bos99 Privacy Policy

Introduction

bos99 ("we", "us", "our", or "the Company") operates an online betting and casino platform accessible at bos99.ws, offering sportsbook wagering, live casino, slot games, togel (Indonesia's traditional numbers lottery), Sic Bo, Bandar Q, and a range of other gaming products. We are committed to handling your personal information with the utmost care, transparency, and responsibility.

This Privacy Policy describes the personal data bos99 collects from Members and visitors, the purposes for which that data is processed, the circumstances under which it may be shared with third parties, and the rights you hold with respect to your own information. It applies to all interactions with the bos99 platform — including account registration, deposits and withdrawals, gameplay, customer support, and any marketing communications you have opted into.

bos99 primarily serves players located in Indonesia. Where this Policy references local legal or regulatory frameworks, it does so in the context of internationally recognised data protection standards applied to the Indonesian market. Indonesian players access the bos99 platform at their own initiative; players are solely responsible for determining whether accessing our services is lawful in their jurisdiction.

Definitions

The following terms are used throughout this Privacy Policy and have the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, whether directly (e.g., full name, national identity number) or indirectly (e.g., IP address, device identifier).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, and any combination thereof.
• "Controller" means bos99, the entity that determines the purposes and means of processing your Personal Data.
• "Processor" means a third-party service provider that processes Personal Data on bos99's behalf and under bos99's documented instructions.
• "Member" or "User" means any individual who has registered an Account on the bos99 platform.
• "KYC Data" means identity and document verification materials submitted by a Member to satisfy Know Your Customer requirements, including government-issued ID, proof of address, and payment method confirmation.
• "Cookies" means small text files stored on your device by the bos99 platform or its authorised technology partners to facilitate session management, analytics, and personalisation.
• "Consent" means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose.

Personal Data We Collect

bos99 collects only the categories of Personal Data that are necessary to deliver our services, meet our legal obligations, and protect the security and integrity of the platform. The table below summarises the main data categories we process:

How We Collect Personal Data

bos99 collects Personal Data through the following channels:

4.1 Directly from You

The majority of your Personal Data is provided directly by you during account registration, KYC submission, payment transactions, support communications, and when you update your Account profile or preferences. This data is submitted voluntarily; however, certain data fields (such as full name, date of birth, and payment method details) are mandatory — without them, we cannot open your Account or process withdrawals.

4.2 Automatically Through Your Device

When you visit or use the bos99 platform, our servers and analytics systems automatically collect Technical Data including your IP address, browser user-agent string, referring URL, device operating system, screen resolution, and session timestamps. This data is collected whether or not you are logged in and is used primarily for platform security, fraud detection, and service optimisation.

4.3 From Third-Party Service Providers

In certain circumstances, bos99 may receive Personal Data about you from trusted third-party service providers, including:

• Payment processors and Indonesian banking partners (transaction confirmation data, payment method ownership verification)
• Identity verification service providers used during KYC processing
• Fraud prevention and anti-money laundering screening services
• Analytics and platform performance monitoring providers

All third-party providers supplying data to bos99 are required to have a lawful basis for sharing that data with us and are bound by data processing agreements that meet internationally recognised security standards.

Purpose of Processing

bos99 processes your Personal Data only for legitimate, specified purposes. We will never use your data for purposes that are incompatible with those stated here without first obtaining your explicit consent or being compelled to do so by applicable law. Our processing purposes are as follows:

• Account Management: To create, maintain, and administer your bos99 Member Account, including processing login credentials, account preferences, and membership tier status.
• Identity Verification (KYC): To verify your identity, confirm your age (21+ requirement), and ensure that your payment methods are registered in your legal name, in accordance with our Anti-Money Laundering obligations.
• Payment Processing: To process deposits and withdrawals in Indonesian Rupiah (IDR) via your nominated Indonesian bank account or e-wallet, and to maintain accurate financial transaction records.
• Service Delivery: To provide access to bos99's full range of games and betting markets, personalise your in-platform experience, and deliver relevant promotions to which you have opted in.
• Customer Support: To respond to your inquiries, resolve disputes, address complaints, and maintain records of support interactions for quality assurance purposes.
• Security & Fraud Prevention: To detect, investigate, and prevent fraud, money laundering, collusion, use of automated betting tools, duplicate accounts, and other prohibited conduct.
• Legal & Regulatory Compliance: To comply with applicable anti-money laundering laws, data retention obligations, and lawful requests from competent authorities.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling, enforce deposit limits and self-exclusion requests, and fulfil our duty-of-care obligations to Members.
• Platform Improvement: To analyse usage patterns, test new features, fix technical issues, and improve the overall performance and user experience of the bos99 platform.
• Marketing Communications: To send you promotions, bonus offers, and news about new bos99 products or games — but only where you have explicitly opted in and subject to your right to opt out at any time.

