bossbb Privacy Policy

This Privacy Policy describes how bossbb ("bossbb", "we", "us", "our"), the operator of the online gaming platform accessible at bossbb.app, collects, uses, stores, shares, and protects the personal data of individuals who register for, access, or otherwise interact with the bossbb platform ("Users", "you", "your").

bossbb operates under international gaming authority licensing, which imposes specific obligations regarding the collection and handling of personal data, including identity verification (KYC) and anti-money laundering (AML) requirements. This Privacy Policy is intended to fulfil our transparency obligations to you under those licensing conditions and under applicable data protection principles.

By registering a bossbb Account or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms of this policy, you should not use the bossbb platform. This policy should be read together with our Terms & Conditions.

bossbb collects personal data through several channels: directly from you during registration and account management; automatically through your use of the Platform; and from third-party identity verification and payment service providers. The categories of personal data we collect include:

bossbb does not collect sensitive personal data such as racial or ethnic origin, religious beliefs, health data, or biometric data beyond what is strictly required for identity document verification under our licensing obligations.

bossbb uses the personal data we collect for the following purposes:

• Account Registration and Management: To create, maintain, and administer your bossbb Account, including verifying your identity and processing your registration details.
• KYC and Regulatory Compliance: To fulfil our obligations under international gaming authority licensing, including identity verification, age verification (21+), and anti-money laundering checks. We are legally required to perform and retain records of these checks.
• Payment Processing: To process MYR deposits and withdrawals via supported payment methods including Touch n Go eWallet, Boost, FPX, and USDT, and to verify the legitimacy of financial transactions.
• Platform Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, and prohibited conduct as defined in our Terms & Conditions.
• Responsible Gaming: To monitor account activity for indicators of problem gambling behaviour and to administer responsible gaming tools including deposit limits, session limits, and self-exclusion where applied or requested.
• Customer Support: To respond to enquiries, process complaints, and provide account assistance through our live chat and email support channels.
• Platform Improvement: To analyse usage patterns, optimise platform performance, and improve the bossbb user experience, using aggregated and where possible anonymised data.
• Legal Compliance: To comply with any legal obligation, court order, regulatory direction, or law enforcement request applicable to bossbb's operations.

bossbb does not use personal data for automated decision-making that produces legal or similarly significant effects on Users, except where required for identity verification processes using certified third-party KYC technology.

bossbb processes personal data on the following legal bases:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the bossbb Terms & Conditions — including Account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with our international gaming licence conditions, anti-money laundering legislation, and other applicable regulatory requirements — including KYC verification and transaction monitoring.
• Legitimate Interests: Processing undertaken for the legitimate interests of bossbb or third parties, such as fraud prevention, platform security, and responsible gaming monitoring, where those interests are not overridden by your data protection rights.
• Consent: Where we rely on consent for specific processing activities (such as optional marketing communications), we will seek your explicit consent and provide a clear mechanism for withdrawal.

bossbb does not sell, rent, or trade personal data to third parties. We share personal data only in the following limited circumstances:

• KYC and Identity Verification Providers: Certified third-party identity verification services that assist bossbb in fulfilling its KYC and AML obligations under licensing requirements. These providers operate under strict data processing agreements.
• Payment Service Providers: Payment processors and e-wallet operators (including the operators of Touch n Go eWallet, Boost, and FPX) to the extent necessary to process your financial transactions. Each provider's own privacy policy governs their data handling.
• Game Content Providers: International gaming studios whose products are available on bossbb may receive anonymised or pseudonymised usage data for technical integration and RNG audit purposes. No directly identifiable personal data is shared with game providers without your knowledge.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, our international gaming licence, court order, or a valid request from a competent authority, bossbb will disclose personal data as legally required.
• IT and Security Service Providers: Infrastructure, hosting, cybersecurity, and analytics service providers operating under confidentiality obligations and data processing agreements with bossbb.

Any third party receiving personal data from bossbb is required, by contract, to use that data only for the specified purpose and to maintain appropriate security standards. bossbb remains responsible for ensuring that third-party data processing arrangements comply with applicable data protection principles.

bossbb uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential Cookies: Required for the Platform to function correctly, including maintaining your login session, storing account preferences, and enabling secure access. These cannot be disabled without affecting core Platform functionality.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users navigate the Platform — including pages visited, session duration, and navigation paths — to help us improve the user experience.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot detection, duplicate session monitoring, and geographic anomaly detection.

