Privacy Policy

This Privacy Policy ("Policy") is published by BOS138 ("the Platform", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://bos138.asia. This Policy applies to all users of the bos138 platform, including registered account holders, visitors who browse the platform without registering, and individuals who interact with our customer support channels.

BOS138 takes its data protection obligations seriously. We recognise that the personal data you share with us is sensitive — it includes identity documents submitted for KYC verification, financial transaction records associated with payment methods such as DuitNow, FPX, Maybank, Touch 'n Go eWallet, and cryptocurrency walets, as well as your gaming history and communication records. This Policy describes with precision how that data is handled.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the overarching legal framework governing your relationship with bos138.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, identification number, contact details, location data, online identifiers, and financial data.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means BOS138, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of BOS138, such as payment processors, KYC service providers, and cloud infrastructure providers.
• "Consent" means a freely given, specific, informed, and unambiguous indication of a data subject's agreement to the processing of their Personal Data.
• "KYC" means Know Your Customer identity verification procedures, including the collection and review of government-issued identity documents and proof of address.
• "Cookies" means small data files stored on your device by the bos138 platform for session management, preference storage, and analytics purposes.

BOS138 collects Personal Data from you through several channels — directly from you during registration and use of the platform, automatically through your interaction with platform systems, and in limited circumstances from third-party verification service providers. The categories of data we collect are described below.

3.1 Registration & Account Data

When you create a bos138 account, we collect:

• Full legal name as it appears on your government-issued identification document.
• Date of birth (for age verification — players must be 21 or above).
• Email address and mobile phone number.
• Username and hashed password credentials.
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam).

3.2 KYC Verification Data

To comply with identity verification requirements, we collect:

• Scanned or photographed copies of valid Malaysian government-issued identification (MyKad, Passport, or Driver's Licence).
• Proof of residential address (utility bill or bank statement dated within the last three months).
• Selfie images holding your identity document for liveness and authenticity verification.

3.3 Financial & Transaction Data

When you transact on the platform, we collect:

• Payment method details — bank account names, FPX reference identifiers, DuitNow QR transaction references, e-wallet account identifiers (Touch 'n Go, Boost, GrabPay), and cryptocurrency wallet addresses.
• Deposit and withdrawal transaction histories, amounts, timestamps, and processing statuses.
• Bonus claims, wagering history, and balance movements.

3.4 Technical & Usage Data

Automatically collected data includes:

• IP address, browser type and version, operating system, and device identifiers.
• Platform session data — login timestamps, session duration, pages visited, and features accessed.
• Game play logs — bet amounts, game selections, outcomes, and session durations.
• Cookie identifiers and tracking pixels (see Section 7).

BOS138 processes your personal data for the following specific purposes:

BOS138 processes your personal data only when a valid legal basis exists for doing so. The legal bases we rely on are as follows:

• Contractual Necessity: Processing is necessary to perform our obligations under the Terms and Conditions you agreed to when registering — including account management, payment processing, and game provision.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including anti-money laundering (AML) requirements, KYC verification mandates, and responsible gambling obligations.
• Legitimate Interest: Processing is necessary for the legitimate business interests of bos138, including fraud detection, platform security, and service improvement, provided those interests are not overridden by your rights and interests.
• Consent: Where we rely on consent — primarily for direct marketing communications — you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

BOS138 does not sell, rent, or trade your personal data to third parties for commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.

6.1 Service Providers (Data Processors)

We engage third-party service providers to assist in operating the bos138 platform. These providers act as Data Processors under binding contractual obligations and may only process your data on our documented instructions. Categories of service providers include: KYC and identity verification providers, payment processing partners (including gateway providers for DuitNow, FPX, and Maybank integrations), cloud hosting and infrastructure providers, fraud detection and cybersecurity vendors, and customer support platform providers.

6.2 Legal and Regulatory Disclosure

BOS138 may disclose your personal data to competent authorities, regulators, or law enforcement agencies where required by applicable law, court order, or regulatory direction. Such disclosures are made only to the extent required and are not subject to your prior consent where legal obligation mandates the disclosure.

6.3 Business Transfers

In the event of a merger, acquisition, sale of assets, or restructuring of the bos138 business, your personal data may be transferred to the successor entity as part of that transaction. You will be notified in advance of any such transfer and of any resulting changes to this Privacy Policy.

