boss96 Privacy Policy

boss96 operates the online gaming platform accessible at boss96.win, providing sports betting, live casino, slot games, and related services primarily to members based in Malaysia. As part of providing these services, boss96 necessarily processes personal data about its members and platform visitors.

This Privacy Policy applies to all personal data processed by boss96 in connection with the Platform, including data collected during registration, identity verification (KYC), deposit and withdrawal transactions, gameplay, customer support interactions, and marketing communications. This Policy should be read alongside our Terms & Conditions, which govern your overall use of the Platform.

By registering for an account on boss96 or continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should cease using the Platform and may request closure of your account.

boss96 collects the following categories of personal data in the course of operating the Platform:

Identity & Registration Data:

• Full legal name as it appears on your government-issued identification;
• Date of birth (used to verify the minimum age requirement of 21 years);
• Gender (optional, where provided);
• Nationality and country of residence;
• Residential address, including postcode;
• Email address and mobile phone number;
• Username selected during registration.

Identity Verification (KYC) Data:

• Copies of government-issued photo identification (MyKad, passport, driving licence);
• Proof of residential address (utility bill, bank statement);
• Proof of payment method ownership where required by compliance review;
• Selfie or facial verification image where required for identity matching.

Financial & Transaction Data:

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method identifiers;
• E-wallet account identifiers (Touch n Go eWallet, Boost) or bank account references used for transactions;
• Account balance history and bonus records.

Gaming & Activity Data:

• Bet history, game session logs, wagering amounts, game outcomes;
• Login timestamps, session durations, and device information;
• IP address and approximate geolocation at login;
• Responsible gaming tool settings (deposit limits, self-exclusion status).

Communications Data:

• Records of customer support interactions (live chat, email correspondence);
• Responses to surveys or feedback requests (where participated in voluntarily);
• Records of marketing communication preferences and opt-in/opt-out history.

Technical Data:

• Browser type and version, device type and operating system;
• Cookie identifiers and session tokens;
• Referring URL and pages visited within the boss96 Platform.

boss96 collects personal data through the following channels and mechanisms:

• Direct submission: When you complete the registration form, submit KYC documentation, make a deposit or withdrawal request, contact customer support, or respond to a survey;
• Automated collection: Through cookies, session tokens, server logs, and analytics tools that automatically record technical and activity data when you interact with the Platform;
• Payment processors: Transaction reference data provided by e-wallet and banking payment gateways upon processing deposits and withdrawals;
• Identity verification partners: Where boss96 uses a third-party KYC service provider to assist with document verification, that provider may return verification status data and associated identity metadata to boss96;
• Fraud and security tools: Risk scoring data from fraud detection services that analyse device fingerprints, IP reputation, and behavioural patterns in connection with account activity.

boss96 uses the personal data we collect for the following purposes:

• Account administration: Creating, maintaining, and managing your boss96 account, including authentication and account security;
• Service delivery: Processing deposits and withdrawals, crediting bonuses, recording bets, settling game outcomes, and providing all gaming and sportsbook services on the Platform;
• Identity verification and AML compliance: Verifying your identity to satisfy our KYC obligations, detecting and preventing money laundering, terrorist financing, and other financial crime;
• Age verification: Confirming that you meet the minimum age requirement of 21 years before permitting gaming activity;
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent account activity, unauthorised access, bonus abuse, and collusion;
• Responsible gaming: Monitoring gambling behaviour to identify potential problem gambling indicators and administering responsible gaming tools requested by members;
• Customer support: Responding to enquiries, resolving complaints, and providing technical assistance;
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates to members who have consented to receive such communications — you may opt out at any time;
• Legal and regulatory compliance: Meeting our obligations under applicable licensing conditions, court orders, and applicable law;
• Platform analytics and improvement: Analysing aggregated usage patterns to improve the user experience, resolve technical issues, and develop new features.

Where applicable data protection law requires a legal basis for the processing of personal data, boss96 relies on the following bases:

• Performance of a contract: Processing necessary for the performance of our contractual obligations to you as a registered member of the Platform — including account management, deposits, withdrawals, and provision of gaming services;
• Legal obligation: Processing necessary for compliance with our regulatory and legal obligations, including KYC, AML, age verification, and licensing requirements;
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gaming oversight, and Platform analytics — where those interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications, non-essential cookies, and any other processing where we have specifically requested and obtained your consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

boss96 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Game and platform technology providers: Third-party game studios (e.g., live casino, slot providers) and platform infrastructure providers who process limited technical and session data to deliver services — all operating under data processing agreements with boss96;
• Payment processors: E-wallet operators and banking gateways (including Touch n Go eWallet, Boost, and FPX bank partners) receive transaction data necessary to process deposits and withdrawals;
• KYC and identity verification services: Specialist verification providers who process identity documents and return verification status data to boss96;
• Fraud detection and risk services: Third-party services that analyse device and behavioural data to provide risk scoring and fraud alerts;
• Regulatory and law enforcement authorities: Where required by applicable law, a valid court order, or our licensing conditions — including suspicious transaction reporting obligations under AML frameworks;
• Professional advisors: Legal, audit, and compliance advisors who are bound by professional confidentiality obligations;
• Group entities: Where boss96 operates as part of a corporate group, data may be shared with affiliated entities for internal compliance, audit, or operational purposes, subject to equivalent data protection standards.

