BOZ388 Privacy Policy

This Privacy Policy ("Policy") is issued by BOZ388 ("we", "us", "our") and applies to all personal data collected from individuals ("you", "User", "data subject") who access or use the BOZ388 platform at https://boz388.asia, including all associated services, account features, and communications channels.

BOZ388 is an online casino and sports betting platform serving users across Malaysia, including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam, as well as other eligible jurisdictions. In the course of operating this platform — processing deposits in MYR, verifying identities for KYC compliance, managing promotional communications, and delivering gaming services — we necessarily collect and process personal data relating to our users.

This Policy is designed to be transparent about those data practices. We are committed to handling your personal data in a manner that is lawful, fair, and proportionate to the services we provide. This Policy should be read alongside our Terms and Conditions, which govern your use of the platform more broadly.

For the purposes of this Privacy Policy, the following terms carry the meanings defined below:

• Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to name, email address, identification number, financial account details, IP address, and device identifiers.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, alteration, or deletion.
• Data Controller: BOZ388, which determines the purposes and means by which personal data is processed.
• Data Processor: A third party that processes personal data on behalf of BOZ388 under a written data processing agreement.
• Data Subject: The individual whose personal data is being processed — in this context, the registered BOZ388 user.
• Cookies: Small text files stored on your device by the BOZ388 platform, used to maintain session state and collect analytical data.
• KYC: Know Your Customer — the identity verification process required for account holders prior to processing withdrawal requests.

BOZ388 collects personal data through multiple channels in the ordinary course of platform operation. The categories of data we collect, and the contexts in which they are collected, are set out below:

BOZ388 processes personal data only for the purposes for which it was collected or for compatible purposes as permitted under applicable law. The primary purposes for which we use your personal data are:

We use your identity and contact data to create and maintain your BOZ388 account, authenticate your login sessions, and communicate account-related notifications including deposit confirmations, withdrawal processing updates, and security alerts.

Financial data is processed to facilitate deposits and withdrawals in MYR through our integrated Malaysian payment channels, including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, and direct banking connections to Maybank, CIMB, Public Bank, and Hong Leong. We also use this data for fraud detection and the prevention of money laundering.

Verification data is processed to confirm the identity and age (minimum 21 years) of account holders, as required by our operating obligations. KYC records are retained for the period stipulated under applicable financial crime prevention regulations.

Technical and usage data is processed in aggregated and anonymised form to analyse platform performance, identify areas for improvement, and ensure stable delivery of our casino games, live dealer tables, and sports betting markets.

Where you have activated self-exclusion or deposit limit tools, we process the relevant data to enforce those controls and to flag patterns of play that may indicate problem gambling behaviour. This processing is carried out in your interests and cannot be opted out of while your account remains active.

With your consent, we may use your contact data to send promotional communications about BOZ388 offers, new games, and seasonal events. You may withdraw marketing consent at any time as described in Section 10.

BOZ388 processes personal data on the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing required to fulfil our obligations under the account agreement with you — including account operation, payment processing, and KYC verification.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering regulations, responsible gambling obligations, and data retention requirements imposed by financial regulators.
• Legitimate interests: Processing carried out for the legitimate interests of BOZ388, including fraud prevention, platform security, and service improvement — where those interests are not overridden by your fundamental privacy rights.
• Consent: Processing carried out on the basis of your freely given, specific, and informed consent — including marketing communications and the use of non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of processing that took place prior to withdrawal.

BOZ388 does not sell, rent, or otherwise trade personal data to third parties for their own commercial purposes. We share personal data with third parties only in the following circumstances:

• Payment service providers: Financial data is shared with payment processors and Malaysian banking institutions (including Maybank, CIMB, Public Bank, and Hong Leong) as necessary to process deposits and withdrawals.
• Identity verification services: Identity and verification data may be shared with regulated KYC service providers for the purpose of document verification and age confirmation.
• Gaming and technology partners: Technical usage data may be shared with platform infrastructure and analytics providers who process data on our behalf under written data processing agreements.
• Legal and regulatory authorities: Where required by applicable law, court order, or regulatory demand, BOZ388 will disclose personal data to relevant government authorities, law enforcement agencies, or financial intelligence units.
• Fraud and AML prevention: Where BOZ388 reasonably suspects fraud, money laundering, or other criminal activity in connection with an account, relevant data may be shared with appropriate investigative bodies.

