bos96 Privacy Policy

1. Data Controller

1.1 bos96, operating at bos96.win, is the data controller in respect of personal data collected from Members and visitors to the Platform. As data controller, bos96 determines the purposes and means by which personal data is processed.

1.2 For all data protection queries, Members may contact the bos96 Data Protection team via the support channels listed in Section 15 of this Policy.

2. Personal Data We Collect

bos96 may collect the following categories of personal data in connection with your use of the Platform:

3. How We Collect Your Data

bos96 collects personal data through the following means:

• Direct submission: information you provide during registration, KYC verification, deposit or withdrawal requests, and support interactions;
• Automated collection: technical and usage data collected automatically via cookies, log files, and session tracking technologies when you access the Platform;
• Third-party sources: identity verification data from licensed KYC service providers; fraud and AML screening data from compliance partners; payment transaction data from FPX, Touch n Go eWallet, Boost, and banking partners.

4. Legal Basis for Processing

bos96 processes personal data on the following legal bases:

• Contractual necessity: processing required to register your Account, manage your Balance, process transactions, and deliver the gaming Services you have requested;
• Legal obligation: processing required to comply with applicable laws, including anti-money laundering regulations, age verification requirements, and gaming licence conditions;
• Legitimate interests: processing required for fraud prevention, platform security, responsible gaming monitoring, and business analytics — where those interests do not override your fundamental rights;
• Consent: where we have obtained your explicit consent for specific processing activities, including certain marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. How We Use Your Personal Data

bos96 uses your personal data for the following purposes:

• Creating and managing your bos96 Account, including identity verification and age confirmation;
• Processing deposits and withdrawals via FPX, Maybank2u, CIMB Clicks, Public Bank, Touch n Go eWallet, and Boost;
• Communicating with you about account status, transaction confirmations, promotional offers (where consented), and support responses;
• Enforcing responsible gaming tools including deposit limits, session reminders, cooling-off periods, and self-exclusion;
• Detecting, investigating, and preventing fraudulent activity, bonus abuse, and violations of the Terms & Conditions;
• Complying with anti-money laundering, counter-terrorist financing, and gaming licence regulatory requirements;
• Analysing platform usage patterns to improve Service quality, game offering, and user experience;
• Resolving customer support requests and disputes.

6. Sharing Your Personal Data

6.1 bos96 does not sell, rent, or otherwise provide your personal data to third parties for their own marketing purposes.

6.2 bos96 may share your personal data with the following categories of recipients:

• Service Providers: KYC verification providers, payment processors (FPX, Touch n Go eWallet, Boost), IT infrastructure providers, and customer support platform operators — solely for the purpose of delivering services to bos96 under binding data processing agreements;
• Game Providers: licensed game studios whose products are offered on the Platform may receive game session data necessary to operate the game and resolve disputes;
• Regulatory & Licensing Authorities: bos96's licensing authority and applicable regulatory bodies may require access to Member data for compliance audit and investigation purposes;
• Law Enforcement & Legal Proceedings: bos96 will disclose personal data where required to do so by law, court order, or governmental authority, or where necessary to protect the rights, property, or safety of bos96, its Members, or others.

6.3 All third-party recipients of personal data are contractually required to maintain appropriate technical and organisational security measures and to use the data only for the purposes specified by bos96.

7. Cookies & Tracking Technologies

7.1 bos96 uses cookies and similar tracking technologies to operate the Platform, maintain your login session, remember your preferences, and analyse platform usage. Cookies are small text files stored on your device by your browser.

7.2 The following categories of cookies are used on the bos96 Platform:

• Strictly Necessary: required for the Platform to function, including session authentication and security tokens. These cannot be disabled.
• Functional: remember your preferences (language, display settings) to personalise your experience.
• Analytical: collect aggregated, anonymised data about how Members use the Platform to improve performance and game selection.

7.3 You may control cookie preferences through your browser settings. Disabling strictly necessary cookies will impair the functionality of the Platform, including your ability to log in.

8. Data Retention

8.1 bos96 retains personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, subject to applicable legal retention requirements.

