How We Protect Your Data
These six principles summarise our approach to data privacy. The full legal text follows below — but these cards give you the plain-language overview.
Encrypted End-to-End
All data transmitted between your device and the Cilislot platform is protected by 256-bit SSL/TLS encryption — the same standard used by Malaysian banks and financial institutions. Your login credentials, payment details, and KYC documents are never sent or stored in plain text.
Minimal Data Collection
We collect only the data we genuinely need to operate the platform, verify your identity, process payments, and comply with applicable regulations. We do not collect data speculatively or build advertising profiles. If we don't need it, we don't collect it.
No Data Sales
Cilislot does not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. Period. The only circumstances under which we share your data are those described in Section 6 of this Policy — primarily legal obligations and licensed service providers.
Your Rights, Clearly Stated
You have the right to access, correct, export, and request deletion of your personal data. You can withdraw consent for optional data processing at any time. These rights are not buried in footnotes — they are documented clearly in Section 9 of this Policy and our team can assist you in exercising them via Live Chat.
Defined Retention Periods
We do not hold your data indefinitely. Account data is retained for as long as your account remains active and for a defined period thereafter as required by applicable regulations. KYC documents are retained for a minimum of five years in line with anti-money laundering obligations, after which they are securely destroyed.
Breach Notification
In the unlikely event of a data breach that poses a risk to your rights or interests, Cilislot will notify affected users as promptly as possible and take immediate remediation action. We maintain an internal incident response protocol tested on a regular basis.
Introduction
This Privacy Policy ("Policy") describes how Cilislot ("we", "us", "our", "the Platform") collects, processes, stores, uses, and protects the personal data of individuals ("you", "User", "Player") who access or use the online gaming services available at cilislot.cam (the "Site") and any associated features or services.
We are committed to processing your personal data lawfully, fairly, and transparently. This Policy is designed to inform you — in plain, accessible English — about the nature of the personal data we hold about you, the purposes for which it is processed, the legal bases upon which that processing rests, and the rights available to you under applicable data protection law.
This Policy applies to all Users regardless of their location, including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other locations from which the Site is accessed.
Definitions
The following definitions apply throughout this Privacy Policy:
- "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
- "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
- "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, Cilislot.
- "Data Processor" means any third party that processes personal data on behalf of the Data Controller under a contractual arrangement.
- "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data.
- "KYC" means Know Your Customer — the identity verification process required under applicable anti-money laundering regulations.
- "Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sexual orientation — none of which Cilislot intentionally collects.
- "Cookie" means a small text file stored on your device by a web browser, used to maintain session state, preferences, and analytical data.
Data Controller
Cilislot acts as the Data Controller in respect of all personal data collected through the Site and its associated services. As Data Controller, Cilislot is responsible for determining the purposes and means by which your personal data is processed and for ensuring that such processing is carried out in compliance with applicable data protection legislation.
Where Cilislot engages third-party service providers — such as payment processors, KYC verification services, and hosting providers — those providers act as Data Processors under written data processing agreements that require them to implement appropriate technical and organisational security measures and to process data only on our documented instructions.
Personal Data We Collect
Cilislot collects personal data through three primary channels: (a) data you provide directly during registration and account use, (b) data generated automatically through your use of the Platform, and (c) data received from authorised third parties such as payment providers and identity verification services.
4.1 Data You Provide Directly
| Category | Data Elements | When Collected |
|---|---|---|
| Registration Data | Full legal name, date of birth, email address, mobile number, preferred currency (MYR) | Account registration |
| Identity Documents | MyKad (front and back), passport, selfie with ID | KYC verification (first withdrawal) |
| Payment Data | E-wallet identifiers (Touch 'n Go, Boost, GrabPay), bank account details, DuitNow reference, FPX confirmation IDs | Deposit / withdrawal transactions |
| Support Communications | Content of Live Chat sessions, email correspondence, complaint records | Support interactions |
| Responsible Gambling | Deposit limits set, self-exclusion requests, cooling-off period activations | Responsible gambling tool usage |
4.2 Automatically Collected Data
When you access the Site, the following data is collected automatically by our systems and third-party analytics providers:
- IP address and approximate geographic location (city/region level)
- Device type, operating system, and browser version
- Session duration, pages visited, features accessed, and click-path data
- Game activity records: titles played, bet amounts, outcomes, session timestamps
- Login timestamps and authentication events
- Cookie identifiers (see Section 7)
4.3 Data from Third Parties
We may receive personal data about you from the following authorised third-party sources:
- Payment Processors: Transaction confirmation data, account identifiers, and fraud risk signals from providers including Maybank, CIMB, Public Bank, Hong Leong, DuitNow, and FPX operators.
