Boss96 Privacy Policy —
How We Handle
Your Personal Data

This Privacy Policy ("Policy") issued by boss96, the operator of the online casino and sports betting platform accessible athttps://boss96.cam ("Platform"). References to "boss96", "we", "us", and "our" throughout this Policy refer to the Platform operator. References to "you", "your", and "User" refer to any individual who accesses, browses, registers an account on, or otherwise uses the Platform.

Boss96 is committed to protecting the privacy and security of the personal data of all users, including players from across Malaysia — whether you are based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or any other part of the country. We process personal data in accordance with internationally recognised data protection principles and the requirements of applicable law.

This Policy explains in clear, accessible language: what personal data we collect, the purposes for which we use it, the legal basis on which processing is conducted, how long we retain data, with whom it may be shared, and what rights you hold in relation to your personal data.

The following terms are used throughout this Policy with the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, account number, email address, or device identifier.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, and destruction.
• "Data Controller" means boss96, which determines the purposes and means of processing your Personal Data.
• "Data Processor" means a third-party entity that processes Personal Data on behalf of boss96, pursuant to documented instructions.
• "KYC Data" means identity and age verification documents collected as part of the Know Your Customer process, including copies of government-issued identification.
• "Cookies" means small text files placed on your device by the Platform for the purposes of session management, analytics, and functionality.
• "Sensitive Data" means a subset of Personal Data that warants enhanced protection, including government-issued identification numbers and financial account details.

Boss96 collects the following categories of personal data in connection with the operation of the Platform and provision of its Services to Malaysian players:

3.1 Registration Data

When you create an account, we collect:

• Full legal name
• Date of birth (for age verification — you must be 21 or older)
• Email address
• Mobile phone number
• Preferred username and password (password stored in hashed, non-reversible format)
• Country and city of residence (e.g., Kuala Lumpur, Penang, Johor Bahru)

3.2 KYC Verification Data

To comply with age verification and anti-money-laundering obligations, we collect:

• Copies of government-issued identity documents (Malaysian MyKad front and back, or valid international passport)
• Proof of payment method (e.g., screenshot of registered e-wallet account such as Touch'n Go eWallet or Boost)
• Selfie or liveness verification image where required for enhanced KYC

3.3 Financial Transaction Data

In connection with deposits and withdrawals, we record:

• Payment method type (e.g., DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, Public Bank, BTC/USDT)
• Transaction amounts in MYR (or cryptocurrency equivalent)
• Transaction timestamps and reference numbers
• Partial payment identifiers (we do not store full bank account numbers in plain text)

3.4 Gaming Activity Data

• Game history (games played, bets placed, outcomes)
• Sports betting selections (e.g., EPL fixtures, Liga Super Malaysia matches, UFC events)
• Bonus usage and wagering progress
• Session duration and frequency data

3.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser type
• Platform access logs and timestamps
• Cookie identifiers and session tokens

3.6 Communications Data

• Content of messages submitted via live chat or email support
• Marketing preference choices (opt-in or opt-out status)

Personal data is collected through the following mechanisms:

• Directly from you: When you complete registration, submit KYC documents, make deposits or withdrawals, contact support, or interact with promotions.
• Automatically: Through cookies, tracking pixels, server logs, and session analytics tools that record your interactions with the Platform.
• From third-party payment processors: When you initiate a deposit or withdrawal, our payment processing partners (e.g., DuitNow, FPX gateway providers, e-wallet operators) transmit transaction confirmation data to us.
• From identity verification providers: Third-party KYC service providers may share verification results and document authenticity assessments with us as part of the onboarding process.

Boss96 processes your personal data for the following specific purposes:

Boss96 processes personal data one or more of the following legal bases, depending on the specific processing activity:

• Performance of a contract: Processing is necessary to operate your account, facilitate transactions, and deliver the gaming and betting services you have contracted for.
• Legal obligation: Processing is required to comply with applicable anti-money-laundering obligations, age verification requirements, and international licensing conditions — including KYC verification before any withdrawal is processed.
• Legitimate interests: We process certain data to detect fraud, prevent prohibited activities, monitor for responsible gambling concerns, and improve the Platform — where these interests are not overridden by your rights and freedoms.
• Consent: Where processing is based on consent (such as receipt of promotional email communications), you may withdraw your consent at any time by updating your account preferences or contacting support. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Boss96 does not sell, rent, or otherwise commercially disclose your personal data to third parties. We share personal data only in the following limited and documented circumstances:

7.1 Payment Processors

To process deposits and withdrawals, we share necessary transaction data with licensed payment processing providers operating in the Malaysian market, including gateway operators for Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and cryptocurrency networks. These processors act as our Data Processors and are contractually prohibited from using your data for any purpose other than the transaction being processed.

7.2 Identity Verification Providers

We engage accredited third-party KYC verification providers to authenticate identity documents and conduct age verification checks. These providers receive only the specific data required for verification and are bound by strict confidentiality obligations.

7.3 IT and Infrastructure Partners

Our platform infrastructure, including hosting, server, and database services, is provided by third-party technology vendors. These vendors process personal data only in accordance with our documented instructions and applicable data protection agreements.

