bos01 — Privacy Policy

1. Definitions

Throughout this Privacy Policy, the following terms carry the meanings assigned below unless the context clearly requires otherwise.

• "bos01", "we", "us", "our" — the operator of the online betting and gaming platform accessible at https://bos01.cam, operated under an international gaming licence.
• "Platform" — the website, mobile-optimised pages, and associated digital services made available by bos01.
• "User", "you", "your" — any individual who accesses the Platform or holds a registered account, including visitors who have not registered.
• "Personal Data" — any information that identifies or can reasonably be used to identify a living individual, including but not limited to name, date of birth, residential address, email address, telephone number, national identity number, payment account details, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data — in this context, bos01.
• "Data Processor" — a third party that processes Personal Data on behalf of bos01 under a contractual data processing agreement.
• "KYC" — Know Your Customer: the identity and age verification procedures bos01 conducts in accordance with its anti-money-laundering and responsible gaming obligations.
• "Cookies" — small text files placed on your device by the Platform for session management, analytics, and personalisation purposes.

2. Data Controller

bos01 is the Data Controller responsible for Personal Data collected through the Platform. bos01 operates under an internationally recognised gaming licence and applies data protection standards consistent with globally accepted best practices. For all data-related enquiries or to exercise your rights under this Privacy Policy, please use the contact details provided in clause 15.

Where bos01 engages third-party service providers — such as payment processors, identity verification agencies, and cloud infrastructure providers — to process Personal Data on its behalf, bos01 enters into written data processing agreements with those providers that impose data protection obligations no less stringent than those described in this Privacy Policy.

3. Data We Collect

bos01 collects only the Personal Data that is necessary and proportionate to the purposes described in clause 6. The categories of Personal Data we collect are set out in the table below.

Category	Examples	Required / Optional
Identity Data	Full legal name, date of birth, nationality, gender, photograph (from ID document), Indonesian national ID number (NIK from KTP)	Required — for KYC compliance and age verification
Contact Data	Email address, Indonesian mobile telephone number, residential address including city (e.g., Jakarta, Surabaya, Bandung, Bali)	Required — for account communication and verification
Financial Data	Bank account number and bank name (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata, OCBC NISP), e-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja), transaction history, deposit and withdrawal amounts in IDR	Required — for payment processing and AML compliance
Account Data	Username, hashed password, account balance, bonus credit history, wagering activity, session logs, responsible gaming tool settings	Required — for account operation
Technical Data	IP address, device type and operating system, browser type, screen resolution, time zone (WIB/WITA/WIT), session duration, referring URL	Collected automatically — for security and fraud prevention
Usage Data	Pages visited, games played, betting market selections, search queries within the Platform, feature interaction patterns	Collected automatically — for product improvement
Communications Data	Live chat transcripts, email correspondence with support, formal complaint records	Collected when you contact us
Source-of-Funds Data	Employment information, income documentation, bank statements — requested only where transaction volumes trigger enhanced due diligence under our AML policy	Required only where EDD is triggered

4. How We Collect Data

bos01 collects Personal Data through the following channels:

• Direct submission: Information you provide when completing the registration form, submitting KYC documents, depositing or withdrawing funds, contacting customer support, or using responsible gaming tools.
• Automated technologies: Cookies, web beacons, server logs, and similar tracking technologies that record Technical Data and Usage Data when you access the Platform. See clause 11 for full details on our cookie practices.
• Third-party identity verification providers: Where you consent during KYC, bos01 may receive identity and age verification results from accredited identity verification service providers.
• Payment processors: Confirmation of payment status, transaction reference numbers, and — where required for AML compliance — additional payment-account information from banks and e-wallet providers including BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• Fraud prevention and AML screening services: bos01 may receive risk-scoring data or watchlist-screening results from third-party compliance service providers in connection with regulatory obligations.

5. Legal Basis for Processing

bos01 processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity:

1. Contractual necessity: Processing required to perform the contract between bos01 and you — specifically, operating your account, processing deposits and withdrawals, and settling wagers. Without this processing, bos01 cannot provide its services.
2. Legal obligation: Processing required to comply with applicable law, including KYC verification, anti-money-laundering (AML) screening, and record-keeping obligations imposed by our international gaming licence.
3. Legitimate interests: Processing carried out in pursuit of bos01's legitimate business interests — including fraud prevention, platform security, product improvement, and responsible gaming monitoring — where those interests are not overridden by your fundamental rights and freedoms.
4. Consent: Where bos01 relies on your consent as the legal basis for processing (for example, to send you promotional communications or to place non-essential cookies), that consent is obtained at the point of data collection and may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Purposes of Processing

bos01 processes Personal Data for the following specific purposes:

• Account creation and management: Registering your account, maintaining your profile, and authenticating your identity at login.
• Age and identity verification (KYC): Confirming that you are at least 21 years of age and that your identity is consistent with the information provided at registration, in compliance with our licensing obligations.
• Payment processing: Executing deposits from and withdrawals to your registered Indonesian bank account or e-wallet, detecting failed or fraudulent transactions, and maintaining financial records in IDR.
• Anti-money-laundering (AML) and fraud prevention: Screening transactions and account activity against risk indicators, conducting enhanced due diligence where required, and reporting to regulatory authorities where legally mandated.
• Platform operation and improvement: Diagnosing technical issues, analysing usage patterns to improve navigation and features, and conducting A/B testing on Platform elements.
• Customer support: Responding to your enquiries, resolving complaints, and maintaining records of support interactions for quality and training purposes.
• Responsible gaming: Monitoring account activity for indicators of problem gambling, administering deposit limits and self-exclusion tools, and proactively contacting Users where patterns of concern are identified.
• Security: Detecting and preventing unauthorised account access, multi-accounting, bot activity, and other security threats to the Platform and to individual User accounts.
• Marketing communications (with consent only): Sending promotional offers, bonus notifications, and platform updates where you have explicitly opted in to receive such communications. You may opt out at any time.
• Legal compliance and regulatory reporting: Fulfilling record-keeping, reporting, and audit obligations imposed by our gaming licence and applicable law.

7. Data Sharing

7.1 Third-Party Service Providers

bos01 shares Personal Data with carefully vetted third-party service providers who process data on our behalf under binding data processing agreements. These providers include:

• Payment processors and banking partners: BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, OVO, DANA, GoPay, ShopeePay, LinkAja, and affiliated payment gateway operators — solely to execute financial transactions.
• Identity verification providers: Accredited KYC and age-verification service providers engaged to process identity documents submitted during account verification.
• Cloud infrastructure and hosting providers: Providers of the server infrastructure on which the Platform operates, subject to contractual obligations to maintain data security.
• Customer support technology providers: Live chat and CRM platform providers used to deliver and record customer support interactions.
• Analytics providers: Aggregated, anonymised usage data may be shared with analytics service providers for Platform improvement purposes. No individually identifiable data is shared for analytics purposes.
• Fraud and AML screening providers: Compliance technology providers used to screen transactions and account behaviour against risk indicators and sanctions lists.

7.2 Regulatory and Legal Disclosures

bos01 may disclose Personal Data to regulatory authorities, law enforcement agencies, or other governmental bodies where required to do so by applicable law, by our gaming licence conditions, or by a valid legal order. bos01 will, where legally permissible, notify the affected User of such disclosure prior to its occurrence.

7.3 No Sale of Personal Data

bos01 does not and will not sell, rent, lease, or otherwise transfer your Personal Data to third parties for their own marketing or commercial purposes. Any sharing of Personal Data is strictly limited to the purposes identified in this Privacy Policy.

8. International Transfers of Personal Data

bos01 operates globally and some of the third-party service providers described in clause 7 may process Personal Data in jurisdictions outside Indonesia. Where Personal Data is transferred outside Indonesia, bos01 ensures that adequate protections are in place — including standard contractual clauses, binding corporate rules, or transfers to jurisdictions recognised as providing an adequate level of data protection — before any such transfer takes place. Users in Indonesia retain the same data rights described in clause 12 regardless of where their data is processed.

9. Data Retention

bos01 retains Personal Data only for as long as it is necessary to fulfil the purpose for which it was collected, or as required by applicable law and our gaming licence conditions. The following general retention periods apply:

• Account and KYC data: Retained for the duration of the account relationship and for a minimum of five (5) years after account closure, in accordance with AML record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by anti-money-laundering regulations applicable under our gaming licence.
• Customer support records: Retained for three (3) years from the date of the relevant interaction, unless a complaint or legal proceeding requires longer retention.
• Technical and usage data: Retained in identifiable form for up to twenty-four (24) months, after which data is aggregated and anonymised for analytical purposes.
• Marketing consent records: Retained for the duration of your consent and for one (1) year after withdrawal of consent, as evidence of the consent history.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with bos01's internal data disposal procedures.

