bossbb Privacy Policy – How We Protect Your Personal Data

1. Introduction

1.1 This Privacy Policy ("Policy") is issued by bossbb ("bossbb", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the bossbb website and Platform accessible at bossbb.net.

1.2 By registering an account, accessing the Platform, or providing any personal information to bossbb, you acknowledge that you have read and understood this Policy and consent to the collection and use of your personal data as described herein.

1.3 This Policy should be read alongside bossbb's Terms & Conditions and Responsible Gaming Policy, each of which is incorporated by reference.

1.4 bossbb is committed to protecting the personal data of all Members, including those accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Ipoh, and all other locations. Our data protection practices are designed to meet applicable international standards consistent with our licensing obligations.

2. Data Controller

2.1 For the purposes of this Policy, bossbb is the data controller in respect of personal data collected through the Platform. As data controller, bossbb determines the purposes and means of processing your personal data.

2.2 Where bossbb engages third-party service providers to process personal data on its behalf (for example, payment processors, KYC verification services, or game studio partners), those parties act as data processors and are contractually bound to process data only on bossbb's documented instructions and in accordance with applicable data protection requirements.

2.3 bossbb's data protection contact is reachable at [email protected] for any data-related enquiries.

3. Information We Collect

3.1 Registration Data. When you register for a bossbb account, we collect: your full legal name, date of birth, residential address, email address, and telephone number. This information is required to create and maintain your Account and to verify your age eligibility.

3.2 Identity Verification (KYC) Data. To comply with our anti-money laundering (AML) and Know Your Customer (KYC) obligations, bossbb collects copies of government-issued identity documents (e.g. MyKad for Malaysian citizens, passport for others), proof of address documentation, and in some circumstances, source-of-funds documentation. This data is collected prior to processing your first withdrawal and may be re-requested periodically.

3.3 Financial Data. We collect details of payment methods used to make deposits (e.g. Touch n Go eWallet account reference, bank account details for Malaysian bank transfers via Maybank, CIMB, or Hong Leong Bank, GrabPay or Boost eWallet identifiers, or cryptocurrency wallet addresses for USDT TRC20 transactions). We do not store full card numbers or CVV codes.

3.4 Transaction Data. We maintain records of all deposits, withdrawals, wagers placed, games played, bonuses claimed, and related financial transactions associated with your Account.

3.5 Technical Data. We automatically collect certain technical data when you access the Platform, including: IP address, device type and operating system, browser type and version, session timestamps, pages visited, and referring URLs. This data is used for fraud prevention, security monitoring, and aggregate platform analytics.

3.6 Communications Data. If you contact bossbb support or your assigned personal manager, we retain records of those communications including the content of messages, for quality assurance and dispute resolution purposes.

3.7 Responsible Gaming Data. Where you activate responsible gaming tools (deposit limits, self-exclusion, cooling-off periods), we record those preferences and settings to enforce them accurately across your Account and sessions.

4. How We Use Your Personal Data

4.1 bossbb uses your personal data for the following purposes:

• Account management: creating, maintaining, and managing your bossbb Account, including VIP tier tracking and personal manager assignment.
• Identity and age verification: confirming you meet the 21+ age requirement and verifying your identity for KYC compliance.
• Payment processing: processing deposits and withdrawals through your nominated payment methods (Touch n Go eWallet, Boost, GrabPay, Malaysian bank transfers, USDT TRC20, and other supported methods).
• Regulatory compliance: fulfilling AML, counter-financing of terrorism (CFT), and other regulatory obligations under our gaming licence, including transaction monitoring and suspicious activity reporting where required by law.
• Fraud prevention and security: detecting and preventing fraudulent activity, multi-accounting, bonus abuse, unauthorised access, and other prohibited conduct as defined in our Terms & Conditions.
• Platform operation: providing you with access to casino games, sportsbook markets, and other Platform features, and personalising your experience based on your game history and preferences.
• Responsible gaming: monitoring your gaming activity to enforce any responsible gaming tools you have activated, and where appropriate, proactively offering support to Members showing indicators of potential gambling harm.
• Communications: sending you Account-related notifications, security alerts, transaction confirmations, and, where you have consented, promotional communications about bossbb offers and VIP events.
• Dispute resolution: investigating and resolving disputes between Members and bossbb using records of transactions, game outcomes, and communications.