7.4 Legal and Regulatory Disclosure

We may be required to disclose personal data to regulatory authorities, law enforcement agencies, or licensing bodies in response to a lawful request, court order, or to meet our anti-money-laundering reporting obligations. We will notify you of such disclosures where legally permitted to do so.

7.5 Business Succession

In the event of a merger, acquisition, or sale of all or substantially all of the assets of boss96, personal data held by us may be transferred to the acquiring entity as part of that transaction. We will provide notice of any such transfer and ensure that the receiving entity is bound by equivalent data protection obligations.

Boss96 uses cookies and similar tracking technologies to operate the Platform, maintain your login session, and understand how users interact with our services. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. They maintain your login session, remember your language and currency preferences, and ensure the security of your account. These cannot be disabled.
• Analytics cookies: Used to collect anonymised or aggregated data about how users navigate the Platform. This helps us identify popular features, optimise performance, and improve the user experience. These do not identify you personally.
• Functional cookies: Remember your preferences (such as preferred deposit method or game categories) to personalise your experience on return visits.
• Marketing cookies: Where you have consented, these are used to present relevant promotional content. You may withdraw consent for marketing cookies at any time via your account settings.

You may configure your browser to reject or delete cookies. Please note that disabling strictly necessary cookies may impair the functionality of the Platform, including your ability to remain logged in.

Boss96 implements a comprehensive range of technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include but are not limited to:

• Transport encryption: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher (256-bit SSL).
• Encryption at rest: Sensitive data including KYC documents and financial records are encrypted when stored on our servers.
• Access controls: Personal data is accessible only to authorised personnel who require it to perform their role. Access is governed by role-based permissions and logged.
• Password security: Passwords are stored using industry-standard one-way hashing algorithms. We never store or transmit passwords in plain text.
• Regular security audits: Our infrastructure and application code undergoes regular penetration testing and vulnerability assessments.
• Incident response: We maintain a documented data breach response procedure. In the event of a material breach affecting your personal data, we will notify you within the timeframe required by applicable law.

While we take all reasonable precautions, no digital transmission or storage system is entirely immune to risk. You are responsible for maintaining the security of your account credentials and should not share your password with any third party.

Boss96 retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The following indicative retention periods apply:

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in manner that prevents re-identification.

Subject to applicable law, you hold the following rights in relation to your personal data held by boss96. To exercise any of these rights, please contact us via live chat or by emailing [email protected] with the subject line "Data Rights Request".

• Right of Access: You may request a copy of all personal data we hold about you. We will provide this in a structured, commonly-used format within 30 days of receiving a verified request.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request that it be corrected.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for its original purpose, subject to overiding legal retention obligations (e.g., AML records).
• Right to Restrict Processing: In certain circumstances you may request that we restrict the use of your data — for example, while disputing its accuracy.
• Right to Data Portability: You may request your personal data in machine-readable format (e.g., JSON or CSV) for transfer to another service.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing at any time.
• Rights Related to Automated Decision-Making: Where we make automated decisions that significantly affect you, you have the right to request human review.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

We will respond to all verified data rights requests within 30 calendar days. In complex cases, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it. There is no charge for exercising data rights in the majority of circumstances.

The boss96 Platform is strictly intended for users aged 21 years and above. We do not knowingly collect, process, or retain personal data of individuals under the age of 21. If we discover or are notified that personal data of a minor has been submitted to the Platform, we will immediately:

• Suspend the relevant account pending investigation;
• Permanently delete all personal data associated with that account; and
• Refund any real money deposits to the source payment method after verifying the identity of the depositor.

If you believe that a minor has registered an account on boss96, please contact our support team immediately via live chat or email so that we can take prompt action.

Boss96 operates on a global infrastructure and may, as part of its operations, transfer personal data to servers or service providers located outside of Malaysia. Where such transfers occur, we ensure that appropriate safeguards are in place to protect the personal data consistent with the standards described in this Policy.

Safeguards for international transfers include contractual data protection clauses with receiving entities and, where applicable, reliance on recognised transfer mechanisms. By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Malaysia.

Boss96 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — such as new categories of data being collected, new purposes for processing, or changes to how we share data with third parties — we will provide reasonable prior notice to registered users via the Platform interface or by email to your registered address.

The "Last Updated" date at the top of this page reflects when the Policy was most recently revised. We encourage you to review this Policy periodically to stay informed of how we handle your personal data. Your continued use of the Platform following any update constitutes your acknowledgement of the revised Policy.

For all privacy-related enquiries, including data rights requests, questions about this Policy, or to report a potential data protection concern, please contact us through the following channels:

• Email (Privacy Requests) [email protected] — please use subject line "Privacy Policy Enquiry" or "Data Rights Request". Responses within 5 business days for general enquiries, and 30 days for formal data rights requests.
• Live Chat — 24/7 Available on the Platform. For general privacy questions, our support team can provide guidance and escalate formal requests to our data protection team.
• Malaysian Players Boss96 serves players across all states and territories in Malaysia, including Kuala Lumpur, Selangor (Petaling Jaya, Shah Alam), Penang, Johor (Johor Bahru), and beyond. All data rights enquiries from Malaysian users are handled with the same priority regardless of location.