Legal Basis for Processing

bos99 processes your Personal Data on the following legal grounds, consistent with internationally recognised data protection principles:

• Contractual Necessity: Processing that is necessary to perform the Member Agreement between you and bos99 — including account creation, payment processing, gameplay access, and customer support.
• Legal Obligation: Processing required to comply with applicable legal duties, including KYC/AML obligations, financial record-keeping requirements, and responses to lawful authority requests.
• Legitimate Interests: Processing carried out in bos99's legitimate business interests where those interests are not overridden by your rights — including fraud prevention, platform security, internal analytics, and responsible gaming monitoring. We conduct a balancing assessment before relying on this basis.
• Consent: Processing based on your freely given, informed, and specific consent — primarily for direct marketing communications. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

Sharing Your Personal Data

bos99 does not sell, rent, or trade your Personal Data to any third party for their own marketing purposes. We may share your data with the categories of recipients described below, solely to the extent necessary and under appropriate contractual protections:

7.1 Service Providers (Processors)

bos99 engages trusted third-party service providers who process Personal Data on our behalf under documented data processing agreements. Categories include payment infrastructure providers, cloud hosting and data centre operators, KYC and identity verification platforms, fraud detection and AML screening services, customer support software providers, and platform analytics vendors. All Processors are prohibited from using your data for any purpose other than providing the contracted service to bos99.

7.2 Game Content Providers

Certain game studios — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft — may receive limited Technical Data (such as session tokens and device type) to render their games correctly within the bos99 platform environment. These providers are contractually prohibited from retaining or independently processing your Personal Data.

7.3 Legal and Regulatory Authorities

bos99 may disclose Personal Data to law enforcement agencies, financial intelligence units, or other competent public authorities where we are legally required or compelled to do so. In such cases, bos99 will disclose only the minimum data necessary and, where permitted by law, will notify the affected Member.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or a substantial part of bos99's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and of any material change to the terms of this Privacy Policy that results from it.

Cookies & Tracking Technologies

bos99 uses cookies and similar tracking technologies to operate the platform, maintain your login session, remember your preferences, and gather analytics data that helps us improve the service. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential to the operation of the bos99 platform. These cookies maintain your authenticated session, enable secure login, and prevent cross-site request forgery. They cannot be disabled without significantly impairing platform functionality.
• Functional Cookies: Used to remember your language preferences, display settings, preferred game lobby view, and last-used payment method. Disabling these cookies will not prevent access to bos99 but may result in a less personalised experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how Members navigate the platform — pages visited, time on site, feature interactions, and error events. This data is used exclusively to improve platform performance and user experience. bos99 uses privacy-respecting analytics tools that do not share data with advertising networks.
• Security Cookies: Used to detect and prevent fraudulent sessions, credential stuffing attacks, and suspicious login patterns. These cookies store a pseudonymous device fingerprint and are not linked to your personal identity without additional data.

bos99 does not use advertising or behavioural tracking cookies that profile you across third-party websites. You may manage cookie settings through your browser's built-in privacy controls. Note that deleting strictly necessary cookies will log you out of your bos99 Account.

Data Retention

bos99 retains Personal Data only for as long as is necessary for the purposes for which it was collected, subject to any applicable legal retention obligations. The following retention periods apply as a general guide:

• Active Account Data: Retained for the full duration of your membership and for five (5) years following Account closure, to satisfy financial record-keeping and AML compliance obligations.
• KYC Documents: Retained for a minimum of five (5) years following Account closure or the completion of the last transaction, in accordance with internationally recognised AML data retention standards.
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction. All amounts are denominated in IDR.
• Support Communications: Live chat transcripts and email correspondence are retained for two (2) years from the date of the interaction, unless the communication is relevant to an ongoing dispute, in which case it is retained until the dispute is fully resolved.
• Marketing Preference Data: Retained until you withdraw your consent or request deletion. Opt-out records are retained indefinitely to ensure we do not inadvertently re-contact you.
• Technical / Log Data: Server logs and session data are retained for up to twelve (12) months for security monitoring purposes, after which they are automatically deleted or anonymised.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised using methods that prevent re-identification. Where deletion is not immediately possible due to backup schedules or technical constraints, the data is isolated and protected until deletion can be completed.