5. Legal Bases for Processing

5.1 bossbb processes your personal data on the following legal bases:

• Contractual necessity: processing necessary to perform our contract with you (the Terms & Conditions), including Account management, payment processing, and provision of Platform services.
• Legal obligation: processing required to comply with applicable legal and regulatory obligations, including AML/KYC requirements, age verification, and transaction record-keeping under our gaming licence.
• Legitimate interests: processing for fraud prevention, security monitoring, platform integrity, and responsible gaming monitoring, where these interests are not overridden by your data protection rights.
• Consent: where processing is based on your explicit consent, such as receiving promotional communications. You may withdraw consent at any time by contacting bossbb support, without affecting the lawfulness of processing based on consent before its withdrawal.

6. Data Sharing & Third-Party Disclosure

6.1 bossbb does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes under any circumstances.

6.2 We may share your personal data with the following categories of recipients, strictly for the purposes set out in this Policy:

• Payment processors and e-wallet providers: to process your deposits and withdrawals (e.g. Touch n Go, Boost, GrabPay, and banking partners).
• KYC and identity verification service providers: to perform automated or manual identity and age verification in compliance with our AML obligations.
• Game studio partners: game providers (such as Pragmatic Play, NetEnt, PG Soft, and others) may receive limited session and wagering data necessary to operate their games within the bossbb Platform.
• Regulatory and law enforcement authorities: where required by law, court order, or the directions of our licensing authority, bossbb will disclose personal data as required.
• Technology and hosting providers: our Platform infrastructure providers who process data on our behalf under strict data processing agreements.

6.3 All third-party data processors engaged by bossbb are contractually required to maintain appropriate data security standards and to process personal data only in accordance with bossbb's documented instructions.

7. International Data Transfers

7.1 As bossbb operates under an international gaming licence, your personal data may be processed in jurisdictions outside Malaysia. Where personal data is transferred internationally, bossbb takes appropriate steps to ensure that such transfers are conducted with adequate safeguards, including contractual protections consistent with applicable data protection standards.

7.2 Game studio partners operating streaming infrastructure for bossbb's live casino tables may process certain session data in international locations where their studio facilities are based. These transfers are governed by data processing agreements that require the receiving party to maintain appropriate security measures.

8. Data Retention

8.1 bossbb retains personal data for as long as is necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods required by our regulatory obligations:

• Account and identity verification data: retained for a minimum of five (5) years from the date of Account closure, as required by AML regulations applicable under our gaming licence.
• Transaction records: retained for a minimum of five (5) years from the date of each transaction.
• Communications records: retained for a minimum of three (3) years from the date of communication, or longer if related to an unresolved dispute.
• Responsible gaming records: self-exclusion and limit records are retained indefinitely to prevent re-registration during an active exclusion period.

8.2 Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with bossbb's data lifecycle management procedures.

9. Cookies & Tracking Technologies

9.1 bossbb uses cookies and similar technologies on the Platform for the following purposes:

• Essential / session cookies: required for the Platform to function, including maintaining your logged-in session, remembering your language preferences, and ensuring security measures function correctly. These cannot be disabled without impairing Platform functionality.
• Functional cookies: used to remember your preferences such as your preferred game lobby view, last visited game category, and responsible gaming settings.
• Analytics cookies: used to collect aggregate, anonymised data about how Members use the Platform, to help bossbb improve functionality and user experience. bossbb uses first-party analytics only — we do not use third-party advertising networks or cross-site tracking cookies.

