Privacy Policy

1Introduction

This Privacy Policy ("Policy") is published by Bosswin168 ("the Company", "we", "us", "our") and applies to all personal data collected, processed, stored, or transmitted by us in connection with the Bosswin168 platform available at https://bosswin168.cam and any related mobile or digital services.

By registering an account with Bosswin168 or by continuing to access and use our platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy, which together form the full body of rules governing your use of the Bosswin168 platform.

Bosswin168 is committed to handling your personal information with transparency, integrity, and respect. We operate in accordance with internationally recognised data protection principles and the requirements of our operating licence. If you do not agree with any aspect of this Policy, please discontinue your use of the platform and contact our support team to close your account.

2Definitions

For the purposes of this Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a natural person, either directly or in combination with other data.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, transmission, disclosure, and deletion.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates — in most instances, this means you, the registered player.
• "Data Controller" means Bosswin168, which determines the purposes and means by which Personal Data is processed.
• "Data Processor" means any third party that processes Personal Data on behalf of the Company under a written data processing agreement.
• "KYC" means Know Your Customer — the identity and age verification process required by our operating licence and anti-money-laundering obligations.
• "Cookies" means small text files placed on your device by the platform to store session data, preferences, and analytical information.
• "Platform" means the Bosswin168 website, mobile site, and any associated digital services.

3Data We Collect

3.1 Registration Data

When you create a Bosswin168 account, we collect: your full legal name, date of birth, email address, mobile telephone number, residential address (including city, postcode, and country), and preferred currency (MYR). This information is required to establish and maintain your account and to comply with our KYC obligations.

3.2 Identity Verification Data

To complete the KYC process and unlock full account functionality — including withdrawals — we require copies of government-issued identification documents (such as a Malaysian identity card or passport), proof of current residential address (such as a utility bill or bank statement issued within the last three months), and proof of ownership of any payment method used to deposit funds.

3.3 Financial Transaction Data

We record details of all financial transactions conducted via your account, including deposits, withdrawals, bonus credits, wager amounts, and account balance history. Payment method identifiers — such as the last four digits of a bank account or e-wallet account number — are retained for fraud prevention and reconciliation purposes. Full card or account numbers are never stored on Bosswin168 servers.

3.4 Technical and Usage Data

When you access the Platform, our servers automatically log: your IP address, browser type and version, operating system, device identifiers, referring URL, pages visited, session duration, and feature interactions. This data is used for security monitoring, fraud detection, platform performance analysis, and continuous improvement of the user experience.

3.5 Communications Data

If you contact our customer support team via live chat or email, we retain records of those communications for quality assurance, dispute resolution, and staff training purposes. We may also send you service-related notifications, account alerts, and — where you have provided consent — promotional communications.

3.6 Responsible Gambling Data

Where you make use of our responsible gambling tools — such as setting deposit limits, requesting a cooling-off period, or self-excluding — we record the relevant instructions and their parameters. This data is treated with heightened confidentiality and is used solely to give effect to your choices and to meet our duty of care obligations.

4Data Processing

Bosswin168 processes your Personal Data for the following purposes:

• Account Management: Creating, maintaining, and securing your player account; processing login and session authentication; managing account preferences and settings.
• Identity and Age Verification: Fulfilling our KYC obligations, verifying that all players are aged 21 or above, and confirming the accuracy of registration information.
• Financial Processing: Processing deposits and withdrawals in MYR via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and cryptocurrency channels; reconciling transactions; detecting and preventing payment fraud.
• Regulatory Compliance: Meeting anti-money-laundering (AML) and counter-terrorism financing (CTF) obligations; responding to lawful requests from competent authorities; maintaining records as required by our operating licence.
• Platform Operation and Improvement: Analysing usage patterns to improve platform stability, game performance, and user experience; diagnosing technical issues; conducting internal research and product development.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have opted in to receive such communications. You may withdraw consent at any time via your account settings or by contacting support.
• Responsible Gambling: Administering player-initiated limits, cooling-off periods, and self-exclusions; monitoring account activity for indicators of problem gambling behaviour in line with our duty of care.
• Dispute Resolution and Legal Proceedings: Maintaining records necessary to investigate complaints, resolve disputes, and defend legal claims.

5Legal Basis for Processing

Bosswin168 processes Personal Data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions — including account management, transaction processing, and the provision of gambling services.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including KYC, AML, and CTF requirements, as well as lawful orders from regulatory or law enforcement authorities.
• Legitimate Interests: Processing carried out in pursuance of Bosswin168's legitimate business interests, including fraud prevention, platform security, and continuous service improvement, where such interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, and informed consent — principally in the context of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6Data Sharing

Bosswin168 does not sell, rent, or disclose your Personal Data to third parties for their own commercial or marketing purposes. We may, however, share your data with the following categories of recipients for the purposes described in this Policy:

6.1 Service Providers and Data Processors

We engage third-party service providers to assist in delivering the Platform and its features. These include payment processors facilitating MYR transactions via FPX and DuitNow networks, identity verification providers conducting KYC checks, cloud hosting and infrastructure providers, customer support software vendors, and data analytics platforms. All such providers are bound by written data processing agreements requiring them to process data only on our instructions and to maintain appropriate security standards.

6.2 Regulatory and Law Enforcement Authorities

We may disclose Personal Data to competent regulatory bodies, law enforcement agencies, or judicial authorities where we are legally required to do so, or where disclosure is necessary to protect the rights, safety, or property of Bosswin168, our players, or the public.

6.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's assets, Personal Data held by Bosswin168 may be transferred to the relevant successor entity, subject to equivalent privacy protections. Affected players will be notified of any such transfer in advance.

7International Data Transfers

Bosswin168 operates as an international online gambling platform. As a result, your Personal Data may be transferred to and processed in countries outside Malaysia, including countries where our hosting infrastructure, payment processors, and third-party service providers are located.

Where such transfers occur, Bosswin168 takes appropriate measures to ensure that your Personal Data receives a standard of protection consistent with this Policy and applicable data protection principles. These measures may include the execution of standard contractual clauses, reliance on adequacy decisions, or other legally recognised transfer mechanisms.

8Data Retention

Bosswin168 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. The following general retention periods apply:

• Account Data: Retained for the duration of your account relationship with Bosswin168, plus a minimum of five (5) years following account closure, to comply with AML and regulatory record-keeping obligations.
• Financial Transaction Records: Retained for a minimum of seven (7) years following the date of each transaction, in line with standard financial record-keeping requirements.
• KYC and Identity Documents: Retained for the duration of the account relationship plus five (5) years, or such longer period as may be required by applicable law.
• Customer Support Communications: Retained for up to three (3) years from the date of the communication, unless the subject matter requires a longer retention period for dispute resolution purposes.
• Technical and Usage Logs: Retained for up to twelve (12) months, following which they are aggregated and anonymised.
• Marketing Consent Records: Retained for the period during which consent remains active, plus an additional three (3) years as evidence of consent.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.

9Cookies & Tracking Technologies

9.1 What We Use

The Bosswin168 platform uses cookies and similar technologies — including web beacons and local storage objects — to maintain session continuity, store preferences, measure platform performance, and support security features such as fraud detection and login verification.

9.2 Types of Cookies

• Strictly Necessary Cookies: Essential for the Platform to function. These enable you to log in, navigate between pages, and access secure areas. They cannot be disabled without impairing core functionality.
• Performance Cookies: Collect anonymised information about how visitors interact with the Platform — such as which pages are visited most frequently and whether users encounter error messages. This data helps us identify and resolve performance issues.
• Functionality Cookies: Remember your preferences — such as language settings, preferred payment method, and display options — to provide a more personalised experience on your next visit.
• Security Cookies: Support our fraud detection and account security systems by identifying unusual access patterns and flagging potentially compromised sessions.

9.3 Managing Cookies

You can manage or disable cookies through your browser settings. Please note that disabling strictly necessary cookies may prevent you from accessing certain areas of the Platform or impair core functionality including login and payment processing. Instructions for managing cookies in the most widely used browsers are available through each browser's help documentation.

10Data Security

Bosswin168 implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• At-rest encryption for sensitive data stored on Bosswin168 infrastructure;
• Two-factor authentication available on all player accounts;
• Role-based access controls ensuring that internal staff can access only the data required to perform their specific functions;
• Regular penetration testing and vulnerability assessments conducted by independent third parties;
• Continuous monitoring of platform infrastructure for anomalous activity, intrusion attempts, and data exfiltration indicators;
• Formal data breach response procedures, including notification protocols aligned with applicable regulatory requirements.

Notwithstanding the above, no method of electronic transmission or storage is entirely secure. While we employ best-practice security standards, Bosswin168 cannot guarantee the absolute security of data transmitted over the internet. You are encouraged to protect your own account by using a strong, unique password and enabling two-factor authentication.

11User Rights

As a Data Subject, you hold the following rights in respect of your Personal Data held by Bosswin168. These rights are subject to applicable legal limitations and may be exercised by contacting our support team at any time:

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data we hold. Minor account details can be updated directly via your account settings panel.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is otherwise unlawful. This right is subject to overriding retention obligations under applicable law.
• Right to Restrict Processing: You may request that we limit our processing of your Personal Data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that we provide your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease such processing without requiring justification.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact the Bosswin168 support team via live chat or email. We will respond to substantive requests within thirty (30) days and will not charge a fee for reasonable requests. We reserve the right to verify your identity before processing any request that would result in disclosure or modification of Personal Data.

12Minors

The Bosswin168 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from individuals below this age. Our registration and KYC processes include mandatory age verification steps designed to identify and reject applications from underage individuals.

If we become aware that Personal Data has been collected from a person under the age of 21, we will take immediate steps to delete that data from our systems and terminate the associated account. If you have reason to believe that a minor has registered an account on our platform, please notify us immediately via the support channels listed below.

13Policy Amendments

Bosswin168 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes will be communicated to registered players via email notification and/or a prominent notice displayed upon login to the Platform, no fewer than fourteen (14) days before the amended Policy takes effect.

The "Last Updated" date at the top of this Policy will be revised upon each amendment. Your continued use of the Platform following the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not accept the amended Policy, you should discontinue use of the Platform and contact support to request account closure.

14Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the manner in which Bosswin168 processes your Personal Data, please contact us through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly inside your member dashboard. This is the fastest route to a response.
• Email: [email protected] — plain text address, not a clickable link.

Our Data Protection team reviews all privacy-related correspondence and aims to provide a substantive response within thirty (30) days of receipt. For urgent security concerns — such as suspected unauthorised access to your account — please use the live chat facility for the fastest resolution.

For information about responsible gambling tools and self-exclusion options, please visit our dedicated Responsible Gambling page. For a full description of your contractual rights and obligations, please refer to our Terms & Conditions.