bosscuci Privacy Policy

1. Who We Are

This Privacy Policy is published by bosscuci, the operator of the online gaming platform accessible at bosscuci.org (the "Platform"). bosscuci operates under international gaming authority licensing guidelines and is the data controller in respect of all personal data collected through the Platform.

References to "bosscuci", "We", "Us", or "Our" in this Policy mean the bosscuci Platform operator and its duly authorised service providers acting on its behalf. References to "You" or "Your" mean any individual who accesses the Platform, creates an Account, or otherwise provides personal data to bosscuci.

If you have any questions about this Privacy Policy or how your data is handled, contact us at [email protected] (plain text — not a clickable link).

2. Data We Collect

2.1 Registration Data

When you create a bosscuci Account, we collect the following information:

• Email address (used as your Account identifier and primary contact method);
• Date of birth (used for age verification — you must be 21 or older);
• Password (stored in hashed form only — never in plain text);
• Any additional information you voluntarily provide during or after registration.

2.2 KYC Verification Data

When required under our Know Your Customer (KYC) procedures — primarily before processing Withdrawals or at any point deemed necessary by our compliance team — we may collect:

• Government-issued photo identification (MyKad, Malaysian passport, or driving licence);
• Proof of residential address (utility bill, bank statement, or similar document dated within three months);
• Proof of payment method (screenshot or image of the Touch n Go eWallet, bank account, or other payment method used for deposits);
• Selfie or live photo for identity matching where required.

2.3 Transaction Data

We collect records of all financial transactions conducted through your bosscuci Account, including deposits, withdrawals, wagers, bonus credits, and adjustments. This includes payment method references (e.g., partial account numbers, transaction IDs) but not full card numbers or bank credentials — these are processed directly by our payment partners under their own security controls.

2.4 Usage and Technical Data

When you access the bosscuci Platform, our systems automatically collect certain technical information, including:

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, and browser version;
• Pages visited, features used, and session duration;
• Referral source (e.g., the URL from which you arrived at bosscuci.org);
• Session cookies and local storage data used to maintain your login state.

2.5 Communications Data

If you contact bosscuci via live chat, email, or any other channel, we retain records of those communications, including the content of messages and any information you provide in the course of seeking support. These records are used to resolve your enquiry, improve our support processes, and maintain a history of account-related interactions.

2.6 Responsible Gaming Data

Where you configure responsible gaming tools (deposit limits, loss limits, self-exclusion), we record those settings and the dates on which they were applied or modified. This data is used to enforce your chosen limits and to fulfil our regulatory obligations regarding player protection.

3. How We Use Your Data

bosscuci uses the personal data we collect for the following purposes:

• Account management: creating, maintaining, and administering your bosscuci Account;
• Service delivery: enabling you to access all products on the Platform — sportsbook, live casino, slots, arcade, and esports betting;
• Payment processing: facilitating MYR deposits and withdrawals via your chosen payment method (Touch n Go, Boost, Maybank, CIMB, and others);
• Identity and age verification: confirming that you are 21 or older and that the identity you provided is genuine;
• Fraud prevention and security: detecting and investigating suspicious activity, unauthorised access, or potential money laundering;
• Regulatory compliance: fulfilling our obligations under applicable gaming authority requirements, including record-keeping, KYC, and responsible gaming mandates;
• Customer support: responding to your enquiries and resolving account issues;
• Promotions and communications: sending account-related notifications, transaction confirmations, and — where you have not opted out — promotional communications about bosscuci offers;
• Platform improvement: analysing usage patterns to improve Platform performance, user experience, and product offerings;
• Responsible gaming enforcement: applying and monitoring the deposit limits, loss limits, and self-exclusion settings you have configured on your Account.

bosscuci does not use your personal data for automated decision-making that produces legal or similarly significant effects, except where such processing is necessary for fraud detection or regulatory compliance and appropriate safeguards are in place.

4. Legal Basis for Processing

bosscuci processes your personal data on the following legal bases:

• Contractual necessity: processing necessary to perform our contract with you — specifically, to provide the gaming services you have registered to access;
• Legal obligation: processing required to comply with applicable gaming authority regulations, anti-money laundering laws, and KYC requirements;
• Legitimate interests: processing for fraud prevention, platform security, and service improvement where those interests are not overridden by your privacy rights;
• Consent: where we rely on your consent — for example, for promotional communications — you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. Data Sharing

5.1 Service Providers

bosscuci shares personal data with third-party service providers that assist us in operating the Platform, including:

• Payment processors and e-wallet operators (Touch n Go, Boost, Maybank, CIMB, and others) — to facilitate deposits and withdrawals;
• KYC and identity verification providers — to verify identity documents and conduct age checks;
• Game content providers (Pragmatic Play, PG Soft, Evolution Gaming, and others) — limited technical data necessary to deliver their gaming products;
• Cloud hosting and infrastructure providers — to store and process Platform data securely;
• Customer support platform providers — to facilitate live chat and email support.

All service providers are required to process your data only for the purposes specified by bosscuci and in accordance with appropriate data protection standards.

5.2 Regulatory and Legal Disclosure

bosscuci may disclose personal data to gaming regulatory authorities, law enforcement agencies, or other government bodies where required to do so by applicable law or in response to a valid legal process. bosscuci will not disclose more data than is necessary for the specific legal purpose.

