Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, date of birth, national identity number, email address, Indonesian mobile number, bank account details, and IP address.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "Data Controller" means the entity that determines the purposes and means of Processing Personal Data — in this case, bos999.
• "Data Processor" means a third party that Processes Personal Data on behalf of bos999 under a written data-processing agreement.
• "Player" or "you" means any individual who registers an account with bos999 and uses the Platform's Services.
• "Platform" means the bos999 website at https://bos999.cam and all associated mobile-optimized interfaces.
• "Services" means all gaming and betting products offered by bos999, including sports betting, live casino, slot games, and togel (Indonesia's traditional numbers lottery) markets.
• "KYC" means the Know Your Customer identity-verification process mandated for compliance and fraud-prevention purposes.

2. Data Controller

2.1 bos999 acts as the Data Controller for all Personal Data collected through the Platform. As Data Controller, bos999 is responsible for ensuring that Personal Data is Processed lawfully, fairly, and transparently in accordance with applicable data-protection principles.

2.2 bos999 has designated an internal data-protection point of contact. If you have any questions or concerns about how your Personal Data is handled, you may contact us at any time using the details set out in Section 13 of this Policy.

2.3 Where bos999 engages third-party Data Processors — including payment processors such as BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja, as well as identity-verification and fraud-detection service providers — those processors are contractually bound to handle Personal Data only on bos999's documented instructions and to maintain security standards equivalent to or exceeding those described in this Policy.

3. Personal Data We Collect

3.1 bos999 collects the following categories of Personal Data:

3.1.1 Registration Data

• Full legal name (as it appears on your Indonesian KTP or passport)
• Date of birth
• Email address
• Indonesian mobile phone number
• Preferred username and encrypted password
• City and province of residence (e.g., Jakarta, Surabaya, Bandung, Bali)

3.1.2 KYC & Identity-Verification Data

• Copies of government-issued photo identification (KTP, passport, or SIM)
• Proof of residential address (utility bill, bank statement dated within three months)
• Photographs or selfies submitted for liveness verification
• Indonesian National Identity Number (NIK) where required for enhanced due diligence

3.1.3 Financial Data

• Bank account name and number (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, or Bank Permata)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Deposit and withdrawal transaction history, denominated in Indonesian Rupiah (IDR/Rp)
• Bonus redemption and wagering records

3.1.4 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Session timestamps and login history
• Cookies and session tokens (see Section 9)

3.1.5 Behavioral & Gaming Data

• Game history, bet amounts, and outcomes
• Sports betting selections including BRI Liga 1, EPL, La Liga, Champions League, and other markets
• Responsible gaming preferences (deposit limits, self-exclusion status, session time limits)
• Customer support interaction records and chat transcripts

3.2 bos999 does not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or biometric data beyond the liveness-check photographs required for KYC purposes.

4. Purpose & Legal Basis for Processing

4.1 bos999 Processes your Personal Data for the following purposes and on the following legal bases:

4.2 Where Processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of Processing carried out prior to withdrawal. To withdraw consent for marketing communications, use the unsubscribe link included in every promotional message or contact our support team.

5. Data Retention

5.1 bos999 retains Personal Data for as long as is necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:

• Account and registration data: Retained for the lifetime of your account and for a minimum of five (5) years following account closure, to satisfy anti-money laundering and audit obligations.
• KYC documents: Retained for a minimum of five (5) years following submission, or longer if required by applicable regulation.
• Financial transaction records: Retained for a minimum of five (5) years in accordance with financial record-keeping requirements.
• Customer support records: Retained for two (2) years following the resolution of each support interaction.
• Marketing preferences and consent records: Retained for three (3) years from the date of last recorded consent, or until consent is withdrawn.
• Technical and device logs: Retained for twelve (12) months on a rolling basis unless required for an active investigation.

5.2 Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized so that it can no longer be attributed to any identifiable individual. Anonymized, aggregated data may be retained indefinitely for statistical and platform-improvement purposes.

6. Data Sharing & Disclosure

6.1 bos999 does not sell, rent, or otherwise trade your Personal Data to third parties for their own commercial or marketing purposes. We share Personal Data only in the circumstances described below.

6.1.1 Payment Processors

To facilitate deposits and withdrawals, bos999 shares relevant financial data with licensed payment processors and banking partners, including BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, OVO, DANA, GoPay, ShopeePay, and LinkAja. Each of these partners operates under its own regulatory framework and data-protection obligations.

6.1.2 Identity Verification Providers

KYC documents and identity data are shared with third-party verification service providers under strict data-processing agreements. These providers are engaged solely to confirm the authenticity of submitted documents and to screen against sanctions and politically exposed person (PEP) lists.

6.1.3 Fraud Prevention & Security

Technical data including IP addresses, device fingerprints, and behavioral patterns may be shared with fraud-detection partners to identify and prevent unauthorized access, collusion, bonus abuse, and money-laundering activity on the Platform.

6.1.4 Legal & Regulatory Authorities

bos999 may disclose Personal Data to law enforcement, regulatory bodies, or other governmental authorities where required to do so by applicable law, court order, or valid legal process. In such cases, bos999 will disclose only the minimum data necessary to satisfy the legal requirement.

6.1.5 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of bos999's business assets, Personal Data held by bos999 may be transferred to the acquiring entity, subject to the acquiring entity committing to honor the terms of this Privacy Policy or providing equivalent protections.

7. International Data Transfers

7.1 bos999 primarily stores and Processes Personal Data on servers located within or near the Asia-Pacific region to minimize latency for players in Jakarta, Surabaya, Medan, Bandung, Bali, and across Indonesia. However, certain Data Processors engaged by bos999 may operate infrastructure in other jurisdictions.

