bossku Privacy Policy

1. Introduction

bossku ("we", "us", "the Platform", "bossku") is committed to protecting the privacy and personal data of all players who use the bossku Platform at bossku.win. This Privacy Policy ("Policy") describes how bossku collects, processes, stores, discloses, and safeguards your personal information when you register for and use the bossku online gaming services.

This Policy applies to all personal data collected through the bossku website, any associated mobile-optimised interfaces, customer support channels, and any other touchpoint through which bossku interacts with you as a player. This Policy should be read together with the bossku Terms & Conditions.

By registering a bossku account, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you should not create a bossku account or use the Platform.

2. Personal Data We Collect

2.1 Registration Data

When you create a bossku account, we collect: full legal name, date of birth, email address, mobile phone number, residential address, and your preferred currency (MYR). This information is required to create and maintain your account and to comply with our Know Your Customer (KYC) and anti-money laundering (AML) obligations.

2.2 Identity Verification Data

To comply with applicable regulatory requirements, bossku may request copies of government-issued identity documents (such as a Malaysian MyKad, passport, or driving licence) and proof of address documents (such as a recent utility bill or bank statement). This data is used solely for identity verification and fraud prevention purposes.

2.3 Financial Data

bossku collects payment method details to process deposits and withdrawals. This includes e-wallet identifiers (Touch 'n Go, Boost, GrabPay), bank account details (for FPX and direct bank transfers), and transaction history on the bossku Platform. Full payment card numbers are never stored by bossku — card processing is handled by certified PCI-DSS compliant payment processors.

2.4 Gaming Activity Data

bossku logs all game activity on the Platform, including: games played, bet amounts, win/loss outcomes, session durations, and interaction with responsible gaming tools. This data is used for account management, fraud detection, dispute resolution, and responsible gaming monitoring.

2.5 Technical & Device Data

When you access the bossku Platform, we automatically collect technical data including: IP address, device type, operating system, browser type and version, screen resolution, and referring URL. This information is used to optimise the bossku experience across different devices and to detect suspicious activity.

3. How bossku Uses Your Personal Data

bossku uses the personal data it collects for the following purposes:

• To create, maintain, and administer your bossku account.
• To verify your identity and age (21+) in compliance with applicable regulations.
• To process deposits, withdrawals, and other financial transactions via Malaysian payment methods including Touch 'n Go eWallet, DuitNow, FPX, and local bank portals.
• To detect and prevent fraud, money laundering, and other illegal activity.
• To provide customer support and resolve disputes.
• To monitor gaming activity for responsible gaming purposes, including identifying patterns that may indicate problem gambling.
• To send you service communications, including account notices, security alerts, and policy updates.
• To send promotional communications where you have opted in to receive them.
• To improve the bossku Platform through analytics and user behaviour research.
• To comply with all applicable legal and regulatory obligations.

4. Legal Basis for Processing

bossku processes your personal data on the following legal grounds:

• Contractual necessity — processing required to fulfil the bossku Terms & Conditions and deliver gaming services to you.
• Legal obligation — processing required to comply with KYC, AML, and other regulatory requirements applicable to online gaming platforms.
• Legitimate interests — fraud detection, security monitoring, and platform improvement, where these interests do not override your fundamental privacy rights.
• Consent — processing for marketing communications and non-essential cookies, where you have provided explicit, freely given, and withdrawable consent.

5. Data Sharing & Disclosure

bossku does not sell, rent, or trade your personal data to any third party for marketing purposes. bossku may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Payment Processors — To facilitate deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, and other approved Malaysian payment channels.
• KYC / Identity Verification Providers — Third-party providers who assist bossku in verifying player identity and age documents.
• Game Studios & Content Providers — Licensed international game studios whose content is hosted on the bossku Platform may receive anonymised session data for technical and support purposes.
• Regulatory & Law Enforcement Authorities — Where required by law, court order, or regulatory directive, bossku will disclose personal data to competent authorities.
• IT & Security Service Providers — Trusted vendors providing hosting, cybersecurity, and platform maintenance services under contractual confidentiality obligations.

All third parties with whom bossku shares personal data are bound by contractual data protection obligations consistent with the standards in this Policy.

6. Data Retention

bossku retains personal data for as long as necessary to fulfil the purposes described in this Policy, including the duration of your active bossku account and for a period following account closure as required by applicable law and regulatory obligations. In general:

• Account registration and identity verification data is retained for a minimum of five (5) years following account closure.
• Transaction and financial records are retained for a minimum of seven (7) years for AML and tax compliance purposes.
• Gaming activity logs are retained for a minimum of three (3) years for dispute resolution and responsible gaming audit purposes.
• Marketing consent records are retained for the duration of the consent plus a reasonable period thereafter to evidence compliance.

Where personal data is no longer required for any legal or operational purpose, bossku will securely delete or anonymise it.

7. Security Measures

bossku implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit TLS/SSL encryption on all data transmissions between your device and the bossku Platform — the same standard used by Malaysian banking portals such as Maybank2u and CIMB Clicks.
• Encryption of sensitive data at rest in bossku's data storage systems.
• Role-based access controls limiting personnel access to personal data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments by independent security specialists.
• Multi-factor authentication for all internal staff accounts with access to player data.
• Comprehensive audit logs of all access to and modifications of personal data records.

Despite these measures, no internet transmission or data storage system is entirely immune to interception or breach. bossku will notify affected players and relevant authorities of any data breach in accordance with applicable legal requirements.

8. Cookies & Tracking Technologies

8.1 What Are Cookies

Cookies are small text files placed on your device by the bossku Platform to enable functionality, improve performance, and gather analytical data. bossku uses both first-party cookies (set by bossku directly) and third-party cookies (set by service providers such as analytics platforms).

8.2 Types of Cookies Used

• Essential Cookies — Required for the bossku Platform to function. These include session authentication cookies that maintain your logged-in state. These cannot be disabled.
• Functional Cookies — Remember your preferences such as language settings and game lobby filters to provide a personalised bossku experience.
• Analytical Cookies — Used to understand how players navigate the bossku Platform, which pages are visited most, and where technical issues occur. Data collected is aggregated and anonymised.

8.3 Managing Cookies

You can manage or delete non-essential cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the bossku Platform, including the ability to maintain a login session.

9. Your Data Rights

Subject to applicable law and regulatory limitations, you have the following rights with respect to your personal data held by bossku:

• Right of Access — Request a copy of the personal data bossku holds about you.
• Right to Rectification — Request correction of inaccurate or incomplete personal data.
• Right to Erasure — Request deletion of your personal data where bossku no longer has a legal or regulatory obligation to retain it.
• Right to Restrict Processing — Request that bossku limit processing of your personal data in certain circumstances.
• Right to Data Portability — Request a machine-readable copy of personal data you have provided to bossku.
• Right to Withdraw Consent — Withdraw consent for marketing communications or non-essential cookies at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact the bossku support team via live chat or at [email protected]. bossku will respond within 30 days of receiving a verifiable request.

10. Children's Privacy

The bossku Platform is strictly for adults aged 21 and above. bossku does not knowingly collect personal data from individuals under the age of 21. If bossku becomes aware that personal data has been collected from a minor, the associated account will be immediately suspended, all data will be securely deleted, and any associated balances will be voided. If you believe a minor has registered on the bossku Platform, contact support immediately.

11. Third-Party Services & Links

The bossku Platform may reference or link to third-party services (such as payment gateways). These third parties operate under their own privacy policies. bossku is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you use in connection with your bossku account, particularly your chosen Malaysian payment provider.

12. Changes to This Privacy Policy

bossku reserves the right to update this Privacy Policy at any time. Material changes will be communicated to registered players via the email address associated with their bossku account and/or via a prominent notice on the Platform. The "Last updated" date at the top of this Policy reflects the most recent revision. Continued use of the bossku Platform following notification of a material change constitutes acceptance of the revised Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or bossku's data handling practices, please contact the bossku Data Support team. We are committed to resolving privacy concerns promptly and transparently.