At citi99, your personal data is handled with the same care and professionalism we apply to every aspect of our platform. This Privacy Policy explains exactly what we collect, why we collect it, and the rights you hold over your information.
Our Commitment
Before you read the full policy below, these cards outline the six core privacy principles that guide everything we do with your data.
Every piece of data you transmit to or from citi99 — from login credentials to payment details — is protected by industry-standard 256-bit SSL encryption. Sensitive fields such as banking information are additionally encrypted at rest using AES-256 protocols.
citi99 does not sell, rent, or trade your personal data to third-party advertisers, data brokers, or marketing networks. Your information is used solely to operate your account, process transactions, verify your identity, and communicate with you about your citi99 account.
We collect only the data we genuinely need. Each piece of data we hold is collected for a specific, documented purpose. If we need to use your data for a new purpose that was not covered when you registered, we will notify you and, where required by applicable law, request your fresh consent.
You have the right to access, correct, and — in certain circumstances — request the deletion of the personal data we hold about you. Requests are handled within thirty (30) days. See Section 10 for the full list of your data rights and how to exercise them.
We do not hold your data indefinitely. Account data is retained for the duration of your relationship with citi99 plus a post-closure period required by our licensing and anti-money-laundering obligations. After the retention period expires, data is securely destroyed or anonymized.
Where data must be shared with third parties — such as payment processors BCA, BRI, Mandiri, OVO, or DANA, identity verification providers, or our licensing authority — we document each sharing relationship, require contractual data-protection commitments, and disclose these relationships in this policy.
This Privacy Policy ("Policy") describes how citi99 ("we", "us", "our") collects, uses, stores, and shares personal data about individuals ("you", "your") who access or use the citi99 platform at https://citi99.app (the "Platform"). This Policy applies to all users of the Platform, including registered account holders, visitors who browse without registering, and individuals who contact our customer support team.
This Policy should be read alongside our Terms & Conditions, which govern your use of the Platform generally, and our Responsible Gaming page, which explains the tools available to help you maintain control over your gambling activity. Together, these documents constitute the full framework of your relationship with citi99.
By registering an account, making a deposit, placing a bet, or otherwise using the Platform, you confirm that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.
Plain-language summary: We collect the data we need to run your account securely, process your transactions, comply with anti-money-laundering rules, and improve our platform. We do not sell your data. You can ask us to show you, correct, or delete your data at any time.
citi99 is an internationally licensed online sports betting and casino platform operated under a recognized international gaming license. The Platform is designed specifically for the Indonesian market, offering Indonesian players a fully English-language premium betting experience with local payment integrations (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja), 24/7 Indonesian-speaking customer support, and Indonesian Rupiah (IDR) account balances.
As the operator of the Platform, citi99 acts as the data controller in respect of the personal data it processes about you. This means that citi99 determines the purposes for which your data is collected and the manner in which it is processed. Where citi99 engages third-party service providers to process data on its behalf (for example, payment processors or identity verification services), those providers act as data processors under contractual data-processing agreements that require them to protect your data to a standard consistent with this Policy.
For all data-related inquiries, including requests to exercise your rights under Section 10, please contact us at: [email protected]
citi99 collects personal data from you in three ways: data you provide directly, data generated automatically by your use of the Platform, and data obtained from trusted third-party sources to fulfill our verification and compliance obligations.
3.1 — Data you provide directly
| Data Category | Specific Data Points |
|---|---|
| Registration data | Full legal name, date of birth, residential address in Indonesia (including city — Jakarta, Surabaya, Bandung, Bali, Medan, Yogyakarta, or elsewhere), email address, mobile phone number, and chosen username. |
| Identity documents (KYC) | National Identity Card (KTP — Kartu Tanda Penduduk), passport biographic data page, or Driver's License (SIM — Surat Izin Mengemudi); selfie or liveness-check image where required for automated verification. |
| Financial data | Bank account number and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallet registration details (OVO, DANA, GoPay, ShopeePay, LinkAja) as provided for deposit and withdrawal purposes. |
| Communications data | Content of messages sent to our support team via live chat or email, including any attachments, screenshots, or documents you voluntarily provide. |
| Responsible gaming data | Any deposit limits, session reminders, cooling-off periods, or self-exclusion preferences you set within your account dashboard. |
3.2 — Data collected automatically
3.3 — Data from third-party sources
citi99 uses the personal data it collects for the following purposes. Each purpose is linked to the legal basis that authorizes the processing, as set out in Section 5.
citi99 processes your personal data under the following legal bases:
citi99 does not sell your personal data to any third party. We share data only in the circumstances described below, and only to the extent necessary for each specific purpose:
Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of the assets of citi99, personal data held by citi99 may be transferred to the acquirer as part of that transaction. We will notify affected users via the email address registered to their account prior to any such transfer taking effect.
citi99 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your session, and analyze aggregate usage patterns. The following categories of cookies are used:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly necessary | Required for the Platform to function — session management, login state, CSRF protection tokens, load balancing. | Session |
| Functional | Remember your display preferences (such as language and currency display settings) and pre-fill forms with your account details where appropriate. | Up to 12 months |
| Analytics | Collect anonymized data about which pages are visited, how long users spend on each page, and which features are most used — to help us identify improvements. Data is aggregated and not linked to individual accounts. | Up to 24 months |
| Fraud prevention | Device fingerprinting and behavioral signals used by our fraud detection systems to identify suspicious login attempts and unauthorized account access. | Up to 6 months |
Strictly necessary cookies cannot be disabled as they are essential to the operation of the Platform. Functional and analytics cookies can be managed through your browser settings; however, disabling functional cookies may affect your experience of the Platform. citi99 does not use third-party advertising cookies or retargeting pixels.
citi99 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by our licensing obligations and applicable law. The following retention schedule applies:
At the end of the applicable retention period, personal data is securely deleted, anonymized beyond recovery, or — where legal holds require it — archived in a manner that restricts access to only those personnel with a documented need to access the archived data.
citi99 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. Key measures include:
Your responsibility: While we implement robust security measures on our end, the security of your account also depends on your own conduct. Use a strong, unique password for your citi99 account, enable 2FA, and never share your login credentials with any other person. If you suspect your account has been compromised, contact us immediately at [email protected].