BOS138 uses cookies and similar tracking technologies to operate the platform, maintain your login session, remember your preferences, and analyse how players interact with the platform. The cookies we use fall into the following categories:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens and security cookies. They cannot be disabled without disrupting your use of the platform.
• Functional Cookies: Remember your preferences such as language settings, display options, and saved deposit method selections to improve your experience.
• Analytical Cookies: Help us understand how players navigate the platform, which pages are most visited, and where technical issues occur. Data collected is aggregated and anonymised where possible.
• Marketing & Retargeting Cookies: Used only where you have provided explicit consent to receive personalised promotional communications. You may opt out at any time via your account settings or browser cookie controls.

Most web browsers allow you to control cookie settings through the browser's privacy or settings menu. Note that disabling certain cookies may affect the functionality of the bos138 platform, including the ability to maintain a logged-in session.

BOS138 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply as general guide:

• Account registration data: Retained for the lifetime of your active account, plus a minimum of 5 years following account closure to satisfy AML and regulatory record-keeping obligations.
• KYC verification documents: Retained for a minimum of 5 years from the date of verification or account closure, whichever is later, in accordance with anti-money laundering requirements.
• Financial transaction records: Retained for a minimum of 7 years from the date of each transaction, in compliance with applicable financial record-keeping regulations.
• Communication records: Customer support interactions are retained for up to 3 years from the date of the last interaction.
• Technical and usage data: Retained in aggregated form for platform analytics; individual session logs are purged on a rolling12-month basis.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identified individual.

BOS138 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• AES-256 encryption for all stored personal data and KYC documents.
• TLS 1.3 encryption for all data transmitted between your browser or device and the bos138 platform (indicated by the HTTPS protocol and padlock symbol in your browser address bar).
• Strict role-based access controls ensuring that personal data is accessible only to authorised personnel with a documented business need.
• Regular penetration testing and security audits conducted by independent third-party cybersecurity specialists.
• Two-factor authentication (2FA) available to all players and mandatory for all platform administrative accounts.
• Secure, access-controlled data centre infrastructure with physical security controls.

As a data subject, you hold a number of rights in relation to the personal data that BOS138 processes about you. These rights are described below. To exercise any of these rights, please contact our support team via live chat or email (see Section 15).

BOS138 will respond to all valid data subject requests within 30 calendar days of receipt. Where the complexity or volume of requests requires additional time, we will notify you of an extension within the initial 30-day period. Note that certain rights may be limited where processing is required to fulfil a legal obligation or to establish, exercise, or defend legal claims.

The bos138 platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or store personal data relating to persons under the age of 21. Access by minors is prohibited and actively prevented through age-verification controls applied at the point of registration and during the KYC process.

If bos138 becomes aware that personal data has been collected from a person under 21 years of age without verifiable parental consent, we will take immediate steps to delete that data and close the associated account. All winings accumulated by an underage user will be voided and non-payable.

In the course of operating the bos138 platform, your personal data may be transferred to and processed in jurisdictions outside Malaysia by our Data Processors — including cloud infrastructure providers and KYC verification services. Where such transfers occur, BOS138 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that applied within Malaysia.

Safeguards for international transfers may include standard contractual clauses, binding corporate rules, or transfers to jurisdictions that have been assessed to provide an adequate level of data protection. If you require further information about the specific safeguards applicable to any international transfer of your data, please contact using the details in Section 15.

The bos138 platform may include links to third-party payment processors and integrations with external service providers (such as payment gateway landing pages for Maybank, CIMB, Public Bank, and other financial institutions). This Privacy Policy applies solely to the bos138 platform and does not extend to any third-party websites, payment portals, or applications that you may access in connection with using our services.

BOS138 is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party service before providing your personal data to them.

BOS138 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, operational requirements, or applicable legal and regulatory obligations. Where we make material changes to this Policy, we will notify you by displaying a prominent notice on the bos138 platform and, where we hold your email address, by sending you an email notification prior to the changes taking effect.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Your continued use of the bos138 platform after the effective date of any revision constitutes your acceptance of the updated Policy. If you do not accept the revised Policy, you should cease using the platform and contact our support team to request account closure.

If you wish to exercise any of your data subject rights, submit a privacy-related complaint, or have any questions about this Privacy Policy or how BOS138 handles your personal data, please contact us through the following channels:

All privacy and data protection requests are handled byos138's designated Data Protection team. We commit to acknowledging all requests within 5 business days and providing a full substantive response within 30 calendar days, in line with our obligations under applicable data protection law.

If you are not satisfied with our response to a privacy complaint, you retain the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction.