BossJudi Privacy Policy – Personal Data Protection for Malaysian Players

1.Information We Collect

BossJudi collects various types of information to provide our Malaysian members with a secure, transparent and fully functional betting platform. The information collected falls into two main categories — information you provide directly and information collected automatically while you use the platform:

Information You Provide Directly:

• Full name as shown on your MyKad or other valid Malaysian identification document.
• An active Malaysian mobile number for OTP verification and account communications.
• An active email address for account notifications, transaction confirmations, and promotional communications (if you have consented).
• Date of birth to verify the minimum age requirement of 21 years.
• Payment method details such as your Touch 'n Go eWallet account number, GrabPay, DuitNow, or bank account number, for the purpose of processing deposits and withdrawals.
• A copy of your MyKad or other identity document requested during the Know Your Customer (KYC) process for your first withdrawal.
• Information you provide when contacting BossJudi customer support, including communications via Live Chat or email.

Automatically Collected Information:

• Your device's IP address each time you access the BossJudi platform, used for fraud detection and geographic location verification.
• Web browser type, operating system, and device information, including the phone model or computer being used.
• Session data including pages visited, time spent on the platform, in-platform navigation and actions taken.
• Betting activity logs — including betting history, games played, wager amounts and outcomes — are retained for audit, dispute resolution and legal compliance purposes.
• Information on cookies and similar tracking technologies that help us understand how you use the platform and improve your overall experience.

2.Purpose of Data Collection & Use

BossJudi collects and uses members' personal data only for legitimate and necessary purposes in the context of operating our betting platform. Below is a full list of the purposes for which BossJudi uses your data:

• Registration & Account Verification: To create and maintain your BossJudi account, verify your identity, and confirm that you meet the age and location eligibility requirements.
• Payment Processing: To securely process deposits and withdrawals via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX.
• Security Monitoring & Fraud Prevention: To detect and prevent unauthorised access, account manipulation, money laundering, and any suspicious activity or conduct that violates BossJudi's terms.
• Customer Support: To assist you when you contact the BossJudi support team with technical issues, account enquiries or complaints that need to be resolved.
• Platform Communications: To send you important notifications regarding your account, transactions, changes to terms or policies, and relevant security updates.
• Legal Compliance: To fulfil Malaysian legal obligations, including anti-money laundering reporting requirements and compliance with the Personal Data Protection Act 2010.
• Platform Improvements: To analyse usage patterns on an aggregate (not individual) basis in order to improve the user experience, platform performance, and the development of new features that benefit BossJudi members.
• Marketing Communications (with consent): To send you promotional content, bonus offers, and BossJudi news if you have consented to receive such communications. You may withdraw this consent at any time.

3.Sharing of Data with Third Parties

BossJudi does not sell or rent members' personal data to any third party for commercial or marketing purposes. However, in the course of operating the platform, there are limited circumstances where BossJudi needs to share certain information with trusted third parties:

• Payment Service Providers: BossJudi shares the necessary transaction details with payment gateway providers — including Touch 'n Go eWallet, GrabPay, DuitNow and FPX processors — solely for the purpose of processing your deposits and withdrawals. These providers are bound by strict confidentiality agreements.
• Casino Software Providers: Live Casino providers such as Evolution Gaming, Pragmatic Play Live and SA Gaming receive only the minimum session data required to operate the live tables. They do not receive your financial or personally identifying information.
• Legal Authorities: BossJudi will disclose the necessary information to legitimate Malaysian authorities when required by law, court order, or an official investigation into criminal activity or money laundering.
• KYC Service Providers: For identity verification purposes, BossJudi may engage third-party services to help verify the authenticity of submitted identification documents. This data is processed securely and is not stored by the KYC provider.
• Technology Service Providers: Companies that provide hosting infrastructure, cloud services and data processing used by BossJudi may have limited access to data in the course of performing their technical functions, subject to data processing agreements that comply with PDPA.

All third parties working with BossJudi are required to uphold data protection standards equal to or higher than those BossJudi maintains itself. BossJudi will not share your data beyond the situations described above without first obtaining your explicit consent.

4.Data Security & Technical Protection Measures

BossJudi continuously invests in security infrastructure to ensure members' personal data remains protected against cyber threats, unauthorised access and data breaches. The following are the key technical security measures implemented on the BossJudi platform:

• Data Encryption in Transit: All communications between your browser or app and BossJudi's servers are encrypted using TLS 1.3 protocol with 256-bit SSL certificates. This means your login credentials, transaction details, and personal data cannot be intercepted or read by any third party during transmission.
• Data Encryption at Rest: Sensitive data stored in BossJudi's database — including passwords, bank account numbers, and personal identification details — is encrypted at rest. Passwords in particular are stored as bcrypt hashes, which cannot be reversed or decoded.
• Two-Factor Authentication (2FA): BossJudi supports and encourages all members to enable two-factor authentication on their accounts. Once 2FA is activated, you will need an OTP sent to your phone number in addition to your password to log in.
• Real-Time Security Monitoring: BossJudi's systems are monitored around the clock to detect suspicious activity, unauthorised login attempts, brute force attacks, and abnormal activity patterns.
• Regular Security Audits: BossJudi undergoes periodic independent security audits by third-party cybersecurity specialists to ensure our systems and security procedures remain up to date and meet the latest industry standards.
• Internal Access Controls: Access to members' personal data within BossJudi is governed by a strict need-to-know principle — only staff who require access to perform their duties are granted limited, documented permissions.

While BossJudi takes all reasonable steps to protect your data, no security system can be guaranteed 100% safe against every threat. You also play an important role in keeping your account secure — use a strong password, do not share your login credentials, and report any suspicious activity to the BossJudi team immediately.

5.Data Retention Period

BossJudi retains members' personal data for as long as necessary to fulfil the purpose for which it was collected and to meet applicable legal obligations. The following are BossJudi's key data retention guidelines:

Once a retention period expires, BossJudi will securely delete or anonymise the data in accordance with established procedures. Data required to fulfil legal obligations will be retained even after an account is closed, subject to applicable legal requirements.

6.Your Rights as a Data Subject

Under Malaysia's Personal Data Protection Act 2010, you have several rights regarding the personal data BossJudi holds about you. BossJudi respects and facilitates the exercise of these rights:

• Right to Access: You have the right to request a copy of the personal data BossJudi holds about you. Data access requests can be submitted by email to support@bossjudi.best, and BossJudi will respond within 21 business days.
• Right to Rectification: If you find that any personal data BossJudi holds about you is inaccurate or out of date, you have the right to request a correction. Most profile information can be updated directly through your BossJudi account settings.
• Right to Erasure: Under certain circumstances, you may request that BossJudi delete your personal data. However, this right is not absolute — BossJudi may decline a deletion request if the data is still needed to fulfil a legal obligation or to resolve an ongoing dispute.
• Right to Withdraw Consent: For data processed on the basis of your consent (such as marketing communications), you may withdraw that consent at any time without affecting the validity of any processing carried out prior to withdrawal.
• Right to Restrict Processing: In certain circumstances — such as when a dispute about data accuracy is being resolved — you may request that BossJudi temporarily restrict the processing of your data.
• Right to Lodge a Complaint: If you believe BossJudi has violated your privacy rights under PDPA 2010, you have the right to file a complaint with the Personal Data Protection Commissioner of Malaysia.

To exercise any of the rights above, contact the BossJudi team by email at support@bossjudi.best or via 24/7 Live Chat. Please include your account number and a clear description of your request. We will verify your identity before processing any request related to your personal data.

7.Cookies & Tracking Technology Policy

BossJudi uses cookies and similar technologies to enhance the user experience, maintain account security and understand platform usage patterns on an aggregate basis. Below is an explanation of the types of cookies used and their purposes:

• Essential Cookies: Cookies that are required for the BossJudi platform to function properly — including login session cookies that maintain your logged-in status, security cookies that help detect and prevent fraud, and cookies that store your language preferences and settings. These cookies cannot be disabled as they are essential to the platform's core operations.
• Analytics Cookies: Used to gather information on how BossJudi members use the platform — which pages are visited most frequently, how long is spent in each section and where players encounter difficulties. This data is collected in aggregate and anonymised form.
• Functional Cookies: Cookies that remember your preferences — such as your favourite casino table, preferred betting limits, and display settings — to deliver a more personalised experience on the BossJudi platform.

