not overridden by your rights.
• Consent: Processing for marketing communications, where you have provided explicit opt-in consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6.Sharing Your Personal Data

vcity33 does not sell, rent, or trade your personal data to third parties. We may share your data with the following categories of recipients only where necessary and on a strict need-to-know basis:

• Payment Processors: To process your deposits and withdrawals. Payment processors (including Touch 'n Go eWallet, Boost, DuitNow, and bank transfer processors) receive only the data necessary to execute transactions.
• Game Providers: Certified game providers receive anonymised or pseudonymised player session data as required for RNG operation and game outcome recording. They do not receive your full identity data.
• KYC Verification Providers: Third-party identity verification services receive your identity document data to perform KYC checks on our behalf. These providers operate under data processing agreements with vcity33.
• Regulatory Authorities: Gaming authority regulators, financial intelligence units, and law enforcement agencies may receive data where required by law, court order, or regulatory direction.
• Service Providers: Cloud hosting, customer support platform, and analytics service providers acting as data processors under contract. These providers may not use your data for their own purposes.

All third-party data processors engaged by vcity33 are required to implement appropriate technical and organisational security measures and to process data only on our documented instructions.

7.Cookies and Tracking Technologies

The vcity33 platform uses cookies and similar tracking technologies to operate the website, maintain your logged-in session, remember your preferences, and collect analytics data. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the website to function. These include session cookies that maintain your logged-in state. They cannot be disabled without breaking core platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how visitors use vcity33.org. This helps us improve the platform. These cookies do not identify you personally.
• Preference Cookies: Used to remember your language, display settings, and game preferences across sessions.

You may control or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the vcity33 platform.

8.Data Security

vcity33 implements technical and organisational measures appropriate to the risk level of the data we process. These measures include 256-bit SSL/TLS encryption on all data in transit, AES-256 encryption for sensitive data at rest, hashed password storage (your password is never stored in readable form), role-based access controls limiting staff access to personal data on a need-to-know basis, regular third-party security audits, and intrusion detection monitoring on our server infrastructure.

While we take data security seriously, no online platform can guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, vcity33 will notify affected players and relevant regulatory authorities in accordance with applicable legal requirements.

9.Data Retention

vcity33 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following retention guidelines:

• Active Account Data: Retained for the duration of your account relationship with vcity33 plus an additional period as required by applicable law.
• KYC and Identity Documents: Retained for a minimum of five (5) years following account closure, as required by anti-money laundering regulations applicable in our licensing jurisdiction.
• Transaction Records: Retained for a minimum of five (5) years following the date of each transaction, in line with AML record-keeping requirements.
• Support Communications: Retained for three (3) years from the date of the last communication, for dispute resolution purposes.
• Marketing Consent Records: Retained until consent is withdrawn plus three (3) years, to demonstrate the lawful basis for prior communications.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

10.Your Data Protection Rights

Subject to applicable law and certain regulatory exceptions (particularly in relation to AML and gaming authority obligations), you have the following rights regarding your personal data held by vcity33:

• Right of Access: To request a copy of the personal data we hold about you.
• Right of Rectification: To request correction of inaccurate or incomplete personal data.
• Right of Erasure: To request deletion of your personal data where there is no overriding legal obligation to retain it.
• Right to Restrict Processing: To request that we limit how we use your data in certain circumstances.
• Right to Data Portability: To receive a copy of your personal data in a machine-readable format where processing is based on consent or contract.
• Right to Object: To object to processing based on legitimate interests, including profiling for responsible gaming purposes, where your individual circumstances override those interests.
• Right to Withdraw Consent: To withdraw consent for marketing communications at any time without affecting prior lawful processing.

To exercise any of the above rights, contact us via the support email address displayed in plain text throughout this policy. We will respond within thirty (30) days of receiving a valid request.

11.Children and Minors

The vcity33 platform is strictly for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you believe a minor has registered on the platform or provided us with personal data, please contact us immediately so we can take appropriate action, including account termination and data deletion. KYC verification is mandatory precisely to prevent underage access to the platform.

12.International Data Transfers

As an online platform serving Malaysian players with server infrastructure and service providers located in various jurisdictions, your personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, vcity33 ensures that appropriate safeguards are in place — including contractual data processing agreements with standard data protection clauses — to provide an equivalent level of protection to that required under the Personal Data Protection Act 2010 (Malaysia) and applicable international frameworks.

13.Changes to This Privacy Policy

vcity33 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or platform features. Material changes will be communicated to registered account holders via the email address on file at least seven (7) days before the effective date. The "Last Updated" date at the top of this page indicates when the current version was published. We encourage you to review this Policy periodically. Continued use of the platform after the effective date of an updated Policy constitutes acceptance of the revised terms.

14.Contact Us

For privacy-related enquiries, data subject access requests, or to raise a concern about our data practices, please contact the vcity33 data protection contact via our support team. Our support email is displayed in plain text: [email protected] — this is not a clickable link. Support is available 24 hours a day, 7 days a week. Formal data subject requests will be acknowledged within five (5) business days and actioned within thirty (30) days.