Encrypted Storage
Account records, payment information, and identity documents are stored with AES-256 encryption at rest and protected by TLS 1.3 during transit.
Your data, your rights
bos01 Privacy Policy
This Privacy Policy explains how bos01 collects, processes, stores, and protects the personal information of players based in Malaysia and elsewhere — from account registration and payment verification through to responsible gambling controls and support communications.
Privacy overview
How bos01 handles your personal data
bos01 collects only the information genuinely needed to operate a secure, compliant, and fair gaming service. We do not sell personal data to third parties. The sections below detail every category of data we process, how long we keep it, and what your rights are.
By using bos01, you acknowledge this Policy
Registering an account, making a deposit, placing a bet, or otherwise using bos01 indicates that you have read and understood this Privacy Policy. If you are under 21 years of age or do not consent to the data practices described here, you must not use the platform.
Minimum Necessary Collection
bos01 collects only the data required to verify identity, process MYR and crypto payments, prevent fraud, and comply with applicable legal obligations.
No Data Selling
Personal data is never sold to advertising networks, data brokers, or third-party marketers. Sharing is strictly limited to essential service providers under confidentiality obligations.
Your Right to Access & Correct
You may request a copy of the personal data bos01 holds about you and ask for corrections to any inaccurate or outdated information at any time.
Defined Retention Periods
Data is kept only as long as operationally necessary or legally required. Account data for closed accounts is retained for anti-money-laundering compliance periods before secure deletion.
Dedicated Privacy Support
Privacy requests — including access, deletion, restriction, and objection — may be submitted through the bos01 support team via live chat or the email address at the end of this Policy.
Full policy text
Data protection terms for bos01
The clauses below constitute the complete Privacy Policy of bos01. Section headings are provided for ease of reference only and do not limit the scope of any clause.
Introduction
This Privacy Policy governs the collection, use, storage, disclosure, and deletion of personal data by bos01 in connection with the bos01 website, player accounts, cashier and payment functions, casino and sports betting products, promotional programmes, customer support channels, responsible gambling tools, and related services (collectively, the "Platform").
bos01 serves adult players aged 21 and above, primarily across Malaysia, including users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and surrounding areas. References to "we", "our", or "bos01" mean the operator of the Platform. References to "you", "player", or "user" mean any individual who accesses or uses the Platform.
This Policy should be read alongside the bos01 Terms & Conditions and Responsible Gambling page. Where there is a conflict, the more specific document applicable to the relevant activity will govern.
Definitions
- Personal data means any information that identifies or can reasonably be used to identify a natural person, including name, identification number, contact details, payment information, device identifiers, and behavioural data.
- Processing means any operation performed on personal data, including collection, recording, storage, alteration, retrieval, use, disclosure, blocking, erasure, or destruction.
- Controller means bos01 as the entity that determines the purposes and means of processing personal data.
- Third-party processor means a company or individual that processes personal data on behalf of bos01 under a data processing agreement and subject to confidentiality obligations.
- Consent means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
- Data subject means the individual to whom personal data relates, in this context the registered bos01 player or website visitor.
Personal Data We Collect
bos01 collects personal data through direct player submission, automated technical means, and third-party verification services. The categories collected and their primary sources are as follows:
| Category | Examples | Primary source |
|---|---|---|
| Registration data | Full name, date of birth, email address, username, phone number | Submitted by player at sign-up |
| Identity verification | National identity card, passport scan, proof of address, selfie | Submitted by player; cross-checked by verification partner |
| Payment and financial data | Bank account holder name, Touch 'n Go / Boost / GrabPay user ID, DuitNow reference, FPX transaction ID, cryptocurrency wallet address, transaction amounts in MYR | Payment provider and player submission |
| Source of funds / wealth | Bank statements, employment records, business documents — requested where legally required | Submitted by player on request |
| Device and technical data | IP address, browser type, operating system, device fingerprint, session timestamps, geolocation (country/region level) | Automatically collected during Platform use |
| Behavioural and betting data | Wager history, deposit frequency, game session length, bonus usage, sports markets accessed (EPL, Liga Super Malaysia, UFC etc.) | Automatically generated through Platform activity |
| Support communications | Live chat transcripts, email correspondence, ticket content | Direct player communication |
| Responsible gambling data | Deposit limit settings, self-exclusion elections, session limit preferences, cooling-off periods | Player-selected within account settings or via support |
bos01 does not intentionally collect data from persons under 21. If we become aware that data from a minor has been submitted, we will take prompt steps to delete it and close the relevant account.
Legal Bases and Purposes of Processing
bos01 processes personal data only where a lawful basis exists. The primary bases and corresponding purposes are:
Contract performance
Processing is necessary to open and manage your account, process deposits and withdrawals through Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, USDT, BTC, ETH, or BNB, verify transaction ownership, settle sports wagers and casino outcomes, administer promotions and VIP rewards, and respond to account queries.