Data Security

bos99 applies a comprehensive set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, disclosure, or alteration. Our core security controls include:

• Transport Encryption: All data transmitted between your device and bos99 servers is encrypted using TLS 1.2 or higher (256-bit SSL). The bos99.ws domain enforces HTTPS at all times; unencrypted HTTP connections are automatically redirected.
• Password Security: Member passwords are hashed using bcrypt with a high cost factor before storage. bos99 never stores passwords in plaintext and never transmits them over any unencrypted channel. Our support staff will never ask you for your password.
• Two-Factor Authentication: Members are strongly encouraged to enable two-factor authentication (2FA) via a time-based one-time password (TOTP) authenticator app. 2FA is required for all withdrawal requests above a defined threshold.
• Access Controls: Access to Member Personal Data within bos99's internal systems is restricted on a strict need-to-know basis. All internal access is logged, and privileged access is subject to multi-factor authentication and regular review.
• Infrastructure Security: bos99 servers are hosted in enterprise-grade, ISO 27001-aligned data centres with physical access controls, redundant power supply, and 24/7 security monitoring.
• Penetration Testing: The bos99 platform undergoes regular third-party security assessments and penetration tests. Critical vulnerabilities identified are remediated within defined SLA timeframes.
• Incident Response: bos99 maintains a documented data breach response procedure. In the event of a breach affecting your Personal Data, we will notify affected Members and relevant authorities within the timeframes required by applicable law.

Your Privacy Rights

As a bos99 Member, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team via live chat or email at [email protected]. We will respond to all verified requests within thirty (30) days.

• Right of Access: You have the right to request a copy of the Personal Data bos99 holds about you, along with information about how it is being used. We will provide this in a structured, commonly used format.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request correction. Certain data fields (such as your registered name) may require supporting documentation to update.
• Right to Erasure ("Right to Be Forgotten"): You may request that bos99 delete your Personal Data where it is no longer necessary for the original purpose, where you have withdrawn consent, or where processing was unlawful. This right is subject to our legal retention obligations — we cannot delete data we are legally required to retain.
• Right to Restrict Processing: You may ask bos99 to temporarily restrict the processing of your Personal Data while a rectification request is pending, or where you contest the lawfulness of our processing.
• Right to Data Portability: Where processing is based on your consent or on contractual necessity, you have the right to receive your Personal Data in a machine-readable format and to request its transfer to another data controller where technically feasible.
• Right to Object: You have the right to object to processing based on legitimate interests, including profiling. You also have an unconditional right to object to direct marketing at any time, which bos99 will action immediately upon receipt.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Minors

The bos99 platform is strictly intended for adults aged 21 years and older. bos99 does not knowingly collect, retain, or process Personal Data belonging to any individual under the age of 21. Age verification is a mandatory component of the registration process, and all Members are required to confirm their date of birth and, upon KYC request, submit a government-issued identity document confirming their age.

If bos99 discovers or is notified that a Member Account belongs to an individual under the age of 21, the Account will be immediately suspended and permanently closed, all funds will be forfeited, and all Personal Data associated with the underage Account will be deleted as promptly as legally permissible. The matter may be reported to the relevant authorities where required by applicable law.

If you are a parent or guardian and believe that your child has registered an Account on bos99, please contact our support team immediately at [email protected]. We will investigate and take immediate action.

Third-Party Links & Integrations

The bos99 platform may contain references to, or integrations with, third-party game providers, payment technology platforms, and ancillary service tools. This Privacy Policy applies solely to Personal Data collected and processed by bos99 in connection with the bos99 platform. It does not extend to any third-party websites, applications, or services that you may access via links or integrations.

bos99 has no control over, and accepts no responsibility for, the privacy practices or data handling of third-party platforms. We encourage you to review the privacy policy of any third party before providing them with your personal information. The fact that a third party is integrated with the bos99 platform does not constitute an endorsement of their privacy practices by bos99.

Policy Updates

bos99 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the services we offer. When a material change is made to this Policy, we will notify you via one or more of the following methods: a prominent notice on the bos99 platform homepage, an in-Account notification banner, or an email to your registered address.

All updates take effect fourteen (14) days after the notice date, unless the change is required immediately by applicable law or to address an urgent security concern. The "Effective Date" displayed at the top of this Policy will be updated to reflect the date of the most recent revision. Your continued use of the bos99 platform following the effective date of any update constitutes your acceptance of the revised Privacy Policy.

We encourage you to review this page periodically. If you do not accept a material revision, you must cease using the platform and request Account closure by contacting our support team.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your Personal Data by bos99, please reach out to our dedicated privacy support team using the contact details below. We are committed to responding to all privacy-related inquiries promptly and transparently.

• Email: [email protected] — please include "Privacy Request" in your subject line for faster routing.
• Live Chat: Available 24/7 within your logged-in bos99 Account dashboard. Indonesian-speaking agents are on hand at all times.
• Response Time: Privacy-related requests are prioritised and are typically acknowledged within 4 hours during 09:00–21:00 WIB and within 12 hours at all other times. Full responses to data subject access requests are delivered within 30 days.

For responsible gaming concerns, self-exclusion requests, or issues with deposit or loss limits, please visit the Responsible Gaming page or state your request explicitly when contacting live chat. These requests are treated as urgent and actioned within one (1) hour of receipt.