- Identity Verification Providers: Verification status and document authenticity signals from our KYC service partners.
- Fraud Prevention Services: Risk scores and device fingerprint data used to protect against Account takeover and financial fraud.
How We Use Your Personal Data
We process your personal data only for the purposes listed below, and only where a valid legal basis exists for that processing:
5.1 Contract Performance
We process registration data, payment data, and game activity records to fulfil our contractual obligations to you under our Terms and Conditions — specifically to operate your Account, process deposits and withdrawals in MYR, and make our games and services available to you.
5.2 Legal Obligation
We process identity documents, financial transaction records, and IP data to comply with our obligations under applicable anti-money laundering (AML) legislation and licensing requirements. This processing is not optional — it is legally mandated and cannot be withdrawn by the User.
5.3 Legitimate Interests
We process device data, session data, and fraud signals to protect the security and integrity of the Platform, prevent fraud and bonus abuse, and improve the technical performance of the Site. These legitimate interests have been balanced against User privacy rights and, in our assessment, do not override them.
5.4 Consent
Where we send you promotional communications (such as bonus offer emails or SMS notifications about new games), we do so only with your express consent, given at the time of registration or subsequently through your Account settings. You may withdraw this consent at any time by updating your communication preferences or contacting our support team.
5.5 Responsible Gambling Obligations
We process gameplay data, deposit frequency, and session duration data as part of our responsible gambling programme, which includes detecting patterns associated with problem gambling and proactively reaching out to players who may benefit from support. This processing is carried out in your vital interests and in the public interest.
Data Sharing & Disclosure
Cilislot does not sell, rent, or otherwise commercially transfer your personal data to any third party. We share your data only in the following circumstances:
6.1 Licensed Service Providers
We share data with carefully selected third-party providers who assist us in operating the Platform, all of whom are bound by data processing agreements:
- Payment processors (including e-wallet operators and Malaysian banking infrastructure providers via FPX and DuitNow) — to process your transactions.
- Identity verification providers — to conduct KYC checks using your MyKad or passport data.
- Cloud hosting and infrastructure providers — to store and process Account and game data securely.
- Fraud detection and anti-cheat services — to protect Account security and Platform integrity.
- Customer support platform providers — to enable Live Chat and email support operations.
6.2 Legal and Regulatory Disclosure
We may disclose personal data to regulatory authorities, law enforcement agencies, or courts where we are legally required to do so — for example, in response to a court order, a financial intelligence unit request, or a regulatory audit. We will notify you of such requests where we are legally permitted to do so.
6.3 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal data may be transferred to the successor entity. We will provide notice of any such transfer and ensure that the successor is bound by privacy obligations no less protective than those set out in this Policy.
Cookies & Tracking Technologies
The Cilislot Site uses cookies and similar tracking technologies to maintain your session, remember your preferences, and help us understand how the Site is used. The following categories of cookies are in use:
7.1 Strictly Necessary Cookies
These cookies are essential for the Site to function and cannot be disabled. They are used to maintain your login session, prevent cross-site request forgery (CSRF) attacks, and ensure that transactions are processed securely. No personal data collected via these cookies is used for marketing purposes.
7.2 Functional Cookies
These cookies remember your preferences — such as your preferred language (English, Bahasa Melayu, or Mandarin), last-used payment method, and game lobby settings — to provide a more personalised experience. You may disable functional cookies via your browser settings, though doing so may affect certain Site features.
7.3 Analytical Cookies
We use anonymised analytical cookies to understand how players navigate the Site — which pages are visited most, where users drop off, and how game lobby filters are used. This data is processed in aggregate and does not identify individual users. It is used solely to improve the Platform experience.
7.4 Managing Cookies
You can control cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging in or making transactions on the Site. For guidance on managing cookies in popular browsers (Chrome, Safari, Firefox, Edge), please refer to your browser's help documentation.
Data Retention
Cilislot retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention schedules apply:
- Account and registration data: Retained for the duration of account activity and for a period of five (5) years following permanent account closure, in line with AML record-keeping obligations.
- KYC documents (MyKad, passport, selfie): Retained for a minimum of five (5) years from the date of submission, as required by applicable financial crime legislation. Documents are securely destroyed upon expiry of the retention period.
