cly888 Privacy Policy — How We Handle Your Data

1. About This Privacy Policy

This Privacy Policy ("Policy") is issued by cly888 ("cly888", "we", "us", "our") and applies to all personal information collected through the cly888 website at cly888.net, associated mobile-optimised interfaces, customer support channels, and any other service operated under the cly888 brand (collectively, the "Service").

This Policy explains what personal data cly888 collects, the purposes for which it is used, the circumstances under which it may be shared, how long it is retained, and the rights available to you as a data subject. cly888 is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection legislation.

This Policy should be read alongside cly888's Terms & Conditions and Responsible Gaming Policy, each of which forms part of the contractual framework governing your use of the Service.

2. Personal Data We Collect

cly888 collects personal data in the following categories, depending on the nature of your interaction with the Service:

2.1 Registration & Identity Data

• Full legal name as it appears on your government-issued identity document
• Date of birth (for age verification purposes)
• Malaysian identity card number (MyKad) or passport number where required for KYC verification
• Residential address, city, state, and postcode
• Email address and Malaysian mobile telephone number
• Username and encrypted password credentials

2.2 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, dates, and payment methods used
• Touch 'n Go eWallet, Boost, DuitNow, or FPX account identifiers (partial or tokenised, not full credentials)
• Bank account details where provided for withdrawal processing (Maybank, CIMB, Public Bank, and others)
• Betting history, game participation records, and balance movement history

2.3 Technical & Usage Data

• IP address, device type, operating system, and browser type
• Pages visited, time spent on each page, click-through paths, and session duration
• Login timestamps, failed authentication attempts, and device fingerprint data used for fraud detection
• Geolocation data (country and region level) derived from your IP address

2.4 Communications Data

• Records of correspondence between you and cly888 support, including live chat transcripts, emails, and support ticket records
• Responses to surveys, feedback submissions, and promotional enquiries

2.5 Responsible Gaming Data

• Deposit limit, loss limit, and session time settings you have configured
• Self-exclusion status and exclusion period where applicable
• Responsible gaming tool usage history, maintained for regulatory compliance purposes

3. How We Use Your Personal Data

cly888 processes your personal data for the following purposes:

• Account creation and management: To register your account, verify your identity and age, maintain your account record, and provide access to the Service.
• Transaction processing: To process deposits, settle withdrawals, and maintain accurate financial records associated with your account.
• Service delivery: To provide access to sportsbook, live casino, slots, and arcade features; to process wagers; and to settle bets and distribute winnings.
• Customer support: To respond to your enquiries, resolve disputes, investigate complaints, and provide technical assistance.
• Security and fraud prevention: To detect and prevent unauthorised account access, money laundering, bonus abuse, multi-accounting, and other forms of fraud or system manipulation.
• Regulatory compliance: To comply with anti-money laundering (AML) obligations, know-your-customer (KYC) requirements, responsible gaming mandates, and other applicable legal or regulatory requirements.
• Responsible gaming: To administer deposit limits, loss limits, self-exclusion orders, and other player protection tools; to identify potential problem gambling behaviour and intervene appropriately.
• Platform improvement: To analyse usage patterns, identify technical issues, test new features, and improve the overall cly888 platform experience.
• Marketing communications: To send you promotional offers, bonus notifications, and service updates — subject to your communication preferences and applicable opt-out rights.

4. Legal Basis for Processing

cly888 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions you agreed to upon registration, including account management, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, KYC requirements, age verification mandates, and responsible gaming obligations.
• Legitimate interests: Processing undertaken for cly888's legitimate business interests, including fraud detection, security monitoring, platform analytics, and product improvement, where these interests are not overridden by your fundamental rights.
• Consent: Processing of data for optional purposes — including marketing communications and non-essential cookies — is conducted only where you have provided express consent, which you may withdraw at any time.

5. Sharing Your Personal Data

cly888 does not sell, rent, or trade your personal data. We may share your data with the following categories of third parties in the circumstances described:

• Payment service providers: Touch 'n Go, Boost, DuitNow operators, FPX, and participating Malaysian banks, to the extent necessary to process your deposit and withdrawal transactions.
• Game and technology providers: Licensed gaming studios and software providers whose games are accessible through cly888, solely to the extent required to deliver their services to you.
• Identity verification and KYC providers: Third-party identity verification service providers engaged to conduct age and identity checks as required by applicable regulations.
• Fraud and security providers: Third-party fraud detection and security analytics providers used to protect the integrity of the cly888 platform and its members.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or legitimate regulatory request. cly888 will notify you of any such disclosure where legally permitted to do so.
• Professional advisers: Legal counsel, auditors, and other professional advisers engaged by cly888, subject to confidentiality obligations.

