Privacy Policy

This Privacy Policy (the "Policy") describes how vcity, accessible at https://vcity.casa (the "Platform"), collects, uses, stores, and shares the personal data of its registered users ("Players", "you", or "your") and visitors to the Platform.

vcity is an English-language online gaming platform operated under international gaming licence terms. The Platform serves Malaysian players and processes personal data in accordance with applicable international data protection standards. By accessing or using the Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

This Policy should be read in conjunction with our Terms and Conditions, which govern your use of the Platform. In the event of any conflict, the Terms and Conditions shall prevail in respect of contractual matters, and this Policy shall prevail in respect of data protection matters.

The following definitions apply throughout this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, location data, online identifier, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, dissemination, or erasure.
• "Data Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this Policy, the Data Controller is vcity.
• "Data Processor" means a third party that processes personal data on behalf of the Data Controller, strictly in accordance with documented instructions.
• "Consent" means any freely given, specific, informed, and unambiguous indication of a data subject's wishes by which they signify agreement to the processing of their personal data.
• "KYC" (Know Your Customer) means the identity and age verification processes conducted by vcity in accordance with its licensing obligations and applicable anti-money-laundering regulations.
• "AML" (Anti-Money Laundering) refers to the regulatory framework and internal procedures designed to prevent the Platform from being used for money laundering or terrorist financing.

vcity acts as the Data Controller in respect of all personal data collected and processed through the Platform. As Data Controller, vcity is responsible for ensuring that personal data is processed lawfully, fairly, and transparently in accordance with this Policy and applicable data protection legislation.

For all data protection enquiries, requests to exercise your rights, or concerns regarding the processing of your personal data, please contact our Data Protection team at: support@vcity.casa

We aim to respond to all data-related enquiries within 30 calendar days of receipt. Complex requests may require additional time, in which case we will notify you of the expected timeline.

4.1 — Information You Provide Directly

vcity collects personal data that you provide directly when interacting with the Platform. This includes:

• Registration data: Your full legal name, date of birth, residential address, email address, phone number, and preferred username and password when you create an account.
• KYC documentation: Copies of your government-issued identity documents (such as a MyKad or passport), proof of residential address (such as a utility bill or bank statement), and any additional verification documents requested by vcity's compliance team.
• Payment data: Payment method details necessary to facilitate deposits and withdrawals, including bank account details, e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay, DuitNow), and card details (Visa/Mastercard).
• Communications: Any messages, enquiries, or documents you submit to vcity via Live Chat, email, or any other support channel.

4.2 — Information We Collect Automatically

When you access or use the Platform, vcity automatically collects certain technical and usage data, including:

• IP address and approximate geographic location (country/city, e.g., Kuala Lumpur or Penang) derived from IP data.
• Device identifiers, browser type and version, operating system, and screen resolution.
• Session duration, pages visited, features accessed, and navigation patterns within the Platform.
• Betting and gaming history, including game types played, wagering amounts, and outcomes.
• Cookie and tracking technology data as described in Section 11 of this Policy.

vcity collects personal data through the following means:

• Direct interactions: Data you provide when registering, completing KYC, making deposits, requesting withdrawals, claiming bonuses, or contacting our support team.
• Automated technologies: Data collected automatically via cookies, server logs, and analytics tools as you interact with the Platform.
• Third-party sources: Data received from payment processors, KYC verification service providers, fraud detection systems, and publicly accessible databases as part of our compliance obligations.

vcity processes personal data only where a valid legal basis exists under applicable data protection law. The legal bases we rely on are as follows:

• Performance of a contract: Processing necessary to deliver the gaming services you have requested, operate your account, process deposits and withdrawals, and fulfil our contractual obligations to you as set out in our Terms and Conditions.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC identity verification, AML record-keeping, age verification (21+ requirement), and regulatory reporting obligations under our international gaming licence.
• Legitimate interests: Processing necessary for vcity's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, internal analytics, and service improvement, provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent, principally in relation to receiving marketing communications and promotional offers. You may withdraw this consent at any time.

vcity uses the personal data it collects for the following purposes:

• Account management: Creating and managing your Player account, verifying your identity and age, and enabling you to access Platform services.
• Payment processing: Facilitating MYR deposits and withdrawals via your chosen payment method (including Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, and Public Bank), verifying transaction legitimacy, and maintaining accurate financial records.
• Regulatory compliance: Fulfilling our KYC and AML obligations under international gaming licence requirements, including reporting suspicious transactions to relevant authorities where required by law.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, money laundering, identity theft, and breaches of our Terms and Conditions.
• Responsible gaming: Monitoring gaming activity to identify signs of problem gambling, enforcing self-exclusion requests and player-set limits, and ensuring 21+ age restrictions are observed.
• Customer support: Responding to enquiries, resolving disputes, and providing technical assistance to Players across Malaysia and other served territories.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates where you have explicitly opted in. You may unsubscribe at any time.
• Platform improvement: Using aggregated and anonymised usage data to analyse platform performance, improve user experience, and develop new features.

vcity does not sell, rent, or trade your personal data to third parties for commercial purposes. We share personal data with third parties only in the following circumstances:

• Payment service providers: We share transaction data with payment processors to facilitate deposits and withdrawals. These providers include operators of Touch 'n Go eWallet, DuitNow, FPX, and other supported Malaysian payment platforms.
• KYC and compliance partners: We share identity documentation with accredited third-party KYC verification services for the purpose of age and identity verification in accordance with our licensing obligations.
• Fraud prevention and AML systems: We may share data with fraud detection platforms and financial intelligence services to identify and prevent illegal activity on the Platform.
• Regulatory and law enforcement authorities: We will disclose personal data to competent authorities where required to do so by law, court order, or regulatory direction, including for the purposes of AML reporting.
• Group companies and service providers: We may share data with affiliated entities and contracted service providers who assist in delivering the Platform and its services, acting strictly as Data Processors under our instructions and bound by appropriate data processing agreements.

