Golden City Privacy Policy – Data Protection for Malaysian Players

01Personal Data We Collect

Golden City collects your personal data in several ways throughout your use of our platform. In general, the data we collect falls into three main categories:

A. Data You Provide Directly

• Full name as shown on your Malaysian identity card (MyKad).
• National identification card (IC) number or passport number.
• Email address and mobile phone number.
• Date of birth for age verification.
• Current residential address.
• E-wallet account details (Touch 'n Go, GrabPay, Boost, ShopeePay) or bank account information (FPX, Maybank2u, CIMB Clicks) for deposits and withdrawals — we do not store full account numbers, only the references required for processing.
• Identity verification documents submitted during the KYC process, such as copies of your MyKad, utility bills, or bank statements.

B. Automatically Collected Data

• The IP address of your device when accessing the platform.
• Device type, operating system, and web browser version.
• Session data including login time, logout time, and duration of use.
• Gaming history — game types played, bet amounts, outcomes, and session times.
• History of deposit and withdrawal transactions, including amounts, payment methods, and timestamps.
• Country- or state-level geolocation data (not precise GPS) used for regional verification purposes.
• Error logs and technical diagnostic data for platform troubleshooting.

C. Data from Authorised Third Parties

• Identity verification from approved third-party KYC service providers.
• AML (Anti-Money Laundering) checks by financial compliance service providers.
• Self-exclusion information from relevant responsible gambling databases.

02Purpose of Data Collection and Processing

Every piece of data we collect has a clear and legitimate purpose. Golden City does not collect data for irrelevant or unnecessary reasons. The primary purposes for which your data is used are as follows:

• Account Management: Creating, managing, and verifying your account at Golden City.
• Financial Transaction Processing: Processing deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX, as well as withdrawals of your winnings.
• Identity Verification (KYC): Verifying that you meet the minimum age requirement of 18 years and confirming your identity prior to processing large winnings.
• Legal Compliance: Meeting AML (Anti-Money Laundering), KYC (Know Your Customer), and mandatory reporting requirements to relevant authorities where required by law.
• Platform Security: Identifying and preventing fraud, multi-account use, bonus abuse, and other unauthorized activities.
• User Experience Enhancement: Analyzing aggregated (non-personal) usage patterns to improve the interface, platform performance, and game recommendations.
• Service Communications: Sending important notifications relating to your account, security, or changes to our terms — these are operational communications that cannot be disabled.
• Marketing Communications: Sending information about promotions, bonuses, and new games — you may unsubscribe at any time.
• Responsible Gambling: Monitoring gameplay patterns to identify signs of problem gambling and reaching out when necessary, or ensuring compliance with limits you have set yourself.

03How We Protect Your Personal Data

Golden City continuously invests in the most up-to-date security infrastructure to keep every member's personal data safe. The technical and organizational security measures we have in place are as follows:

• 256-bit SSL Encryption: All data transmitted between your device and Golden City servers is encrypted using TLS 1.3 — making it impossible for any third party to intercept.
• AES-256 Encryption at Rest: All personal data stored in our databases is encrypted using AES-256 — the same standard used by government agencies and major banks worldwide.
• PCI DSS Level 1 Standard: All payment information processing complies with the highest level of payment card industry data security standards.
• Two-Factor Authentication (2FA): Available to all members and strongly encouraged — an additional security layer that requires verification via your mobile phone each time you log in from a new device.
• 24/7 Monitoring: Our cybersecurity team monitors the platform around the clock for suspicious activity, supported by real-time automated alert systems.
• Internal Access Controls: Only staff who require access to specific data to perform their duties are permitted — and all access is logged and audited.
• Regular Penetration Testing: Our technical infrastructure undergoes regular security testing by independent third-party experts to identify and patch vulnerabilities before they can be exploited.
• Secure Data Centers: Data is stored in ISO 27001-certified data centers equipped with physical security, fire suppression systems, backup power, and disaster recovery procedures.

04Sharing Data with Third Parties

Golden City does not sell, rent, or share your personal data with third parties for marketing or commercial purposes. However, in the course of operating our services, there are limited situations where your data may be shared with specific third parties:

• Payment Provider: Transaction information required for payment processing is shared with payment processors such as FPX gateway providers, Touch 'n Go, and GrabPay to handle your deposits and withdrawals. They are bound by strict confidentiality agreements.
• KYC Service Provider: Identity verification data is shared with approved third-party KYC service providers for account verification purposes only. They do not use your data for any other purpose.
• AML Compliance Service Provider: Required transaction information is shared for legally mandated anti-money laundering screening.
• Game Platform Provider: For games operated by third-party software providers, only the minimum information required to launch your game session is shared securely.
• Legal Authorities: Golden City may disclose your personal data to government authorities, regulatory bodies, or law enforcement agencies when required to do so by a court order, warrant, or other valid legal obligation.