7.2 Where Personal Data is transferred outside Indonesia, bos999 ensures that appropriate safeguards are in place, which may include:

• Standard contractual clauses incorporating data-protection obligations equivalent to those described in this Policy
• Binding corporate rules where the receiving entity is part of a group that has implemented an approved group-wide privacy framework
• Adequacy determinations where the destination jurisdiction has been recognized as providing an equivalent level of data protection

7.3 You may request further information about the specific safeguards applicable to any international transfer of your Personal Data by contacting our support team at the details provided in Section 13.

8. Security Measures

8.1 bos999 implements a comprehensive set of technical and organizational security measures designed to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in transit: All communications between your browser or device and the bos999 Platform are encrypted using TLS 1.2 or higher.
• Encryption at rest: Personal Data stored in bos999's databases is encrypted using AES-256 encryption.
• Access controls: Access to Personal Data is restricted to bos999 personnel and authorized Data Processors who have a legitimate operational need. All access is logged and audited.
• Two-factor authentication: Players are encouraged to enable two-factor authentication (2FA) on their accounts. bos999 staff accounts with access to player data are required to use 2FA.
• Penetration testing: bos999 engages independent security specialists to conduct regular vulnerability assessments and penetration tests of Platform infrastructure.
• Incident response: bos999 maintains a documented data-breach response procedure. In the event of a breach likely to result in risk to affected individuals, bos999 will notify the relevant Players and authorities within the timeframe required by applicable regulation.

8.2 While bos999 takes all reasonable steps to protect your Personal Data, no method of electronic transmission or storage is entirely risk-free. You are responsible for maintaining the confidentiality of your account credentials and for logging out of your account when using shared or public devices.

9. Cookies & Tracking Technologies

9.1 bos999 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are deployed:

9.2 bos999 does not deploy third-party advertising cookies or behavioral-profiling trackers. You will not be tracked across other websites for the purpose of serving you targeted advertisements.

9.3 Strictly necessary and security cookies cannot be disabled as they are essential to the secure operation of the Platform. You may manage functional and performance cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of your account.

10. Your Data Rights

10.1 As a Player on the bos999 platform, you hold the following rights in respect of your Personal Data, subject to applicable legal limitations:

• Right of Access: You may request a copy of the Personal Data bos999 holds about you, including the categories of data, the purposes for which it is Processed, and any third parties with whom it has been shared.
• Right to Rectification: If any of your Personal Data is inaccurate or incomplete, you may request that we correct or update it. For registered account details, many fields can be updated directly through your account settings.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully Processed. This right is subject to bos999's legal obligation to retain certain records for compliance and audit purposes.
• Right to Restriction: You may request that bos999 restrict the Processing of your Personal Data in certain circumstances, such as where you contest the accuracy of the data or where you object to Processing based on legitimate interests pending verification.
• Right to Data Portability: Where Processing is based on your consent or on the performance of a contract, you may request that bos999 provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to the Processing of your Personal Data where bos999 relies on legitimate interests as its legal basis, including profiling based on those interests. bos999 will cease Processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where Processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of Processing carried out prior to withdrawal.

10.2 To exercise any of the above rights, please contact bos999 customer support via live chat or email at [email protected]. bos999 will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where a request is complex or numerous, this period may be extended by a further 30 days, of which you will be notified.

10.3 bos999 may require you to verify your identity before processing a data rights request to ensure that Personal Data is not disclosed to unauthorized parties.

11. Minors & Age Restriction

11.1 The bos999 Platform is intended exclusively for adults. You must be at least 21 years of age and a legal resident of Indonesia to register an account and use our Services. This minimum age requirement is strictly enforced.

11.2 bos999 does not knowingly collect Personal Data from individuals under the age of 21. If bos999 becomes aware that Personal Data has been collected from a minor, the relevant Account will be immediately suspended, all Personal Data associated with that Account will be deleted, and any funds deposited will be returned to the verified owner of the payment method used.

11.3 If you have reason to believe that a minor has registered an account on the bos999 Platform, please notify us immediately at [email protected]. bos999 takes underage gambling extremely seriously and will act on all such reports without delay.

11.4 Parents and guardians are encouraged to use parental-control software to restrict minors' access to online gambling platforms. A range of free and paid parental-control tools are available that can block access to gambling websites at the device or network level.

12. Changes to This Privacy Policy

12.1 bos999 reserves the right to update or modify this Privacy Policy at any time to reflect changes in applicable data-protection law, regulatory guidance, or our internal data-handling practices. The date of the most recent revision is displayed at the top of this page.

12.2 Where a proposed change is material — meaning it substantially affects your rights or the way in which your Personal Data is Processed — bos999 will provide at least fourteen (14) days' advance notice via email to your registered address and via an in-platform notification. Your continued use of the Platform following the effective date of the revised Policy constitutes your acceptance of the updated terms.

12.3 If you do not agree with a proposed material change, you may close your account before the change takes effect by contacting our support team. Any verified real-money balance will be returned to your registered bank account or e-wallet following successful identity verification.

12.4 The current version of this Privacy Policy is always accessible at https://bos999.cam/privacy-policy. We recommend that you review this page periodically to stay informed of how bos999 protects your data.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bos999 handles your Personal Data, please contact us through any of the following channels:

• Email: [email protected]
• Live Chat: Available 24/7 via the chat interface on the bos999 Platform
• Support Hours: 24 hours a day, 7 days a week, operating in WIB timezone (UTC+7)

bos999 is committed to resolving all privacy-related inquiries promptly and transparently. If you are not satisfied with the outcome of your inquiry, you may have the right to lodge a complaint with a relevant data-protection supervisory authority in your jurisdiction.

We recommend retaining a copy of this Privacy Policy for your records. The current and authoritative version is always available at https://bos999.cam/privacy-policy.