All third parties engaged as Data Processors are required to process personal data only in accordance with BOZ388's written instructions and in compliance with applicable data protection law.

BOZ388 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal and regulatory obligations. Specific retention periods applicable to key data categories are set out below:

• Account and identity data: Retained for the duration of your account registration and for a period of 5 years following account closure, in accordance with applicable anti-money laundering record-keeping obligations.
• Transaction data: Retained for a minimum of 5 years from the date of each transaction, as required by financial compliance regulations.
• KYC verification documents: Retained for 5 years from the date of verification completion or account closure, whichever is later.
• Support communications: Retained for 2 years from the date of each interaction.
• Marketing consent records: Retained for the duration of marketing activity plus 3 years, as evidence of consent.
• Technical and usage data: Retained in aggregated, anonymised form indefinitely for analytics purposes; individual session data is retained for 12 months.

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised in accordance with our internal data deletion procedures.

BOZ388 implements technical and organisational security measures appropriate to the risk associated with the personal data we process. Our security infrastructure includes:

• 256-bit SSL/TLS encryption for all data in transit between user devices and BOZ388 servers;
• Encryption of sensitive data at rest within our storage infrastructure;
• Role-based access controls limiting employee access to personal data to those with a legitimate operational need;
• Regular security assessments and penetration testing of platform infrastructure;
• Two-factor authentication capability for all user accounts;
• Continuous monitoring for anomalous access patterns and security incidents.

Notwithstanding the above, no internet transmission or data storage system can be guaranteed to be 100% secure. In the event of a personal data breach that poses a risk to the rights and freedoms of affected users, BOZ388 will notify affected individuals as required under applicable law.

BOZ388 uses cookies and similar tracking technologies on our platform. Cookies are small text files stored on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for the platform to function and cannot be disabled. They include session authentication tokens, load-balancing identifiers, and security tokens. No consent is required for these cookies.
• Functional cookies: These cookies remember your preferences such as language settings and game display options, improving your experience on return visits. They are activated on the basis of your consent.
• Analytics cookies: These cookies collect anonymised data about how users interact with the BOZ388 platform, helping us identify usability issues and improve service delivery. They are activated on the basis of your consent.

BOZ388 does not use advertising cookies or tracking pixels that monitor your activity across third-party websites for behavioural advertising purposes.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may prevent the platform from functioning correctly.

As a data subject, you hold a number of rights in relation to the personal data that BOZ388 processes about you. These rights are described below. To exercise any of these rights, please contact our support team as set out in Section 14.

All data subject requests will be acknowledged within 5 business days and fully responded to within 30 calendar days of receipt. In cases of complex requests, BOZ388 may extend this period by a further 30 days, in which case you will be notified of the extension and the reasons for it.

The BOZ388 platform is strictly intended for use by individuals who are 21 years of age or older. BOZ388 does not knowingly collect personal data from individuals under the age of 21.

Age verification is conducted as part of our KYC process, and any account found to be held by an individual under the age of 21 will be immediately suspended. Any personal data collected in connection with an underage account will be deleted without delay upon confirmation of the user's age, except where retention is required for regulatory compliance purposes relating to the suspected underage access incident.

In the course of operating the BOZ388 platform, personal data may be transferred to and processed in countries outside Malaysia. Where such transfers occur, BOZ388 ensures that appropriate safeguards are in place to protect the transferred data to a standard equivalent to that required under applicable Malaysian data protection law.

Safeguards used for international transfers include standard contractual clauses incorporated into data processing agreements with overseas service providers, as well as transfers to jurisdictions that have been recognised as providing an adequate level of data protection. BOZ388 does not transfer personal data to jurisdictions that lack adequate data protection frameworks without implementing appropriate contractual or technical safeguards.

BOZ388 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform services. When material changes are made to this Policy, we will notify registered users via email or a prominent in-platform notice at least 14 days before the changes take effect.

The "Last updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically to remain informed about how BOZ388 protects your data. Your continued use of the platform following the effective date of a revised Policy constitutes your acknowledgement of and agreement to the updated terms.

For any questions, concerns, or formal data subject requests relating to this Privacy Policy or BOZ388's data processing practices, please contact our Customer Support and Data team using the details below. All privacy-related enquiries are handled with priority and in strict confidence.

You may also visit our Terms & Conditions or FAQ page for further information about your account rights and platform policies.