You may manage cookie preferences through your browser settings. Blocking essential cookies will impair your ability to use the bossbb Platform, including the ability to log in and maintain a session. Analytics and security cookies may be limited through browser settings without affecting core functionality.

bossbb does not use third-party advertising cookies or cross-site tracking technologies for the purpose of serving targeted advertisements to Platform users.

bossbb retains personal data for as long as is necessary for the purposes set out in this Privacy Policy, or as required by our international gaming licence obligations. Specific retention periods include:

• Account and identity data (including KYC documents) — retained for a minimum of five years following Account closure, as required under our licensing obligations for AML record-keeping.
• Transaction records — retained for a minimum of five years from the date of the transaction, in compliance with financial record-keeping requirements.
• Customer support correspondence — retained for three years following resolution of the relevant enquiry or complaint.
• Technical and usage logs — retained for up to 12 months on active systems, after which logs are archived or anonymised.

Where retention is no longer required or justified, bossbb securely deletes or irreversibly anonymises personal data so that it can no longer be attributed to an identifiable individual.

Subject to applicable law and the limitations imposed by our licensing obligations, bossbb Users have the following rights in relation to their personal data:

• Right of Access: You may request a copy of the personal data bossbb holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held about you.
• Right to Erasure: In certain circumstances, you may request deletion of your personal data. Note that where retention is required by law or licensing obligation (such as KYC and AML records), full erasure may not be possible during the required retention period.
• Right to Restriction: You may request that we restrict processing of your personal data in defined circumstances, such as where you contest the accuracy of the data.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming purposes, subject to our overriding legal and regulatory obligations.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact bossbb through live chat or by email at [email protected]. We will acknowledge your request within 5 business days and respond substantively within 30 days. In complex cases we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.

bossbb implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or alteration. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the bossbb Platform
• Encryption at rest for sensitive personal data and financial information held on our servers
• Role-based access controls limiting personal data access to authorised personnel who require it to perform their function
• Regular security assessments and penetration testing of Platform infrastructure
• Two-factor authentication requirements for administrative access to systems holding personal data
• Incident response procedures for detecting, containing, and notifying affected parties in the event of a data breach

No security system is infallible. In the event of a data breach that is likely to result in a risk to your rights and freedoms, bossbb will notify affected Users without undue delay and in accordance with applicable notification obligations under our licensing framework.

bossbb operates under international gaming authority licensing and may utilise service providers and infrastructure located in multiple jurisdictions. As a result, your personal data may be transferred to and processed in countries outside Malaysia, including countries whose data protection laws may differ from those applicable in Malaysia.

Where such international transfers occur, bossbb ensures that appropriate safeguards are in place, including contractual protections requiring the recipient to apply data security and confidentiality standards equivalent to those described in this Privacy Policy. By using the bossbb Platform, you acknowledge and consent to the potential transfer of your personal data for the purposes described in this policy.

The bossbb platform is strictly intended for persons aged 21 years and above. bossbb does not knowingly collect personal data from persons under 21. Age verification is a mandatory component of the bossbb KYC process, and Accounts found to belong to persons under 21 will be immediately closed and all associated personal data deleted, except where retention is required for regulatory compliance purposes.

If you believe that a person under the age of 21 has provided personal data to bossbb or created an Account, please contact us immediately at [email protected] so that we can take prompt action.

bossbb reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, updates to our licensing obligations, or changes in applicable law. Where changes are material, we will notify registered Users by email or via an in-Platform notification prior to the changes taking effect.

The effective date of the current version of this Privacy Policy is shown at the top of this page. We encourage you to review this policy periodically to remain informed about how bossbb handles your personal data. Continued use of the Platform following publication of an updated policy constitutes your acceptance of the revised terms.

For questions, concerns, or requests relating to your personal data, or to exercise any of your data rights described in Section 8, please contact bossbb through the following channels:

This Privacy Policy was last revised in June 2026 and is effective as of that date. The current version is always available at bossbb.app/privacy-policy.