moicity Privacy Policy for Malaysian Players

Introduction

moicity respects the privacy of every person who accesses its website or uses its account-related services. This Privacy Policy describes the personal information moicity collects, the purposes for which that information is processed, the parties with whom it may be shared and the rights available to users regarding their own data.

By using moicity, a user acknowledges having read and understood this Privacy Policy and confirms acceptance of the described data practices. If any part of this policy is not acceptable, the user should discontinue using moicity and may request account closure by contacting the support team. This policy should be read together with the moicity Terms & Conditions.

moicity may update this Privacy Policy to reflect changes in service, technology or legal obligations. When a material revision is made, the effective date shown at the top of this document will be updated accordingly. Continued use of moicity after such a revision constitutes acceptance of the new terms.

Definitions

In this Privacy Policy: "moicity", "we", "our" and "us" refer to the moicity website and its operating entity. "User", "you" and "your" refer to any individual visiting, registering on or using moicity services. "Personal data" means any information that identifies or can reasonably identify a natural person, including but not limited to a name, identity number, contact detail, financial record or device identifier.

"Processing" refers to any operation performed on personal data including collection, storage, use, transmission, analysis or deletion. "Third party" means any person or organisation other than the user and moicity. "Payment provider" includes any bank, e-wallet or transfer service used to process an eligible MYR transaction, which may include Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX where available and supported.

Personal Data We Collect

moicity collects personal data in several ways: directly from the user through account registration and verification, automatically through device and session technology, and from trusted third-party service providers where permitted.

moicity does not seek to collect sensitive personal data such as medical records, racial or ethnic origin, religious beliefs or political opinions unless specifically required by applicable legal obligations. Where such information is inadvertently received, it will be deleted or anonymised promptly.

How We Use Personal Data

Personal data collected by moicity is used for the following purposes:

• Account creation and maintenance: Registering a user profile, storing login credentials securely and maintaining accurate account records.
• Identity and age verification: Confirming that a user is aged 21 or above and is the person named in the account, in compliance with applicable legal and operator requirements.
• Payment processing: Facilitating MYR deposits and withdrawals through eligible payment providers including DuitNow, FPX and supported Malaysian bank channels.
• Fraud and security monitoring: Detecting unauthorised access, unusual transaction patterns, money laundering risks or misuse of promotional offers.
• Responsible-gambling obligations: Monitoring account activity for signs of potential harm, applying user-requested limits and maintaining self-exclusion records in accordance with player-protection standards.
• Service communications: Sending account confirmations, transaction receipts, verification requests, security alerts and support responses.
• Legal and regulatory compliance: Retaining required records, responding to lawful regulatory requests and meeting anti-money-laundering or fraud-reporting obligations.
• Service improvement: Analysing aggregated usage patterns to improve content, navigation and account features for Malaysian users.
• Marketing communications: Where a user has opted in, sending information about eligible promotions. Users may withdraw marketing consent at any time.

moicity does not sell personal data to unrelated third parties for their independent marketing purposes.

Legal Basis for Processing

moicity processes personal data under one or more of the following bases as applicable to each activity:

• Contract performance: Processing necessary to operate the user account, process MYR payments and deliver services described in the Terms & Conditions.
• Legal obligation: Processing required to comply with anti-money-laundering rules, age-verification requirements, fraud reporting and lawful regulatory requests.
• Legitimate interests: Processing necessary to prevent fraud, maintain network security, improve services and protect moicity and its users, where those interests are not overridden by the user's data-protection rights.
• Consent: Processing for optional purposes such as marketing communications, where the user has given clear and freely withdrawable consent. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

Sharing and Disclosure of Data

moicity may share personal data with the following categories of recipient in limited, purpose-limited circumstances:

• Identity and payment verification providers: Third-party services that assist with KYC checks, document authentication or MYR payment processing.
• Game and content technology providers: Suppliers who deliver casino games, sports markets or platform functions under contractual data-processing arrangements.
• Fraud prevention and security services: Organisations that assist with detecting suspicious activity, preventing money laundering and protecting account integrity.
• Regulatory and law enforcement authorities: Where moicity is legally required to disclose information in response to a lawful request, court order or regulatory investigation.
• Professional advisers: Lawyers, auditors and consultants under professional confidentiality obligations where necessary for business operations.

Where personal data is transferred to a service provider operating outside the user's jurisdiction, moicity aims to apply appropriate contractual protections consistent with recognised data-transfer standards. moicity does not transfer or sell personal data to unrelated commercial buyers.

Data Retention Periods

moicity retains personal data for as long as necessary to fulfil the purpose for which it was collected, subject to any legal retention obligation that applies.