As a user of the citi99 Platform, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) days of receiving a valid request.
You have the right to request a copy of all personal data citi99 holds about you. We will provide this in a structured, machine-readable format within thirty (30) days.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it promptly. Contact support or update eligible fields directly in your account profile.
You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our retention obligations under Section 8 and applicable law.
You may request that we restrict processing of your data — for example, while a rectification request is being investigated — without requiring full deletion of the data.
Where processing is based on your consent or a contract with you, you have the right to receive your personal data in a structured, commonly used, machine-readable format for transfer to another service provider.
You have the right to object to processing based on our legitimate interests, including profiling for marketing purposes. On receipt of a valid objection, we will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests.
The citi99 Platform is strictly intended for adults aged 21 and over. We do not knowingly collect personal data from any individual under the age of 21. If you are under 21 years of age, you must not register an account, make a deposit, or use any feature of the Platform.
If citi99 discovers or has reasonable grounds to believe that personal data has been collected from an individual under the age of 21, we will immediately suspend the associated account, delete all personal data related to that account, and return any deposited funds to the originating payment method pending verification of the account holder's age.
If you are a parent or guardian and have reason to believe that a minor under your care has registered on the Platform or otherwise submitted personal data to citi99, please contact us immediately at [email protected] so that we can take prompt remedial action.
Where you have consented to receive marketing communications from citi99, we may send you promotional emails, SMS notifications, or in-Platform messages about bonuses, new game releases, seasonal promotions, and special events. Examples of such communications include notifications about Ramadhan bonus events, Idul Fitri / Lebaran reload bonuses, Chinese New Year (Imlek) promotions, BRI Liga 1 betting markets, and new slot titles from Pragmatic Play, Spribe, and other studio partners.
You may withdraw your consent to marketing communications at any time by:
Withdrawal of marketing consent does not affect the sending of transactional and account-related communications — such as deposit confirmations, withdrawal notifications, KYC request emails, and security alerts — which are sent on the basis of contractual necessity and cannot be opted out of while your account is active.
citi99 operates globally and may process or store your personal data on servers or with service providers located outside of Indonesia. In particular, our licensing authority, certain game technology providers, and fraud-screening services may be based in jurisdictions including Malta, the Isle of Man, Gibraltar, Curaçao, Cyprus, or other recognized international gaming licensing jurisdictions.
Where your personal data is transferred outside of Indonesia, citi99 takes steps to ensure that an equivalent level of data protection is applied. These steps include:
You may request further information about the specific safeguards applied to international transfers of your personal data by contacting us at [email protected].
citi99 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, operational requirements, or applicable legal and regulatory obligations. All updates will be posted on this page with a revised "Last Reviewed" date at the top of the document.
Where a proposed change materially affects the way we collect or use your personal data, we will provide you with at least fourteen (14) days' advance notice prior to the change taking effect. Notice will be delivered via the email address registered to your account and, where appropriate, via an in-Platform notification. Your continued use of the Platform after the effective date of any change constitutes your acceptance of the revised Policy.
We encourage you to review this Policy periodically so that you remain informed about how citi99 protects your personal data. If you have any questions about a specific change, please contact us at [email protected] before the change takes effect.
Version history: The current version of this Policy (effective 1 January 2026) supersedes all prior versions. If you require a copy of a previous version of this Policy, please contact our support team and we will provide one upon request.
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way citi99 handles your personal data, please contact our Data Protection team using the details below. We are committed to resolving all data-related inquiries promptly and professionally.
| Contact Method | Details |
|---|---|
| Email (Data Requests) | [email protected] — use subject line "Data Rights Request" or "Privacy Inquiry" |
| Live Chat Support | Available 24/7 via the live chat widget on the Platform. Indonesian-speaking agents are available at all hours (WIB, UTC+7). |
| Response Timeframe | We aim to acknowledge all privacy inquiries within 48 hours and to provide a substantive response within 30 days of receiving a valid, complete request. |
If you are not satisfied with our response to your privacy inquiry or data rights request, you have the right to escalate the matter to the data protection authority or regulatory body in our licensing jurisdiction. Contact details for the relevant regulatory authority will be provided upon request.
citi99 takes all privacy complaints seriously. We will investigate every complaint we receive and provide a written response within thirty (30) days. Where a complaint reveals a systemic issue with our data practices, we will take reasonable steps to address the root cause and prevent recurrence.
citi99 protects your privacy so you can focus on what matters: the thrill of the match, the spin of the reel, and the strategy of every bet. Explore our full range of sports betting markets, live casino tables, and premium slot titles — all secured by 256-bit encryption and backed by 24/7 Indonesian-speaking support.