8.2 Account data is retained for the duration of the Member relationship plus a minimum of five (5) years following account closure, in accordance with applicable anti-money laundering and gaming licence record-keeping obligations.

8.3 Financial transaction records are retained for a minimum of seven (7) years as required under applicable financial regulation.

8.4 Following the applicable retention period, personal data is securely deleted or anonymised in accordance with bos96's data destruction procedures.

9. Data Security

9.1 bos96 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Measures include:

• TLS 1.3 encryption for all data in transit between your device and bos96 servers;
• AES-256 encryption at rest for sensitive data fields including financial identifiers;
• bcrypt password hashing with unique per-user salt values;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security audits and penetration testing by qualified security professionals;
• Intrusion detection systems and real-time login anomaly monitoring.

9.2 In the event of a personal data breach that is likely to result in a high risk to your rights, bos96 will notify affected Members without undue delay and in accordance with applicable notification obligations.

10. Your Data Rights

Subject to applicable law, you have the following rights in respect of your personal data held by bos96:

• Right of Access: you may request a copy of the personal data bos96 holds about you;
• Right to Rectification: you may request correction of inaccurate or incomplete personal data;
• Right to Erasure: you may request deletion of your personal data where bos96 has no legal obligation or overriding legitimate interest to retain it;
• Right to Restriction: you may request that processing of your personal data be temporarily restricted in certain circumstances;
• Right to Data Portability: you may request your personal data in a structured, commonly used, machine-readable format;
• Right to Object: you may object to processing based on legitimate interests or for direct marketing purposes;
• Right to Withdraw Consent: where processing is based on consent, you may withdraw at any time without affecting prior lawful processing.

To exercise any of these rights, contact the bos96 support team. bos96 will respond within 30 days of receiving a verifiable request, subject to identity verification requirements.

11. Children's Privacy

11.1 The bos96 Platform is strictly restricted to individuals aged 21 years and above. bos96 does not knowingly collect personal data from any person under the age of 21.

11.2 If bos96 becomes aware that personal data has been collected from a person under the age of 21, the associated Account will be immediately terminated, all data will be deleted, and any balance will be forfeited in accordance with the Terms & Conditions.

11.3 If you have reason to believe that a minor has accessed the bos96 Platform or provided personal data, please contact support immediately.

12. International Data Transfers

12.1 bos96's primary servers are located in jurisdictions consistent with our licensing requirements. In the course of delivering Services, your personal data may be transferred to and processed in countries outside Malaysia, including countries whose data protection laws may differ from those applicable in Malaysia.

12.2 Where personal data is transferred internationally, bos96 ensures appropriate safeguards are in place, including data processing agreements incorporating recognised contractual protections or transfers to jurisdictions with adequacy determinations under applicable law.

13. Third-Party Content

13.1 The bos96 Platform may contain links to third-party service providers' interfaces — including game studios, payment processors, and customer support tools. This Privacy Policy applies only to data processed by bos96 directly.

13.2 bos96 is not responsible for the privacy practices of third-party service providers. Members are encouraged to review the privacy policies of any third-party services they interact with through the Platform.

14. Changes to This Privacy Policy

14.1 bos96 reserves the right to update this Privacy Policy at any time. Where changes are material — particularly those affecting how we use your personal data or the rights available to you — bos96 will notify Members via email or in-platform notification at least 14 days prior to the changes taking effect.

14.2 Your continued use of the bos96 Platform following the effective date of a revised Privacy Policy constitutes your acceptance of the revised terms.

14.3 The current version of this Privacy Policy is always available on the bos96 website with the effective date clearly displayed.

15. Contact & Data Requests

For all data protection enquiries, access requests, or to exercise any of your rights under this Privacy Policy, please contact the bos96 Data Protection team:

• Live Chat: Available 24/7 via the Platform after login — fastest response channel
• Email: [email protected]

Please include "Privacy Request" in your subject line and provide sufficient identification for us to verify your identity before processing access or deletion requests. bos96 targets a response within 30 calendar days.