Legal obligation
bos01 is required to verify identity and age (21+ minimum), conduct anti-money-laundering checks, screen for politically exposed persons and sanctions lists, maintain transaction records, and respond to lawful requests from competent authorities.
Legitimate interests
bos01 relies on legitimate interests for fraud prevention, account security monitoring, platform abuse detection, system analytics to improve performance and stability, responsible gambling monitoring (detection of at-risk betting patterns), and communicating platform updates that are directly relevant to your account.
Consent
Where bos01 sends optional promotional communications or engages in processing activities that go beyond the above bases, we will request your explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.
Cookies and Technical Tracking
bos01 uses strictly necessary cookies and session tokens to authenticate your account, maintain security tokens, prevent cross-site request forgery, and ensure the Platform operates correctly. These cannot be disabled without rendering the service non-functional.
bos01 may also use performance analytics tools to measure Platform speed, page load errors, and feature usage in aggregate form. Where analytics involve third-party processors, those processors are bound by data processing agreements and are not permitted to use Platform data for their own purposes.
bos01 does not use advertising cookies, cross-site tracking pixels, social media tracking buttons, or behavioural profiling for external ad networks. Device fingerprinting is used exclusively for fraud prevention, account security, and multi-account detection purposes.
Data Sharing and Third Parties
bos01 does not sell personal data. Disclosure to third parties is limited to the following categories, each subject to contractual confidentiality and data security obligations:
- Payment processors: Touch 'n Go, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency network operators receive only the transaction data required to process a specific payment instruction.
- Identity and KYC verification providers: Receive identity documents and biometric data to verify age and identity as required for account opening and withdrawal processing.
- Game and platform technology providers: Casino and sports betting data is shared with game suppliers and odds feed providers to the extent required to operate those products and settle outcomes.
- Fraud prevention and security services: Device data, IP addresses, and transaction patterns may be shared with anti-fraud systems to protect player funds and Platform integrity.
- Professional advisers: Legal, audit, compliance, and insurance advisers may receive personal data under strict confidentiality obligations where necessary for those engagements.
- Competent authorities: bos01 will disclose data where required by a court order, regulatory instruction, law enforcement agency request, or other legally enforceable demand.
bos01 requires all third-party processors to implement adequate technical and organisational security measures and to process data only for the purposes described in their engagement with bos01.
International Data Transfers
bos01 operates with infrastructure and third-party providers that may be located in countries outside Malaysia. Where personal data is transferred to a jurisdiction that does not offer a comparable standard of data protection by default, bos01 relies on contractual safeguards, such as standard data protection clauses incorporated into processor agreements, to provide appropriate protection for personal data.
Cryptocurrency blockchain transactions are inherently recorded on decentralised public ledgers. Wallet addresses visible on public blockchains are not associated with your name or bos01 account details by bos01, but the immutable and public nature of blockchain data is outside bos01's control once a transaction is broadcast to the network.
Data Retention
Personal data is retained only for as long as reasonably required to fulfil the purpose for which it was collected or as required by applicable legal, regulatory, audit, or dispute-resolution obligations. General retention guidelines are as follows:
- Active account data: Retained for the life of the account plus a minimum of five years after closure, to comply with anti-money-laundering record-keeping obligations.
- Transaction records: Retained for a minimum of seven years from the date of the transaction.
- Identity verification documents: Retained for the minimum period required under the applicable compliance framework and deleted or rendered unreadable when that period expires.
- Support communications: Retained for up to three years after the conversation is closed, unless required longer for an ongoing dispute.
- Responsible gambling records: Self-exclusion records are retained for the duration of the exclusion period and for a defined period thereafter to prevent inadvertent account reinstatement.
When data is no longer required, it is securely deleted or anonymised so that it cannot reasonably be used to identify any individual.
Security Measures
bos01 implements a layered set of technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These include:
- TLS 1.3 encryption for all data in transit between your device and bos01 servers.
- AES-256 encryption for personal data and financial records stored on bos01 infrastructure.
- Access controls and role-based permissions ensuring that staff access personal data only to the extent necessary for their specific function.
- Multi-factor authentication requirements for internal systems that process personal data.
- Regular vulnerability assessments, penetration testing, and independent security reviews.
- Incident response procedures with defined timelines for detection, containment, remediation, and, where applicable, notification.
No digital system can be guaranteed absolutely secure. You are responsible for protecting your bos01 account credentials, device security, and any authentication codes received by email or SMS. Please do not share your password, one-time codes, or cryptocurrency wallet keys with any bos01 support representative or any other party.
