Privacy Policy

01Introduction

This Privacy Policy ("Policy") is issued by Siti8 ("the Platform", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at siti8.cam. It applies to all individuals ("Player", "User", "you") who visit, register on, or interact with the Platform in any capacity.

Siti8 takes the privacy of its players seriously. We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection law — including Malaysia's Personal Data Protection Act 2010 (PDPA). This Policy describes how we collect, use, store, disclose, and protect your personal information, and sets out the rights you have in relation to that data.

By registering an account on Siti8 or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree to this Policy, you must discontinue use of the Platform immediately.

02Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, contact details, financial information, and online identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, organisation, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — Siti8, as the entity that determines the purposes and means of processing players' personal data.
• "Data Processor" — any third party engaged by Siti8 to process personal data on Siti8's behalf, such as payment service providers or KYC verification partners.
• "KYC Data" — identity and address verification documents submitted by a Player, including government-issued photo identification such as a Malaysian MyKad or passport.
• "Cookies" — small text files placed on a Player's device by the Platform to facilitate session management, security, and analytical functions.
• "PDPA" — the Personal Data Protection Act 2010 of Malaysia, which governs the processing of personal data in commercial transactions.
• "Third Party" — any natural or legal person, public authority, or agency other than the Player, Siti8, and Siti8's authorised Data Processors.

03Data We Collect

Siti8 collects the following categories of personal data, depending on how you interact with the Platform:

We do not collect sensitive personal data categories such as racial or ethnic origin, religious beliefs, health data, or biometric data beyond what is strictly required for KYC liveness verification. Where such data is incidentally captured, it is not stored beyond the immediate verification process.

04How We Collect Your Data

Siti8 collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access the Platform, including via cookies, web beacons, server logs, and similar technologies.
• Third-party sources: Identity verification data received from KYC and AML compliance partners; fraud signal data from payment processors; geolocation data from IP resolution services used for security purposes.
• Payment providers: Transaction data relayed by payment service providers including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX-connected banks such as Maybank, CIMB, Public Bank, and Hong Leong Bank, where such data is required to complete or verify a financial transaction.

05Data Processing

Siti8 processes your personal data for the following purposes:

1. Account management: Creating, maintaining, verifying, and closing player accounts in accordance with our Terms & Conditions.
2. Service delivery: Providing access to casino games, sports betting markets, live casino tables, and all other platform features, including the processing of wagers and settlement of winnings.
3. Payment processing: Facilitating deposits and withdrawals via supported Malaysian payment methods, and maintaining accurate financial records of all transactions denominated in MYR.
4. KYC and AML compliance: Verifying player identity and age, conducting anti-money laundering (AML) checks, and fulfilling obligations under applicable financial crime prevention regulations.
5. Responsible gambling: Monitoring player activity to identify indicators of problem gambling, administering self-exclusion arrangements, deposit limits, and cooling-off periods at a player's request or where required by our responsible gambling policy.
6. Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, bonus abuse, and other prohibited conduct as defined in our Terms & Conditions.
7. Customer support: Responding to player enquiries, resolving disputes, and maintaining records of communications for quality assurance purposes.
8. Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. Players may opt out at any time.
9. Platform improvement: Analysing aggregated and anonymised usage data to improve platform performance, user experience, and game selection.
10. Legal compliance: Retaining records and responding to lawful requests from regulatory or law enforcement authorities where required.

06Legal Basis for Processing

Siti8 processes your personal data on one or more of the following legal grounds, as applicable to each processing activity:

• Contractual necessity: Processing required to fulfil our obligations to you under the Terms & Conditions, including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC obligations, AML obligations, and responses to lawful regulatory requests.
• Consent: Processing based on your freely given, specific, and informed consent — for example, for marketing communications or optional analytics. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
• Legitimate interests: Processing necessary for the purposes of Siti8's legitimate business interests, including fraud prevention, platform security, and service improvement, where such interests are not overridden by your fundamental rights and freedoms.

07Data Sharing & Disclosure

Siti8 does not sell, rent, or trade your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment service providers: Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX banking partners (Maybank, CIMB, Public Bank, Hong Leong Bank, and others) — for the purpose of processing deposits and withdrawals.
• KYC and identity verification partners: Third-party providers engaged to verify player identity, confirm age, and conduct AML screening in connection with account registration and withdrawal processing.
• IT infrastructure and hosting providers: Cloud service providers and technology partners who process data on Siti8's behalf under data processing agreements that impose equivalent data protection obligations.
• Customer support platforms: Third-party live chat and helpdesk software providers, to the extent necessary to facilitate player support interactions.
• Fraud prevention services: Third-party providers of fraud detection and security intelligence services, for the purpose of protecting the Platform and its players.
• Regulatory and law enforcement authorities: We may disclose personal data to relevant governmental, regulatory, or law enforcement bodies where required by applicable law, court order, or official regulatory request, including but not limited to Malaysian authorities where applicable.
• Professional advisers: Legal, financial, and compliance advisers who are subject to professional obligations of confidentiality.

In all cases where data is shared with third-party processors, Siti8 ensures that appropriate contractual safeguards are in place to govern the processing of your data.

08International Data Transfers

Some of Siti8's service providers and technical infrastructure partners may be located outside Malaysia. Where personal data is transferred to a jurisdiction that does not provide an equivalent level of data protection to that afforded by Malaysian law, Siti8 will implement appropriate safeguards — such as standard contractual clauses or binding corporate rules — to ensure that your personal data remains protected to a standard consistent with this Policy.

By using the Platform, you acknowledge and consent to your personal data being transferred internationally where necessary for the operation of the Platform, subject to the safeguards described in this clause.

09Data Retention

Siti8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by applicable law or regulatory obligation. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your active account relationship, plus a minimum of seven (7) years following account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction and financial data: Retained for a minimum of seven (7) years from the date of each transaction, consistent with financial record-keeping obligations.
• KYC documents: Retained for the period required by applicable AML regulations, typically five (5) years from the date of the most recent transaction or account closure, whichever is later.
• Customer support communications: Retained for three (3) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Technical and usage data: Retained for twelve (12) months in identifiable form, after which data is either deleted or anonymised for aggregate analytical use.
• Marketing consent records: Retained for the period during which marketing communications are sent, plus an additional two (2) years to evidence consent in the event of a regulatory inquiry.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with our data destruction procedures.

10Cookies & Tracking Technologies

Siti8 uses cookies and similar technologies to operate the Platform securely and efficiently. The categories of cookies used are as follows:

• Strictly necessary cookies: Essential to the operation of the Platform. These cookies enable core functions such as secure login session management, authentication tokens, and account security checks. The Platform cannot function without these cookies, and they do not require consent.
• Functional cookies: Used to remember your preferences, such as your preferred language (English, Bahasa Melayu, or Mandarin), display settings, and regional localisation choices. These cookies improve your experience but are not strictly essential.
• Analytical cookies: Used to collect aggregated, anonymised information about how players interact with the Platform — such as pages visited, time spent per session, and navigation paths — to help us improve performance and usability. These cookies do not identify you individually.

Siti8 does not use third-party advertising or tracking cookies to build profiling data for external advertisers or marketing networks. Your browsing behaviour on the Siti8 Platform is not sold or shared with advertising platforms.

You may control or delete cookies through your browser settings. Disabling strictly necessary cookies will impair your ability to use the Platform. Disabling analytical or functional cookies will not prevent access but may affect certain personalisation features.

11User Rights

Subject to applicable law, you hold the following rights in relation to your personal data held by Siti8. Requests may be submitted to our support team via the contact details at the end of this Policy. We will respond to all verified requests within 30 calendar days.

12Children's Privacy

The Siti8 Platform is strictly intended for use by individuals aged 21 years and above. We do not knowingly collect, process, or store personal data belonging to individuals under the age of 21.

If Siti8 becomes aware that personal data has been submitted by a person under the age of 21 — whether through a false declaration during registration or any other means — the relevant account will be suspended immediately, all funds will be frozen pending investigation, and the personal data in question will be securely deleted to the extent permitted by applicable legal obligations.

Parents or guardians who believe their child may have registered on the Platform should contact our support team immediately at [email protected] so that we may take prompt action.

13Security Measures

Siti8 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport security: All data transmitted between your device and the Platform is encrypted using 256-bit SSL/TLS protocols.
• Access controls: Access to personal data is restricted to authorised Siti8 personnel and vetted third-party processors, governed by role-based access control policies.
• Two-factor authentication: Available on all player accounts to add an additional layer of identity verification at login.
• Database encryption: Sensitive data fields, including payment account identifiers and KYC document references, are encrypted at rest.
• Penetration testing: Regular third-party security assessments are conducted to identify and remediate vulnerabilities in the Platform's infrastructure.
• Incident response: Siti8 maintains a documented data breach response procedure. In the event of a breach that presents a risk to your rights and freedoms, we will notify affected players and relevant authorities in accordance with applicable law.

While Siti8 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. Do not share your password with any third party, and contact our support team immediately if you suspect your account has been compromised.

14Amendments to This Policy

Siti8 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the services we offer. Where amendments are material — meaning they significantly affect your rights or how your data is used — we will provide notice via the Platform or by email to your registered address prior to the changes taking effect.

Minor amendments — such as clarifications of existing language or corrections to typographical errors — may be made without specific notification. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

We encourage you to review this Policy periodically. Continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised Policy.

15Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact Siti8's support team through the following channels:

• Email: [email protected] (plain text only — not a clickable link)
• Live Chat: Available 24/7 directly within the Platform interface
• Languages: English, Bahasa Melayu, and Mandarin
• Response time: Email enquiries responded to within 24 hours; live chat within 3–5 minutes during normal operating conditions

For data subject requests (access, rectification, erasure, portability, or objection), please submit your request in writing via email with the subject line "Data Subject Request" along with sufficient information to verify your identity. We will acknowledge receipt within 5 business days and provide a substantive response within 30 calendar days.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the Personal Data Protection Commissioner of Malaysia, the relevant supervisory authority under the PDPA 2010.