Privacy Policy

BossKu8 ("the Company," "we," "us," or "our") operates the online casino and sports betting platform accessible at bossku8.cam. In the course of providing our services to members across Malaysia — including players in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and Bangsar — we process personal data belonging to registered members and visitors to our platform.

This Privacy Policy ("Policy") describes in full how BossKu8 collects, uses, stores, shares, and protects personal data. It also sets out the rights available to you as a data subject and explains how to exercise those rights.

This Policy applies to all personal data processed in connection with your use of the BossKu8 platform, including data collected at registration, during account operation, through payment processing, during KYC verification, and through your interactions with our customer support team.

The following terms carry the meanings assigned below throughout this Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person — including name, identification number, contact details, financial information, device identifiers, and behavioural data — that can be used directly or indirectly to identify that person.
• "Processing" means any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction — whether or not by automated means.
• "Data Controller" means BossKu8, the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" means any third party that processes personal data on behalf of BossKu8 under a contractual arrangement, such as payment gateway providers or KYC verification services.
• "Member" or "User" means any individual who has registered a BossKu8 account and whose personal data is processed under this Policy.
• "KYC" means Know Your Customer — the identity verification process conducted to confirm a member's identity and comply with anti-money laundering obligations.
• "Cookie" means a small text file stored on your device by a web browser, used to maintain session state, preferences, and anonymised analytics data.

BossKu8 collects personal data across several categories depending on your interaction with the platform. The table below summarises the categories of data we collect and their typical sources:

We collect personal data through the following channels and mechanisms:

• Direct submission: Data you provide when completing registration, updating your account profile, submitting KYC documents, contacting customer support, or responding to surveys and promotions.
• Automated collection: Technical and usage data gathered automatically when you access and interact with the BossKu8 platform, including via server logs, session tracking, and cookies placed on your device.
• Payment processors: Transaction confirmation data received from third-party payment service providers — including FPX, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, and cryptocurrency network confirmations for USDT TRC20 and BTC transactions — following deposit or withdrawal events.
• KYC verification partners: Identity and address confirmation data returned by accredited third-party identity verification services engaged to process KYC submissions on our behalf.
• Fraud and security systems: Device fingerprinting, IP geolocation, and pattern recognition data collected by our internal fraud prevention infrastructure to detect and prevent unauthorised account access and financial crime.

BossKu8 processes your personal data for the following specific and legitimate purposes:

1. Account creation and management: To register your account, verify your identity at onboarding, maintain your account profile, and manage your login credentials and security settings.
2. Transaction processing: To process deposits and withdrawals via your selected payment method, reconcile financial transactions, and maintain an accurate record of your account balance in MYR.
3. KYC compliance: To verify your identity and address in accordance with our anti-money laundering obligations and responsible gambling age verification requirements (minimum age 21).
4. Platform operation and improvement: To deliver games, live casino content, and sports betting markets; to diagnose technical issues; to improve platform performance and user experience based on aggregated usage analytics.
5. Customer support: To respond to your queries, complaints, and requests submitted via live chat or email to [email protected], and to maintain a record of support interactions for quality assurance.
6. Fraud prevention and security: To detect and investigate suspected fraud, money laundering, account compromise, bonus abuse, and other prohibited conduct; to protect the integrity of the platform and the safety of all members.
7. Responsible gambling: To monitor account activity for indicators of problem gambling; to apply deposit limits, cooling-off periods, or self-exclusion restrictions at your request or in accordance with our responsible gambling policy.
8. Legal and regulatory compliance: To comply with applicable laws, respond to lawful requests from regulatory or law enforcement authorities, and maintain records required under financial crime prevention legislation.
9. Marketing communications (where consented): To send you promotional offers, bonus notifications, and platform updates — only where you have not opted out, and only via BossKu8 itself. We do not pass your contact details to third-party marketers.

Each processing activity carried out by BossKu8 is grounded in one or more of the following lawful bases:

• Contractual necessity: Processing required to perform the contract between you and BossKu8 — including account setup, transaction processing, KYC verification, and service delivery — is necessary to fulfil our obligations to you as a member.
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering regulations, financial crime reporting obligations, and data retention requirements imposed by regulatory authorities.
• Legitimate interests: Processing carried out for purposes of fraud prevention, platform security, abuse detection, and internal analytics — where those interests are not overridden by your rights and interests as a data subject.
• Consent: Processing carried out for direct marketing communications, where your consent has been obtained at registration or subsequently, and which you may withdraw at any time without detriment to your account status.

BossKu8 does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual data protection obligations:

• Payment service providers: Including FPX network operators, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency network processors — for the sole purpose of completing financial transactions you have initiated.
• KYC and identity verification partners: Accredited third-party services engaged to verify identity documents and confirm proof of address submissions. These partners are bound by data processing agreements and are not permitted to use your data for any other purpose.
• Fraud prevention and security services: Third-party services that assist in detecting fraudulent activity, device fingerprinting, and IP intelligence — engaged solely to protect the security of the platform and its members.
• Technology and infrastructure providers: Cloud hosting, database management, and content delivery providers that process technical data as part of platform operations, under binding data processing agreements.
• Legal and regulatory authorities: Law enforcement agencies, financial intelligence units, courts, or regulators where we are required by law to disclose personal data, or where disclosure is necessary to protect the rights, property, or safety of BossKu8, its members, or the public.

