bosku8 Privacy Policy

bosku8 collects personal data from several sources and in several categories, as outlined below:

2.1 Registration and Account Data. When you register a bosku8 Account, we collect: full legal name, date of birth, email address, mobile phone number, residential address, and a username of your choosing. This information is required to create and administer your Account and to verify your identity in compliance with our gaming authority licence.

2.2 Identity Verification (KYC) Data. As part of our Know Your Customer obligations, we may collect copies of government-issued identification documents (such as the Malaysian MyKad or passport), proof of address documents, and proof of payment method. These documents are processed solely for identity verification and anti-money laundering compliance purposes.

2.3 Financial Data. bosku8 collects payment information necessary to process deposits and withdrawals, including the name and details of your payment account (e.g., Touch n Go eWallet, DuitNow, FPX, bank account details). bosku8 does not store full card numbers. Payment data is processed via PCI DSS-compliant payment processors.

2.4 Gaming and Transaction Data. We record all gaming activity on the bosku8 Platform, including game sessions, bets placed, outcomes, bonus usage, and account transaction history. This data is retained as required by our gaming authority licence and for dispute resolution purposes.

2.5 Technical and Usage Data. When you access the bosku8 Platform, we automatically collect technical data including: IP address, device type and operating system, browser type and version, session duration, pages visited, and referring URLs. This data is used for platform security, fraud detection, and platform performance improvement.

2.6 Communications Data. When you contact bosku8 customer support via live chat or email, we retain records of those communications including the content and metadata of your enquiry and our response.

2.7 Marketing Preferences. Where you consent to receive promotional communications from bosku8, we record your marketing preferences and track engagement with marketing emails (e.g., open rates, click-through rates) for campaign optimisation purposes.

bosku8 processes your personal data on the following legal grounds:

• Contractual Necessity: Processing is required to perform our obligations under the bosku8 Terms & Conditions, including account management, payment processing, and provision of gaming services.
• Legal Obligation: Processing is required for compliance with our gaming authority licence conditions, anti-money laundering regulations, and other applicable legal requirements, including Know Your Customer obligations.
• Legitimate Interests: Processing is carried out on the basis of bosku8's legitimate interests in operating a secure, fraud-free, and compliant gaming platform — including fraud detection, platform security, and responsible gaming monitoring — where those interests are not overridden by your fundamental rights.
• Consent: Where we rely on consent as a legal basis (principally for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

bosku8 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share personal data with third parties in the following limited circumstances:

• Service Providers: bosku8 engages third-party service providers to support Platform operations, including payment processors (e.g., FPX gateways, e-wallet operators), identity verification providers, IT hosting and infrastructure providers, and customer support platforms. These providers are permitted to use your data only for the specific services they provide to bosku8 and are contractually bound to maintain appropriate data security standards.
• Gaming Authority and Regulators: bosku8 may be required to disclose member data to our licensing gaming authority or other regulatory bodies as a condition of our licence or in response to a lawful regulatory request.
• Law Enforcement: bosku8 will disclose personal data to law enforcement authorities where required by a valid court order, legal process, or applicable law. Where legally permitted, we will endeavour to notify affected members of such disclosures.
• Anti-Money Laundering (AML) Reporting: Where required by applicable AML regulations, bosku8 may be obligated to file reports with relevant financial intelligence authorities. Such disclosures are subject to statutory confidentiality obligations and may be made without notice to the member.
• Business Transfers: In the event of a merger, acquisition, or sale of assets involving the bosku8 business, member data may be transferred as part of that transaction. Affected members will be notified in advance where reasonably practicable, and the successor entity will be required to honour the terms of this Privacy Policy.

bosku8 retains personal data only for as long as is necessary for the purposes for which it was collected, subject to the following retention principles:

• Active Account Data: Personal data associated with an active bosku8 Account is retained for the duration of the Account's activity.
• Closed Account Data: Following Account closure, bosku8 retains member identification, KYC, and transaction records for a minimum of 5 years from the date of closure, in compliance with gaming authority licence conditions and anti-money laundering regulations.
• Gaming and Transaction Records: Detailed gaming and transaction records are retained for a minimum period as required by our licensing obligations, and thereafter deleted or anonymised.
• Marketing Data: Where you have consented to marketing communications, your marketing preferences are retained until you withdraw consent. Upon withdrawal, your data is removed from active marketing lists within a reasonable processing period.
• Support Communications: Records of customer support interactions are retained for up to 3 years following the resolution of the relevant enquiry.

Following the expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised such that it can no longer be attributed to an identifiable individual.

bosku8 implements a range of technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL encryption for all data transmitted between member devices and bosku8 servers;
• Encryption of sensitive personal data at rest using industry-standard encryption protocols;
• Access controls that restrict access to member personal data to authorised personnel on a need-to-know basis;
• Two-factor authentication available to all bosku8 Account holders to protect against unauthorised account access;
• Login anomaly detection systems that flag unusual access patterns for investigation;
• Regular security assessments and penetration testing of the bosku8 Platform infrastructure;
• Contractual data security obligations imposed on all third-party service providers who process member data on behalf of bosku8.

Notwithstanding the above, no data transmission over the internet or data storage system can be guaranteed as 100% secure. In the event of a data breach that is likely to result in a risk to your rights, bosku8 will notify affected members and relevant authorities in accordance with applicable legal requirements.

bosku8 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or gaming authority requirements. Material changes will be communicated to registered members via the email address associated with their bosku8 Account and/or by a prominent notice on the Platform.

The date of the most recent revision is displayed at the top of this page. We encourage you to review this Privacy Policy periodically. Continued use of the bosku8 Platform following notification of material changes constitutes acceptance of the revised Privacy Policy.