As an internationally licensed gaming platform, vcity may transfer your personal data to countries outside your country of residence, including countries that may not provide the same level of data protection as the jurisdiction in which you are located.

Where such transfers occur, vcity implements appropriate safeguards to ensure that your personal data remains protected to a standard consistent with this Policy. These safeguards may include contractual clauses, data processing agreements, or reliance on recognised adequacy determinations.

By using the Platform and accepting this Policy, you consent to the international transfer of your personal data in accordance with the safeguards described herein.

vcity retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations. Specific retention periods are as follows:

• Active account data: Retained for the full duration of your account's active status on the Platform.
• Post-closure data: Following account closure, identity, financial, and transaction records are retained for a minimum of five years in compliance with international AML regulations and gaming licence requirements.
• KYC documentation: Retained for a minimum of five years after account closure or the last transaction, whichever is later.
• Marketing preferences: Retained until you withdraw your consent or request deletion of marketing-related data.
• Technical and usage logs: Typically retained for a rolling period of 12–24 months for security and analytics purposes, subject to anonymisation at the end of the retention period.

At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

11.1 — What Are Cookies

Cookies are small text files placed on your device by a website to store information about your preferences, session state, and browsing activity. vcity uses cookies and similar technologies (including web beacons, pixel tags, and session storage) to operate the Platform effectively and improve your experience.

11.2 — Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of the Platform, including session management, authentication, security, and fraud prevention. These cannot be disabled without materially affecting Platform functionality.
• Performance & Analytics Cookies: Used to collect anonymised information about how visitors use the Platform, including page load times, error rates, and navigation paths, to help us improve performance.
• Functional Cookies: Remember your preferences such as language selection, display settings, and responsible gaming tool configurations.
• Marketing Cookies: Used with your consent to track your interactions with promotional content and deliver relevant offers. You may opt out of marketing cookies at any time.

11.3 — Managing Cookies

You may control non-essential cookies through your browser settings or any cookie preference centre provided on the Platform. Please note that disabling certain cookies may affect the functionality and performance of the Platform.

vcity implements comprehensive technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, destruction, or loss. These measures include:

• Encryption: All data transmitted between your device and the Platform is encrypted using 256-bit SSL/TLS protocols. Personal and financial data stored on our servers is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data is restricted to authorised vcity personnel and contracted service providers on a strict need-to-know basis. All staff with access to personal data are trained in data protection obligations.
• Penetration testing: Our systems undergo regular independent security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident response: vcity maintains a documented data breach response procedure. In the event of a breach affecting your rights, we will notify you and the relevant authorities within the timeframe required by applicable law.

Subject to applicable data protection law, you have the following rights in respect of your personal data held by vcity. To exercise any of these rights, please contact us at support@vcity.casa or via our 24/7 Live Chat.

• Right of Access: You have the right to request a copy of the personal data we hold about you, including information about how it is being processed.
• Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected. This right is subject to our legal retention obligations, which may require us to retain certain data even after account closure.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your data in certain circumstances, such as while a dispute is being resolved.
• Right to Data Portability: Where processing is based on consent or contract, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or carried out for direct marketing purposes, including profiling related to direct marketing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We will respond to all rights requests within 30 calendar days. In complex cases, this may be extended by a further 60 days, and we will notify you accordingly.

vcity is strictly restricted to individuals aged 21 and above. We do not knowingly collect, use, or store personal data from persons under the age of 21. Age verification is a mandatory component of our KYC process, and accounts identified as belonging to persons under 21 will be closed immediately and any associated data deleted, except where retention is required for compliance purposes.

If you are a parent or guardian and believe that a minor has registered on the Platform or provided personal data to vcity without your consent, please contact us immediately at support@vcity.casa. We will investigate the matter promptly and take appropriate action.

vcity reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or the features and services available on the Platform. When material changes are made, the "Last Updated" date at the top of this Policy will be revised, and where the changes significantly affect your rights or how we process your data, we will notify you by email or via a prominent notice on the Platform.

We encourage you to review this Policy periodically. Your continued use of the Platform following the publication of an amended Policy constitutes your acceptance of the changes. If you do not agree with any amendment, you must discontinue use of the Platform and request account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the vcity Data Protection team through the following channels:

• Email: support@vcity.casa — for formal written data protection enquiries and requests to exercise your rights. Please include "Data Privacy Request" in the subject line.
• Live Chat: Available 24/7 on the vcity Platform for general enquiries. For formal rights requests, email correspondence is recommended to create a written record.
• Support Hours: 24 hours a day, 7 days a week, aligned to Malaysia Time (MYT, UTC+8).

We take all privacy enquiries seriously and aim to provide a full response within 30 calendar days of receipt. For enquiries about our Terms of Service, please refer to our Terms and Conditions. For enquiries about responsible gaming tools, please visit our Responsible Gambling page.