All third-party data processors engaged by BossKu8 are required to maintain appropriate technical and organisational security measures and to process personal data only for the specified purposes communicated to them.

BossKu8 uses cookies and similar tracking technologies to ensure the platform functions correctly, to maintain your session state while logged in, and to collect anonymised analytics data that helps us understand how members use the platform and where improvements can be made.

The categories of cookies we use are as follows:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing identifiers. These cookies cannot be disabled without impairing platform functionality.
• Functional cookies: Store your preferences such as language settings, remembered login details (where you have enabled this), and UI preferences. Disabling these cookies may affect your experience but will not prevent access.
• Analytics cookies: Collect anonymised data about page visits, session durations, game interactions, and navigation patterns. This data is aggregated and cannot be used to identify individual members. Used solely to improve platform design and performance.
• Security cookies: Used by our fraud prevention systems to identify devices associated with suspicious activity and to distinguish legitimate member sessions from automated bots.

BossKu8 does not use third-party advertising cookies or cross-site tracking cookies that profile your behaviour across external websites.

BossKu8 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following indicative retention periods apply:

• Active account data: Retained for the duration of your membership and for a minimum of 5 years following account closure, in accordance with financial record-keeping and anti-money laundering obligations.
• KYC and identity documents: Retained for a minimum of 5 years from the date of submission or account closure (whichever is later), as required by applicable financial crime prevention legislation.
• Transaction records: Retained for a minimum of 7 years from the date of each transaction, consistent with standard financial record-keeping requirements.
• Customer support communications: Retained for 3 years following the closure of each support interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your membership and for 2 years following account closure or the date of opt-out, whichever is later.
• Anonymised analytics data: May be retained indefinitely, as it cannot be used to identify any individual member.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data destruction procedures.

BossKu8 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Key security controls include:

• Transport encryption: All data in transit between your device and our servers is encrypted using TLS 1.2 or higher with 256-bit AES encryption.
• Encryption at rest: Sensitive stored data — including identity documents, financial information, and KYC records — is encrypted at rest using AES-256 encryption.
• Access controls: Access to personal data systems is restricted to authorised personnel on a strict need-to-know basis. All access is authenticated via multi-factor authentication and logged for audit purposes.
• Infrastructure security: Platform infrastructure is hosted in ISO 27001-aligned data centres with physical security controls, redundant power, and environmental monitoring.
• Penetration testing: Regular independent security assessments and penetration tests are conducted to identify and remediate vulnerabilities before they can be exploited.
• Incident response: BossKu8 maintains a documented data breach response procedure. In the event of a breach that is likely to result in a risk to your rights, we will notify affected members as required by applicable law.

As a member whose personal data is processed by BossKu8, you hold the following rights. You may exercise any of these rights at any time by contacting our support team at [email protected] with your request clearly stated.

We will respond to all valid data subject requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days with prior notification. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive, in which case a reasonable administrative charge may apply.

Please note that certain rights are subject to limitations under applicable law. For example, we cannot erase transaction records that we are legally required to retain, and we cannot provide access to data where doing so would prejudice an active fraud investigation.

BossKu8 is strictly an adult platform. We do not knowingly collect personal data from individuals under the age of 21. Our registration process requires confirmation of age eligibility, and our KYC verification process is designed to detect and prevent underage registration.

If we become aware that personal data has been collected from an individual who is under 21 years of age, we will immediately suspend the relevant account, delete the personal data concerned (subject to any applicable legal reporting obligations), and return any deposited funds to the originating payment method following verification.

If you believe a minor has registered on BossKu8 using false information, please contact us immediately at [email protected]. We take underage gambling extremely seriously and will act on all such reports without delay.

BossKu8 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, platform features, or applicable legal requirements. All changes will be published on this page with an updated "Last Updated" date.

Where amendments are material — meaning they significantly affect how your personal data is processed or the rights available to you — we will notify you via email to your registered address and/or via a prominent notice on the platform at least 14 days before the changes take effect.

Your continued use of the BossKu8 platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with the revised terms, you must cease use of the platform and may request account closure by contacting [email protected].

If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or want to report a privacy concern, please contact the BossKu8 Data Protection team through the following channel:

We aim to acknowledge all privacy-related inquiries within 24 hours and to provide a substantive response within 30 calendar days. For requests that are complex or numerous, we may extend this period by up to 60 additional days and will inform you of the extension and the reason within the initial 30-day window.

This Privacy Policy was last reviewed and updated on 1 January 2026. All previous versions of this Policy are superseded by this document.