All third parties who receive your data are bound by strict data processing agreements and may only use that data for specified purposes. Golden City takes responsibility for ensuring all third-party partners uphold data protection standards comparable to our own.

05Cookies & Tracking Technologies

Golden City uses cookies and similar tracking technologies to enhance the user experience and ensure the platform functions correctly. The following are the types of cookies we use:

• Essential Cookies (Required): Required for core platform functions such as login, session security, and transaction processing. These cookies cannot be disabled without affecting platform functionality.
• Performance Cookies: Collects information on how you use the platform (pages visited, time spent) to help us improve performance and user experience. This data is aggregated and does not identify you personally.
• Functional Cookies: Remembers your preferences such as language, region, and display settings to deliver a more personalised experience.
• Session Cookies: Temporary cookies that are automatically deleted when you close your browser — used to maintain your login session while browsing the platform.

You can manage or delete cookies through your web browser settings. However, disabling essential cookies may affect your ability to log in or use certain features on the platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

06Your Rights as a Golden City User

As a Golden City member, you have the following rights regarding your personal data. All requests can be sent to support@goldencity.click and will be processed within 30 working days:

• Right of Access: You have the right to request a copy of all personal data we hold about you. We will provide a complete, readable report within 30 days.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request a correction. For basic details such as your email address, corrections can be made directly in your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data. Such requests will be fulfilled to the fullest extent permitted by law — certain data must be retained for a specified period to comply with AML regulations and financial record-keeping obligations.
• Right to Restriction of Processing: In certain circumstances (for example, when you are disputing the accuracy of your data), you may request that we temporarily restrict the processing of your data.
• Right to Object: You have the right to object to the processing of your data for direct marketing purposes — and we will honour that objection immediately.
• Data Portability Right: You may request a copy of the data you have provided to us in a structured, machine-readable format (JSON or CSV) for transfer to another service provider if desired.

07Data Retention & Deletion

Golden City retains your personal data only for as long as it is needed for the purposes set out in this policy, or as required by law. Our general retention schedule is as follows:

• Active Account Data: Retained for as long as your account remains active with Golden City.
• Data After Account Closure: Following account closure, basic personal data is retained for 5 years for AML compliance purposes and financial record-keeping requirements — this is the minimum retention period mandated by most international regulatory bodies.
• Financial Transaction Records: Retained for 7 years in line with standard financial industry practices and audit requirements.
• Security Logs: Retained for 12 months for the purposes of investigating security incidents should they occur.
• Support Communication Data: Customer support conversation records are retained for 3 years for service quality and dispute resolution purposes.
• Marketing Data: If you unsubscribe from marketing communications, your preference is stored to ensure we do not send you unwanted communications in the future.

Once the applicable retention period has expired, your data will be securely deleted or anonymised so that it can no longer be linked back to you as an individual.

08Account Security & Shared Responsibility

Protecting your privacy and account security is a shared responsibility between Golden City and you. While we take all reasonable technical measures on our end, the security of your account also depends on your own actions:

• Use a strong, unique password for your Golden City account — at least 12 characters, combining uppercase letters, lowercase letters, numbers, and symbols.
• Enable Two-Factor Authentication (2FA) in your account settings — it is the single most effective extra layer of protection you can add.
• Never share your login credentials with anyone — including family members. Golden City will never ask for your password.
• Log out of your account after each session, especially when using a shared device or a public Wi-Fi network.
• Be cautious of emails or messages claiming to be from Golden City that ask for sensitive information — these may be phishing attempts. Contact us directly at support@goldencity.click to verify.
• Keep your account information (email address and phone number) up to date so we can reach you if any suspicious activity is detected.

If you suspect your account has been accessed without authorisation or you notice suspicious activity, please contact us immediately at support@goldencity.click or via the platform's live chat. Our security team operates 24/7 and will respond promptly to protect your account.

09Contact Us About Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or how Golden City handles your personal data, we are here to help:

• Privacy Email: support@goldencity.click — please include "Privacy Inquiry" in your email subject line.
• Live Chat: Available on the Golden City platform, 24 hours a day, 7 days a week.
• Response Time: Privacy-related inquiries are responded to within 48 hours. Formal requests relating to user rights are processed within 30 days.

We encourage you to contact us directly before escalating to a regulatory body — we are committed to resolving your concerns quickly and fairly. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection regulatory authority.

This Privacy Policy applies to all services offered at goldencity.click. We will update this policy from time to time and notify you of any material changes via your registered email at least 7 days before those changes take effect. The "Updated" date at the top of this page reflects the latest revision.