All third parties with whom cly888 shares personal data are required to implement appropriate data protection measures and are permitted to use the data only for the specified purpose and in accordance with cly888's instructions.

6. Cookies & Similar Technologies

cly888 uses cookies and similar tracking technologies on the cly888.net website. Cookies are small text files placed on your device that help us deliver a functional, personalised, and secure experience. The types of cookies we use are:

• Essential cookies: Required for core platform functionality, including session management, authentication state, and security token validation. These cannot be disabled without impairing platform use.
• Performance and analytics cookies: Used to understand how visitors interact with cly888 pages, identify high-traffic sections, and detect technical errors. Data collected is aggregated and anonymised.
• Functionality cookies: Used to remember your preferences, such as language settings, display preferences, and previously entered information, to provide a more convenient experience on return visits.
• Security cookies: Used to detect and prevent fraudulent activity, bot traffic, and unauthorised access attempts.

You may manage cookie preferences through your browser settings. Disabling essential cookies may prevent certain cly888 features from functioning correctly. cly888 does not use third-party advertising or cross-site tracking cookies.

7. Data Retention

cly888 retains personal data for the following periods, or such longer period as required by applicable law:

• Account and identity data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, as required by applicable AML and gaming regulations.
• Transaction and financial records: Retained for a minimum of seven (7) years following the date of each transaction, in compliance with financial record-keeping requirements.
• Responsible gaming records: Retained for a minimum of five (5) years following the end of any self-exclusion period or the last use of a responsible gaming tool.
• Customer support records: Retained for three (3) years following the closure of the relevant support case.
• Marketing consent records: Retained for three (3) years following the withdrawal of consent or the last marketing communication sent, whichever is later.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with cly888's data destruction procedures.

8. Your Data Subject Rights

Subject to applicable law and the legitimate interests of cly888, you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data cly888 holds about you.
• Right of rectification: You may request correction of inaccurate or incomplete personal data.
• Right of erasure: You may request deletion of your personal data where retention is no longer necessary, subject to overriding legal obligations (such as AML retention requirements).
• Right to restrict processing: You may request that cly888 restrict processing of your data in certain circumstances, such as while a rectification request is under review.
• Right to data portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request a copy of your data in a structured, machine-readable format.
• Right to object: You may object to processing based on legitimate interests, including profiling, and to the use of your data for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact the cly888 Data Team at [email protected] with the subject line "Data Subject Request". cly888 will respond within thirty (30) days of receipt of a valid request.

9. Data Security

cly888 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

• 256-bit SSL/TLS encryption across all data transmission pathways between your device and cly888 servers
• Encrypted storage of sensitive personal and financial data at rest
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis
• Multi-factor authentication requirements for internal administrative systems
• Continuous security monitoring, intrusion detection systems, and regular independent security audits
• Incident response procedures designed to detect, contain, and notify affected parties of any data breach within required regulatory timeframes

10. International Data Transfers

Some of the third-party service providers engaged by cly888 — including gaming studios, technology platform providers, and security vendors — may be located in countries outside Malaysia. Where personal data is transferred to such providers, cly888 ensures that appropriate data transfer safeguards are in place, including contractual protections equivalent to those required under applicable Malaysian data protection law.

cly888 does not transfer personal data to jurisdictions that lack adequate legal protections without first implementing appropriate contractual safeguards and conducting a transfer impact assessment.

11. Third-Party Links

The cly888 platform does not contain links to external third-party websites. In the event that any such links are added in future, cly888 is not responsible for the privacy practices or content of linked third-party websites. You should review the privacy policy of any external site you visit independently of cly888.

12. Children's Privacy

cly888 is strictly an adult platform. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. The cly888 registration process includes mandatory age verification, and we reserve the right to request documentary proof of age from any member at any time.

If cly888 becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted immediately, the associated account will be closed, and any funds will be returned to the originating payment method. If you believe a minor has registered with cly888, please contact us immediately at [email protected].

13. Changes to This Privacy Policy

cly888 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. Material changes will be communicated to registered members via the email address associated with their account and through a notice published prominently on the cly888 website.

The effective date of the current version of this Policy is displayed at the top of this page. Your continued use of the cly888 Service following the publication of any updated Policy constitutes your acceptance of the revised terms.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or cly888's handling of your personal data, please contact us through the following channels:

• Email: [email protected] (subject line: "Privacy Enquiry" or "Data Subject Request")
• Live Chat: Available 24/7 via the cly888 website
• Response Time: Within 30 days for formal data subject requests; within 24 hours for general privacy enquiries

cly888 is committed to resolving all privacy-related concerns promptly and transparently. If you remain unsatisfied following our response to your enquiry, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.