All third-party data processors engaged by boss96 are required to maintain appropriate technical and organisational security measures and to process personal data only in accordance with boss96's documented instructions.

boss96 retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of account membership and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements;
• Transaction and financial records: Retained for a minimum of seven (7) years from the date of the transaction, consistent with financial record-keeping obligations;
• Gaming activity logs: Retained for a minimum of three (3) years from the date of the session, and for the duration of any active dispute relating to the session;
• Customer support records: Retained for three (3) years from the date of last communication;
• Marketing consent records: Retained for the period of the consent plus a reasonable period thereafter to evidence that consent was obtained and respected;
• Self-exclusion records: Where a member has self-excluded, we retain sufficient information to enforce the exclusion for its stated duration and to prevent re-registration during that period.

Following the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised in accordance with our internal data lifecycle management procedures.

The boss96 Platform uses cookies and similar tracking technologies to enable essential functionality, improve user experience, and analyse Platform usage. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function — including session authentication tokens, security cookies, and load balancing identifiers. These cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Remember your preferences such as language, time zone, and display settings to personalise your experience on boss96.
• Analytics cookies: Collect aggregated, pseudonymised data about how members use the Platform — pages visited, session duration, interaction patterns — to help us improve Platform performance and usability. Where consent is required, these are only activated after you provide it.
• Marketing cookies: Used to deliver relevant promotional content within the Platform and, where applicable, through partner channels. These are subject to your marketing consent preference.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will affect your ability to log in and use the Platform. For analytics and marketing cookies, you may withdraw consent at any time by adjusting your account privacy settings or by updating your browser preferences.

boss96 implements comprehensive technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures in place include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the boss96 servers;
• Encryption of sensitive data fields at rest in the Platform's database systems;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Multi-factor authentication for administrative and support staff accessing member data systems;
• Regular security vulnerability assessments and penetration testing by qualified third-party security professionals;
• Documented incident response procedures for responding to personal data breaches, including notification obligations under applicable law;
• Continuous fraud and anomaly detection systems monitoring account activity in real time.

While boss96 takes all reasonable steps to protect your personal data, no transmission over the internet is completely secure. You are responsible for maintaining the security of your boss96 login credentials and must notify us immediately if you suspect unauthorised access to your account.

Subject to applicable law and our legal obligations (including KYC and AML retention requirements), you have the following rights in relation to your personal data held by boss96:

To exercise any of these rights, please submit a written request to the boss96 support team at the email address provided in the Contact section of this Policy. We will respond to valid requests within 30 days. Where requests are complex or numerous, this period may be extended by a further 60 days, and we will notify you accordingly.

Please note that certain rights may be limited where compliance with applicable law — particularly AML record-keeping obligations — requires boss96 to retain personal data beyond your request for deletion.

The boss96 Platform is strictly for adults aged 21 years and above. boss96 does not knowingly collect personal data from persons under 21 years of age. The Platform's KYC verification process is designed to identify and prevent the registration of underage individuals.

If you are a parent or guardian and believe that a minor in your care has registered on the Platform or provided personal data to boss96 without your consent, please contact us immediately using the details in Section 13. Upon verification of the report, we will immediately suspend the account, delete the associated personal data to the extent permitted by applicable legal obligations, and return any funds deposited to the original payment source.

boss96 recommends that parents and guardians implement appropriate parental control software on devices accessible to minors to prevent inadvertent access to online gambling platforms.

boss96 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. The "Last Updated" date at the top of this document will reflect the most recent revision.

Where material changes are made to this Policy, boss96 will notify registered members via the email address on record or by displaying a prominent notice on the Platform prior to the changes taking effect. We encourage you to review this Policy periodically.

Your continued use of the boss96 Platform following notification of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you should cease using the Platform and may request account closure by contacting support.

For any questions, concerns, or requests related to this Privacy Policy or the personal data boss96 holds about you, please contact our support team using the details below. Please include "Privacy Request" in the subject of your correspondence to ensure prompt routing to the appropriate team.

For complaints about how boss96 has handled your personal data that cannot be resolved through direct contact, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.