9.2 bossbb does not use advertising cookies, cross-site tracking pixels, or any cookie technology designed to track your behaviour on other websites for advertising retargeting purposes.

9.3 You may manage cookie preferences through your browser settings. Please note that disabling essential cookies will affect your ability to use core Platform features including the bossbb login process.

10. Data Security

10.1 bossbb implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and bossbb servers
• One-way cryptographic hashing for stored passwords (no bossbb staff member can read your password in plain text)
• Access controls limiting internal access to personal data to authorised personnel with a legitimate need
• Two-factor authentication (2FA) available for all Member Accounts and enforced for bossbb administrative access
• Regular independent security assessments and penetration testing of Platform infrastructure
• Anomaly detection and login monitoring to identify suspicious access patterns

10.2 In the event of a personal data breach that poses a risk to Members, bossbb will notify affected Members and relevant regulatory authorities in accordance with applicable notification obligations under our licensing jurisdiction.

10.3 While bossbb takes data security seriously, no internet-based platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own Account credentials.

11. Your Rights as a Data Subject

11.1 Subject to applicable legal and regulatory restrictions (including AML retention requirements), you have the following rights in relation to your personal data held by bossbb:

• Right of access: you may request a copy of the personal data bossbb holds about you.
• Right to rectification: you may request correction of inaccurate or incomplete personal data.
• Right to erasure: you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our regulatory retention obligations.
• Right to restriction: you may request that we restrict processing of your personal data in certain circumstances, for example while a correction request is being assessed.
• Right to data portability: where technically feasible and legally applicable, you may request a structured, machine-readable copy of personal data you have provided to bossbb.
• Right to withdraw consent: where processing is based on your consent (e.g. promotional communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to object: you may object to processing based on bossbb's legitimate interests, subject to bossbb's ability to demonstrate compelling legitimate grounds.

11.2 To exercise any of the above rights, contact bossbb at [email protected]. We will respond to verified requests within a reasonable timeframe, typically 30 days.

11.3 bossbb may require identity verification before processing a data subject rights request to ensure we do not disclose personal data to an unauthorised party.

12. Children's Privacy and Age Restriction

12.1 The bossbb Platform is strictly restricted to individuals aged 21 (twenty-one) years or older. bossbb does not knowingly collect, process, or retain personal data from individuals under the age of 21.

12.2 If bossbb becomes aware that personal data has been collected from an individual under 21 — whether through age verification failure or any other means — we will immediately suspend the associated Account, void any transactions, and securely delete the personal data collected, subject to any AML-related retention obligations that may apply.

12.3 If you believe a person under 21 has registered or attempted to register on the bossbb Platform, please notify us immediately at [email protected].

13. Changes to This Privacy Policy

13.1 bossbb reserves the right to update or amend this Privacy Policy at any time. Material changes will be communicated to Members via notification on the Platform or by email to the registered address prior to the effective date of the change.

13.2 The "Last updated" date at the top of this page reflects when the Policy was most recently revised. We encourage you to review this Policy periodically.

13.3 Your continued use of the bossbb Platform after the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not accept the amended Policy, you should discontinue use of the Platform and may request Account closure in accordance with our Terms & Conditions.

14. Contact & Complaints

14.1 For any questions, concerns, or requests regarding this Privacy Policy or bossbb's data handling practices, please contact us at: [email protected]

14.2 VIP Members at Gold tier and above may also direct privacy-related enquiries to their assigned personal manager, who will coordinate with bossbb's data protection team on your behalf.

14.3 If you believe bossbb has not handled your personal data in accordance with this Policy or applicable data protection law, you have the right to raise a complaint with bossbb's support team in the first instance. If you remain dissatisfied with bossbb's response, you may escalate your complaint to the applicable data protection supervisory authority in your jurisdiction.

14.4 bossbb takes all data protection complaints seriously and will acknowledge receipt of your complaint and provide a substantive response within 30 days of receipt of a verified complaint.