Your Data Rights
Subject to applicable law and the conditions described below, you hold the following rights in respect of the personal data bos01 processes about you. Requests may be submitted through live chat support or to the email address at the end of this Policy.
Your data rights
Rights you hold over your personal data
bos01 recognises the following rights for every registered player. Each right is subject to legal limitations, such as anti-money-laundering record-keeping obligations and fraud investigation requirements.
Right to Access
You may request a summary of the personal data bos01 holds about you, including the categories processed, the purposes, and any third parties with whom data has been shared.
Right to Rectification
You may ask bos01 to correct inaccurate personal data or complete incomplete data. Certain corrections may require supporting documentation to protect account integrity.
Right to Erasure
You may request deletion of personal data that is no longer necessary for the original purpose, processed on the basis of consent you have withdrawn, or processed unlawfully. Legal retention obligations may prevent immediate deletion of certain records.
Right to Restriction
In certain circumstances — such as where accuracy is contested or processing is under objection — you may request that bos01 restricts further processing of your personal data while a matter is resolved.
Right to Objection
You may object to processing carried out on the basis of legitimate interests, particularly where that processing has a significant effect on your interests, rights, or freedoms. bos01 will assess the objection against the applicable lawful basis.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal, and certain processing necessary to manage your account will continue under other legal bases.
Children and Age Verification
bos01 is strictly intended for adults aged 21 years and above. We apply age verification checks at the point of account creation and prior to processing withdrawal requests. If bos01 determines, at any point, that a registered account belongs to a person under the age of 21, we will suspend access, conduct a full review, and if confirmed, close the account. Any balance held in such an account will be handled in accordance with our anti-fraud and compliance obligations.
If a parent or guardian believes their child has registered on bos01, they should contact support immediately. bos01 treats minor access as a serious matter requiring prompt action.
Responsible Gambling and Data Processing
bos01 monitors certain behavioural indicators — including deposit frequency, session duration, wager escalation, and self-exclusion history — for the purpose of responsible gambling intervention. This monitoring uses automated pattern analysis and may flag an account for manual review by a responsible gambling specialist.
Where bos01 identifies indicators of potential gambling harm, we may contact the player to provide information about support resources, suggest setting deposit or loss limits, or initiate a cooling-off period. In some circumstances, bos01 may restrict betting activity on the account pending review.
Responsible gambling data is processed on the basis of legitimate interests in protecting player welfare and on legal obligations where applicable. For full details of responsible gambling tools available at bos01, including self-exclusion, deposit limits, and session controls, please visit the Responsible Gambling page.
Automated Decision-Making
bos01 uses automated systems to assist with fraud detection, multi-account identification, risk assessment, and responsible gambling monitoring. In certain limited circumstances, an automated process may result in temporary account restrictions pending manual human review.
Where a significant decision is made about your account based primarily on automated processing — such as a fraud-related restriction — you have the right to request a manual review by a bos01 team member. Please contact support, providing your account details and a description of the decision you wish to challenge.
Changes to This Privacy Policy
bos01 may update this Privacy Policy to reflect changes in our data practices, legal requirements, platform features, or payment methods. The revised version will be published on this page with an updated effective date. Where changes are material, bos01 may provide notice through the Platform or by email where contact details are available.
Continued use of bos01 following publication of an updated Policy constitutes acceptance of the revised terms. If you do not accept a material change, you should stop using the Platform and request account closure, ensuring any pending balances and wagers are resolved beforehand.
Contact Us
For questions about this Privacy Policy, to submit a data rights request, or to report a privacy concern, please contact the bos01 support team through live chat on the Platform or by email at [email protected]. The email address is displayed as plain text and is not a clickable link.
When submitting a data rights request, include your registered account username and a clear description of the right you wish to exercise. bos01 may request identity verification before fulfilling a request to prevent unauthorised access to another person's data.
bos01 aims to acknowledge requests within five business days and to provide a substantive response within the timeframe required by applicable law, ordinarily no longer than 30 days from receipt of a complete and verified request.
Your privacy is part of responsible play
bos01 believes that protecting player data and promoting responsible gambling are two sides of the same commitment: treating players with respect. The same account protections that guard your funds — verified identity, encrypted storage, controlled access — also support the responsible gambling controls that help you stay in charge of your play.
Review your account privacy settings or responsible gambling controls at any time by contacting bos01 support. Full details of available limits, cooling-off periods, and self-exclusion options are covered on the Responsible Gambling page. For full account rules, see the Terms & Conditions.
🔞 Players aged 21+ only
Continue exploring bos01
Your data is safe. Your play is your choice.
Return to the bos01 homepage to explore the platform, supported payment methods, sports markets, and casino games. For any privacy or account concern, our 24/7 support team is available in English, Bahasa Melayu, and Chinese.
For adults aged 21 and above only · Gambling involves financial risk