You can manage and control cookies through your web browser settings. However, disabling essential cookies may affect the functionality of the BossJudi platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

8.Children's Privacy & Protection of Minors

BossJudi strictly does not provide services to individuals under the age of 21. We do not knowingly collect any personal data from children or minors. All account registrations require age verification, and BossJudi reserves the right to request additional proof of age at any time.

Should BossJudi discover that personal data belonging to a child or minor has been collected without our knowledge — for example, through registration using false information — we will promptly delete that data and close the account in question.

Parents and guardians who are concerned that their child may have registered for or accessed the BossJudi platform without permission are urged to contact us immediately at support@bossjudi.best. We will take prompt action to address the situation and encourage the use of parental control software to block access to gambling websites.

9.Cross-Border Data Transfers

As BossJudi's platform operates with international service providers — including Live Casino providers and cloud infrastructure — some data may be processed or stored on servers located outside Malaysia. BossJudi ensures that all cross-border data transfers are carried out with adequate safeguards in place:

• All cross-border data transfers are governed by data processing agreements that require recipients to uphold data protection standards equivalent to Malaysia's PDPA 2010.
• BossJudi only works with international providers that have a strong track record of data security compliance and are based in jurisdictions with recognised data protection legislation.
• Data transferred is the minimum necessary for the specific operational purpose and does not include more information than is required for the function in question.

10.Financial Security & Payment Information

As BossJudi processes financial transactions involving Malaysian payment methods such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, and FPX via Maybank2u and CIMB Clicks, we apply additional security measures to safeguard members' financial information:

• BossJudi does not store members' credit card numbers or internet banking passwords in any of our systems. All such sensitive financial information is processed directly by dedicated third-party secure payment gateways.
• Every financial transaction on BossJudi is assigned a unique ID, enabling precise tracking and verification in the event of any dispute or audit requirement.
• Withdrawals are only permitted to payment methods registered under the same member's name to prevent misappropriation of funds. This also protects you in cases where someone attempts to withdraw funds to another person's account using your BossJudi account.
• BossJudi monitors all financial transactions for patterns indicative of money laundering or fraudulent activity, in line with obligations under Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001.

11.Contact the BossJudi Privacy Officer

BossJudi has appointed a dedicated officer responsible for managing data protection matters and ensuring ongoing compliance with Malaysia's PDPA 2010 and this Privacy Policy. If you have any questions, concerns, or wish to exercise your privacy rights, please reach us through the following channels:

• Email: support@bossjudi.best – for privacy and data access requests, include "PRIVACY" in your email subject line.
• Live Chat: Available 24/7 through the BossJudi platform for general privacy-related enquiries.
• Response Time: BossJudi is committed to responding to all privacy-related enquiries within 5 business days and resolving more complex requests within 21 business days, in line with PDPA requirements.

If you are not satisfied with BossJudi's response to your privacy inquiry, you have the right to file a complaint with the Department of Personal Data Protection Malaysia or the relevant Personal Data Protection Commissioner.

12.Amendments to This Privacy Policy

BossJudi reserves the right to modify this Privacy Policy from time to time to reflect changes in our data processing practices, applicable legal requirements, or technological developments that affect how we protect your data. The most recent update date is always displayed at the top of this document.

For material changes that significantly affect your privacy rights, BossJudi will notify you by email to the address registered on your account, or through a prominent notice within the BossJudi platform, before the changes take effect. Continued use of the BossJudi platform after such notification will be considered acceptance of the updated policy.

We encourage you to review this Privacy Policy page periodically to stay informed about how BossJudi protects your information. If you have any questions about changes that have been made, feel free to reach out to our team.