- Financial transaction records: Retained for five (5) years from the date of each transaction.
- Game activity logs: Retained for three (3) years for dispute resolution purposes, then securely deleted.
- Support communications: Retained for two (2) years from the date of the interaction.
- Marketing consent records: Retained until consent is withdrawn, plus one (1) year for audit purposes.
Your Data Protection Rights
As a data subject, you are entitled to exercise the following rights in respect of your personal data held by Cilislot. To exercise any of these rights, please contact us via Live Chat or by email at [email protected]. We will respond to all valid requests within thirty (30) days.
Right of Access
Request a copy of all personal data we hold about you, along with information about how it is being processed.
Right to Rectification
Request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Right to Restriction
Request that we restrict processing of your data — for example, while a correction request is being resolved.
Right to Portability
Request a machine-readable copy of the personal data you provided to us, for transfer to another service provider.
Right to Object
Object to processing carried out on the basis of legitimate interests, including direct marketing communications.
Right to Withdraw Consent
Where processing is based on consent (e.g., marketing emails), you may withdraw that consent at any time without affecting prior processing.
Rights re: Automated Decisions
Request human review of any fully automated decision that significantly affects you, such as Account risk assessments.
Data Security
Cilislot implements a comprehensive suite of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
- 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
- AES-256 encryption at rest for sensitive data fields including identity documents and payment credentials.
- Role-based access controls ensuring that only authorised personnel with a legitimate need can access personal data.
- Multi-factor authentication (MFA) for all internal system access by Cilislot staff.
- Regular penetration testing and vulnerability assessments conducted by independent security professionals.
- Automated intrusion detection systems monitoring for anomalous access patterns around the clock.
- Incident response protocols that define escalation procedures, containment measures, and user notification timelines in the event of a security incident.
While we take all reasonable precautions to protect your data, no digital system is entirely immune to risk. You also play a role in your own data security — please use a strong, unique password for your Cilislot Account and enable any two-factor authentication options available to you.
Children & Minors
The Cilislot platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals below the age of 21. Registration is not permitted for minors.
Our KYC verification process — which requires submission of a valid MyKad or passport — serves as a primary control against underage registration. Age verification is completed before any withdrawal is processed.
Third-Party Services
The Cilislot platform integrates with a number of third-party services necessary for its operation, including Malaysian payment infrastructure providers (Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, DuitNow, FPX), e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), and game content studios. When you interact with these services — for example, by initiating a DuitNow transfer — your data is also subject to the privacy policies of those respective providers.
Cilislot is not responsible for the privacy practices of third-party service providers. We encourage you to review the privacy policies of any payment provider or service you use in connection with your Cilislot Account. All third-party processors engaged by Cilislot are required by contract to process data in accordance with applicable data protection standards.
International Data Transfers
Where personal data is transferred to or processed in countries outside Malaysia, Cilislot ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that afforded under applicable Malaysian and international data protection requirements. Such safeguards may include contractual data protection clauses, adequacy determinations, or binding corporate rules.
Transfers to cloud infrastructure providers — who may host data on servers located outside Malaysia — are governed by standard contractual clauses that impose equivalent data protection obligations on the receiving entity.
Updates to This Privacy Policy
Cilislot reserves the right to update, amend, or replace this Privacy Policy at any time in response to changes in applicable law, regulatory guidance, or our internal data processing practices. The "Last Updated" date at the top of this document will reflect the most recent revision.
Where changes are material — meaning they significantly affect how we process your personal data or the rights available to you — we will provide notice via a prominent banner on the Site or by email to your registered address, at least seven (7) days prior to the effective date of the change. Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes.
Contact Us
If you have any questions, concerns, complaints, or requests relating to this Privacy Policy or the way in which Cilislot processes your personal data, please contact us through the following channels:
- Live Chat: Available 24/7 on the Site. Agents handle data protection queries in English, Bahasa Melayu, and Mandarin Chinese. Average response time is 3–5 minutes.
- Email: [email protected] (plain text — not a clickable link). Please mark data protection requests clearly with the subject line "Data Protection Request" for priority routing.
We aim to acknowledge all data protection requests within two (2) business days and to resolve them within thirty (30) days. Where additional time is required due to the complexity of a request, we will notify you of the expected resolution timeline.
Privacy Questions? We're Here to Help.
Our 24/7 support team can help you understand your data rights, update your preferences, or process a data access request — in English, Bahasa Melayu, or Mandarin.