5.3 No Sale of Personal Data

bosscuci does not sell, rent, license, or otherwise transfer your personal data to third parties for their own independent marketing or commercial purposes. Data shared with third parties is limited to what is strictly necessary to provide the services described in this Policy.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of the bosscuci business, personal data held by bosscuci may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to data handling practices that may result.

6. Cookies & Tracking Technologies

6.1 What We Use

bosscuci uses cookies, session storage, and similar technologies to operate the Platform. These fall into the following categories:

• Strictly necessary cookies: essential for Platform operation — including your login session token, security cookies, and preference settings. These cannot be disabled without materially impairing Platform functionality.
• Analytics cookies: used to understand how users interact with the Platform — which pages are most visited, how sessions begin and end, and where errors occur. This data is aggregated and not used to identify individual users.
• Preference cookies: used to remember settings you have configured, such as display preferences.

6.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from accessing your bosscuci Account and using the Platform. Browser-level cookie management instructions vary by browser; consult your browser's help documentation for guidance.

7. Data Security

bosscuci implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the Platform;
• Password hashing using a strong, one-way cryptographic algorithm — plain-text passwords are never stored;
• Access controls limiting Platform system access to authorised personnel on a need-to-know basis;
• Regular security reviews and monitoring for anomalous activity;
• Two-factor authentication (2FA) available for all Account holders.

While bosscuci takes reasonable measures to protect your data, no method of transmission over the internet or electronic storage is completely secure. bosscuci cannot guarantee absolute security and will not be liable for breaches resulting from circumstances beyond its reasonable control. In the event of a data breach affecting your personal data, bosscuci will notify you and the relevant regulatory authority as required by applicable law.

8. Data Retention

bosscuci retains your personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal and regulatory requirements. Specific retention periods include:

• Active Account data: retained for the duration of your Account and for a minimum of five years after Account closure;
• Transaction records: retained for a minimum of five years from the date of each transaction, consistent with anti-money laundering record-keeping obligations;
• KYC documents: retained for a minimum of five years from the date of verification or Account closure, whichever is later;
• Support communications: retained for up to three years from the date of the communication;
• Marketing consent records: retained for as long as the consent is active and for a reasonable period after withdrawal to demonstrate compliance.

After the applicable retention period, data is securely deleted or anonymised in a manner that prevents re-identification.

9. Your Rights

Subject to applicable law and the gaming authority framework under which bosscuci operates, you have the following rights in respect of your personal data:

• Right of access: you may request a copy of the personal data bosscuci holds about you;
• Right to rectification: you may request correction of inaccurate or incomplete personal data;
• Right to erasure: you may request deletion of your personal data, subject to legal retention obligations and any outstanding compliance requirements;
• Right to restrict processing: you may request that we limit how we use your data in certain circumstances;
• Right to data portability: you may request your data in a structured, machine-readable format where technically feasible;
• Right to object: you may object to processing based on legitimate interests, including profiling;
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time — this does not affect the lawfulness of prior processing.

To exercise any of these rights, contact bosscuci at [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days, following identity verification. Some requests may be subject to limitations where legal obligations require us to retain data or where deletion would conflict with responsible gaming self-exclusion requirements.

10. International Data Transfers

bosscuci and its service providers may process your personal data in countries outside Malaysia. Where data is transferred internationally, bosscuci ensures that appropriate safeguards are in place — such as data processing agreements that incorporate standard contractual protections — to ensure your data receives a level of protection consistent with this Policy.

Game providers such as Evolution Gaming and Pragmatic Play operate internationally and may process game session data on infrastructure located in multiple countries. These providers are certified under international gaming authority standards and are bound by data protection agreements with bosscuci.

11. Minors

The bosscuci Platform is strictly for adults aged 21 and above. bosscuci does not knowingly collect personal data from individuals under the age of 21. If we become aware that an Account has been created by or on behalf of a minor, we will immediately suspend the Account, void any associated transactions, and delete the relevant personal data in accordance with our data retention procedures.

If you are a parent or guardian and believe that a minor has provided personal data to bosscuci or has created an Account, please contact us immediately at [email protected]. We will investigate and take appropriate action without undue delay.

12. Changes to This Privacy Policy

bosscuci reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they affect how we collect, use, or share your personal data in a significant way — we will notify you by posting the updated Policy on this page with a revised "Last Updated" date and, where practicable, by sending a notification to the email address registered to your Account.

Your continued use of the bosscuci Platform after the effective date of any amendment constitutes your acceptance of the revised Policy. We encourage you to review this page periodically. If you do not agree to a revised Policy, you may close your Account in accordance with the process set out in our Terms & Conditions.

13. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by bosscuci, please contact us using the following channels:

• Email: [email protected] — plain text, not a clickable link. Include "Privacy Policy" or "Data Rights Request" in the subject line for faster routing.
• Live Chat: available 24/7 on the bosscuci Platform, accessible without logging in for general privacy enquiries.

We aim to respond to all privacy enquiries within 5 business days and to complete data rights requests within 30 calendar days of identity verification. For unresolved complaints, you may also contact the applicable regulatory authority under whose framework bosscuci operates.