• Account and identity records are generally retained throughout the account lifecycle and for a further period after closure to satisfy anti-money-laundering, accounting and dispute-resolution requirements.
• Transaction and payment records are typically retained for a minimum of five years to meet financial compliance standards.
• Responsible-gambling records, including self-exclusion and limit-setting history, may be retained beyond account closure to support harm-prevention obligations.
• Support communications are retained for a reasonable period to assist with ongoing queries, appeals or regulatory requests.
• Marketing preferences are held until withdrawn by the user or until the account is closed, whichever is earlier.

When personal data is no longer required for any lawful purpose, moicity will securely delete, anonymise or otherwise dispose of it in a manner appropriate to the sensitivity of the information.

Security Measures

moicity implements appropriate technical and organisational measures to protect personal data against accidental or unlawful access, disclosure, alteration or destruction. Measures in use may include encrypted data transmission over HTTPS, access controls limiting data to authorised personnel, session security features and regular security reviews.

Users play an important role in account security. moicity recommends using a strong, unique password for the moicity account, enabling any available two-factor authentication, signing out after each session on shared or public devices, and never sharing login credentials or one-time security codes with any other person. Users in Kuala Lumpur, Petaling Jaya, Shah Alam or elsewhere who suspect account compromise should contact moicity support promptly. Identity documents should be submitted only through a secure HTTPS connection and never sent through unsecured messaging channels.

No online system can guarantee absolute security. In the event of a data breach affecting users' rights, moicity will take appropriate steps to contain the incident and notify affected users or relevant authorities as required by applicable law.

Cookies and Similar Technologies

moicity may use cookies and similar tracking technologies to maintain user sessions, detect fraud, analyse aggregated usage patterns and, where consent has been given, deliver relevant promotional content. A cookie is a small text file stored on a user's device that helps the site recognise a returning visitor and maintain a consistent experience.

The following categories of cookie may be used:

• Strictly necessary cookies: Required to operate core site functions such as session management, security tokens and login state. These cannot be disabled without affecting access.
• Analytics cookies: Used to understand how visitors move through moicity, which pages are most visited and where technical issues arise. Data is aggregated and does not identify individuals by default.
• Preference cookies: Store optional settings chosen by the user, such as language or display preferences.
• Marketing cookies: Placed only where a user has consented and used to support relevant promotional communication. Users may withdraw marketing consent at any time.

Users may manage cookie preferences through their browser settings. Blocking strictly necessary cookies may impair access to moicity account features.

Your Rights as a Data Subject

Subject to applicable law and identity verification, users hold the following rights in relation to their personal data held by moicity:

• Right of access: Request a copy of the personal data moicity holds about you, together with information about how it is used.
• Right of correction: Request that inaccurate or outdated personal data be corrected or completed.
• Right of erasure: Request deletion of personal data where it is no longer necessary for its original purpose, unless a legal retention obligation applies.
• Right to restrict processing: Request that processing be limited in specified circumstances, for example while a correction request is being reviewed.
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, request that personal data be provided in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including any direct marketing communications.
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact moicity using the details in Section 13. moicity will respond within a reasonable timeframe, typically within 30 days, and may need to verify identity before processing the request. Some requests may be partially refused where a legal obligation requires continued retention or processing.

Minors and Age Verification Policy

moicity is intended only for adults aged 21 and above. moicity does not knowingly collect personal data from any person under 21 years of age. Account registration requires confirmation that the user meets this minimum age requirement, and identity verification is used to substantiate that declaration.

If moicity determines or reasonably suspects that personal data has been provided by or on behalf of a person under 21, that data will be deleted promptly and the associated account will be closed. Any balance in an underage account will be handled in accordance with applicable regulatory guidance.

Any person who believes that a minor has provided personal data to moicity should contact the support team immediately using the email address in Section 13.

Changes to This Privacy Policy

moicity may update this Privacy Policy from time to time to reflect changes in data-processing practices, legal requirements, service features or operational procedures. The effective date at the top of this document will be updated whenever a revision is made.

For material changes that significantly affect users' rights or data practices, moicity will provide reasonable advance notice through account communications or a prominent notice on the website. Continued use of moicity after any revised policy takes effect constitutes acceptance of the updated terms. Users who do not accept a revised policy should stop using moicity and may request account closure.

Contact Us

Users wishing to exercise a data right, raise a privacy concern or request further information about moicity data practices should contact the support team. Requests must include sufficient detail to identify the specific account, data category or concern, and will be subject to reasonable identity verification before processing. Do not include a password or one-time security code in any message.