10. Security Measures

bos01 implements technical and organisational security measures appropriate to the risk associated with processing your Personal Data. These measures include but are not limited to:

• TLS/SSL encryption across all data transmitted between your device and the Platform.
• Encryption at rest for sensitive Personal Data stored on bos01 servers, including KYC documents and financial information.
• Password hashing using industry-standard cryptographic algorithms; bos01 does not store plaintext passwords.
• Access controls restricting access to Personal Data to authorised bos01 personnel and service providers on a need-to-know basis.
• Regular security audits and penetration testing conducted by independent security specialists.
• Intrusion detection systems monitoring for unauthorised access attempts in real time.
• Two-factor authentication available for User accounts to provide an additional layer of login security.

11. Cookies & Tracking Technologies

11.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the Platform. They enable bos01 to recognise your device across sessions, maintain your login state, remember your preferences, and collect usage data for analytics and security purposes.

11.2 Types of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies and security tokens. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and last-visited section. These improve your experience but are not essential.
• Analytics cookies: Collect anonymised or pseudonymised data about how Users navigate the Platform — pages visited, time spent, errors encountered — to help bos01 improve the product.
• Security cookies: Used to detect fraudulent activity, multi-accounting attempts, and unusual session behaviour that may indicate account takeover.

11.3 Managing Cookies

You may configure your browser to block or delete cookies at any time. Note that disabling strictly necessary cookies will prevent you from logging in to the Platform. Instructions for managing cookies vary by browser and are available in your browser's help documentation. bos01 does not use cookies to serve third-party advertising.

12. Your Data Rights

Subject to applicable law and the conditions described below, you hold the following rights in respect of your Personal Data held by bos01:

• Right of access: You may request a copy of the Personal Data bos01 holds about you. bos01 will respond to verified access requests within thirty (30) days.
• Right to rectification: You may request correction of inaccurate or incomplete Personal Data. Where data is held in KYC documents, you may be required to submit updated documentation.
• Right to erasure ("right to be forgotten"): You may request deletion of your Personal Data in certain circumstances — for example, where the data is no longer necessary for its original purpose, or where you withdraw consent and no other legal basis applies. Note that bos01 may be legally required to retain certain data (e.g., AML transaction records) notwithstanding an erasure request.
• Right to restriction of processing: You may request that bos01 restrict the processing of your Personal Data in certain circumstances, such as while the accuracy of data is under dispute.
• Right to data portability: Where processing is based on your consent or on contractual necessity and is carried out by automated means, you may request a structured, machine-readable copy of your Personal Data.
• Right to object: You may object to processing carried out on the basis of bos01's legitimate interests, including direct marketing. bos01 will cease such processing unless compelling legitimate grounds that override your interests can be demonstrated.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.

To exercise any of the above rights, please contact bos01 using the details in clause 15. bos01 may request verification of your identity before actioning any data rights request. There is no charge for exercising your rights, except in cases of manifestly unfounded or excessive requests.

13. Minors

The bos01 Platform is strictly for adults aged 21 years or older. bos01 does not knowingly collect or process Personal Data relating to individuals under the age of 21. Registration is blocked for users who declare an age below 21 at the point of sign-up. Where bos01 discovers that Personal Data has been submitted by or on behalf of a person under the age of 21, that data will be deleted immediately and the associated account will be closed without refund of any deposited funds, in accordance with clause 2 of our Terms & Conditions.

If you believe that a minor has registered an account on the Platform, please contact bos01 immediately using the details in clause 15. We take underage access extremely seriously and will act on all credible reports without delay.

14. Amendments to This Privacy Policy

bos01 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the services we offer. Where amendments are material — meaning they affect your data rights or the way we use your Personal Data in a significant way — bos01 will publish a notice on the Platform no less than seven (7) days before the amended policy takes effect.

The date of the most recent revision is displayed at the top of this page and in the Table of Contents sidebar. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the revised Privacy Policy. If you do not accept the amended terms, you must cease using the Platform and may request account closure in accordance with the procedure described in our Terms & Conditions.

15. Contact & Data Rights Requests

For any questions about this Privacy Policy, to exercise your data rights, or to report a potential data protection concern, please contact bos01 using the following channels:

• Live Chat: Available 24/7 on the Platform. Recommended for general privacy queries. Agents are available in both English and Bahasa Indonesia.
• Email: [email protected] (plain text — not a clickable link). Please use the subject line "Privacy Request" or "Data Rights Request" to ensure your message is routed to the appropriate team. bos01 acknowledges formal data rights requests within five (5) business days and provides a substantive response within thirty (30) calendar days of receipt.

When submitting a data rights request, please include your registered username, the email address associated with your account, and a clear description of the right you wish to exercise or the concern you wish to raise. bos01 may request proof of identity before processing your request to protect against unauthorised data access.