Privacy Policy — bos67

Throughout this Privacy Policy, the following terms carry the meanings set out below. References to the singular include the plural and vice versa.

2.1 Controller Identity. The Data Controller responsible for personal data processed through the bos67 platform is the offshore entity operating under the bos67 brand, accessible at https://bos67.pro. All data processing activities described in this Privacy Policy are carried out by or on behalf of this entity.

2.2 Contact Details. You may contact the bos67 data compliance team at any time regarding privacy matters by emailing [email protected] (please include "Privacy Request" in the subject line) or by initiating a Live Chat session on the platform and requesting to speak with a compliance representative. For Indonesian players, Indonesian-speaking support agents are available 24/7.

bos67 collects personal data across several categories depending on how you interact with the platform. The table below summarises each category, the specific data points within it, and the primary reason for collection.

bos67 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond the selfie KYC photograph), or health data — except where health-related information is voluntarily disclosed in the context of a responsible gaming self-exclusion request.

4.1 Directly From You. The majority of personal data bos67 processes is provided directly by you during the account registration process, KYC submission, payment method registration, and any communications you initiate with our support team.

4.2 Automatically During Platform Use. Technical and device data — including IP address, session data, and interaction logs — is collected automatically by the bos67 platform infrastructure as you browse and use the site. This data is collected through server logs, cookies, and similar session-state technologies described in Clause 10 of this Policy.

4.3 From Payment Processors. When you complete a deposit or withdrawal via a local Indonesian bank (BCA, BRI, BNI, Mandiri, and others) or an e-wallet provider (OVO, DANA, GoPay, ShopeePay, LinkAja), the relevant payment processor may transmit a transaction confirmation and payer identification details to bos67 for the purpose of crediting or debiting your account accurately.

4.4 From Third-Party Game Providers. Game providers integrated into the bos67 platform — including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, and Spribe — may share aggregated session and game outcome data with bos67 for the purposes of result settlement, bet history compilation, and responsible gaming monitoring. bos67 does not receive independently held personal profiles from these providers.

4.5 From Anti-Fraud and Compliance Services. bos67 may engage third-party anti-fraud and know-your-customer verification service providers. These providers may cross-reference data you supply against public-record databases for the purpose of identity verification and sanctions screening.

bos67 processes your personal data only for the specific, legitimate purposes listed below. We do not process personal data for any purpose that is incompatible with these stated purposes without first notifying you and, where required, obtaining your consent.

• Account Management: Creating, maintaining, and securing your bos67 account, including password reset, session management, and multi-device access controls.
• Age & Identity Verification: Confirming that you meet the minimum age requirement of 21 years and that your identity is genuine, in compliance with our responsible gaming obligations.
• Payment Processing: Executing deposits from and withdrawals to your registered Indonesian bank accounts and e-wallets, reconciling transaction records, and investigating payment discrepancies.
• Fraud Prevention & Security: Detecting, preventing, and investigating account takeover, bonus abuse, money laundering, match-fixing, collusion, and other fraudulent or prohibited activities on the platform.
• Regulatory Compliance: Meeting any reporting, record-keeping, or data-sharing obligations imposed by the offshore licensing authority under which bos67 operates, or by any other competent authority with legitimate jurisdiction over bos67's activities.
• Platform Improvement: Analysing aggregated, anonymised usage patterns to improve the performance, reliability, and user experience of the bos67 platform — including mobile responsiveness for Indonesian players in Jakarta, Surabaya, Bali, and other regions with high smartphone usage.
• Customer Support: Responding to your queries, resolving disputes, and maintaining a record of communications for quality assurance and evidence purposes.
• Responsible Gaming: Monitoring betting patterns for indicators of problem gambling behaviour and, where appropriate, proactively contacting players or applying account restrictions under our Responsible Gaming programme.
• Marketing & Promotions: Where you have opted in to marketing communications, sending you personalised promotional offers by email or platform notification — including seasonal promotions tied to Ramadhan, Idul Fitri, Chinese New Year (Imlek), and other occasions relevant to the Indonesian market. You may withdraw marketing consent at any time.

6.1 Contractual Necessity. Most processing activities — including account management, identity verification, and payment processing — are necessary for bos67 to perform its contractual obligations to you under the Terms & Conditions you accepted upon registration. Without processing this data, bos67 cannot provide the platform services.

6.2 Legitimate Interests. Processing for fraud prevention, security monitoring, anti-abuse measures, and aggregated platform analytics is carried out on the basis of bos67's legitimate business interest in operating a safe, compliant, and commercially viable platform. These interests are balanced against your privacy interests and do not override your fundamental rights.

6.3 Legal Obligation. KYC verification, sanctions screening, and certain record-retention activities are carried out to comply with anti-money-laundering regulations and the requirements of bos67's offshore licensing authority.

6.4 Consent. Processing for direct marketing purposes is carried out solely on the basis of your freely given, specific, and informed consent at the time of registration or via subsequent opt-in. You may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw marketing consent, contact [email protected] or update your preferences in your account settings.

bos67 does not sell your personal data. We share personal data with third parties only in the circumstances described below, and only to the minimum extent necessary for each stated purpose.

• Payment Processors: Indonesian bank payment gateways and e-wallet operators (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja) receive the account holder name and account identifier required to process your transaction. These entities operate under their own privacy policies and regulatory obligations.
• KYC & Identity Verification Providers: Third-party identity verification service providers may process your KTP data and selfie photograph for the purposes of confirming your identity and screening against sanctions and politically exposed person (PEP) lists.
• Game Content Providers: Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Pocket Games Soft, Spribe, and other integrated providers receive a pseudonymised player session identifier for the purpose of delivering game content and settling game outcomes. These providers do not receive your full name, contact details, or payment information.
• Cloud & Infrastructure Providers: bos67 uses cloud hosting infrastructure providers to store platform data. These providers act as Data Processors under written agreements that require them to process data only on bos67's instructions and to maintain appropriate security standards.
• Anti-Fraud & Compliance Services: Specialist fraud detection and AML compliance service providers may process transaction and behavioural data to generate risk assessments. These providers do not retain or independently use the data beyond the scope of the service.
• Competent Authorities: bos67 may disclose personal data to law enforcement agencies, regulatory authorities, or courts if required to do so by a legally binding order, subpoena, or equivalent requirement from a competent authority with legitimate jurisdiction over bos67 or its players.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or substantially all of bos67's assets, personal data held on registered players may be transferred to the successor entity, subject to that entity honouring the obligations set out in this Privacy Policy.

In all cases where bos67 shares data with a third-party Data Processor, we require that processor to maintain confidentiality obligations and security standards commensurate with those applied by bos67 itself.

8.1 Cross-Border Processing. As an offshore international platform, bos67 may process and store personal data on servers located outside Indonesia. By registering a bos67 account, you acknowledge that your personal data may be transferred to and stored in jurisdictions that may not provide the same level of data protection as Indonesian law.

8.2 Transfer Safeguards. Where personal data is transferred to third-party processors in other jurisdictions, bos67 requires those processors to maintain data security standards and confidentiality obligations that provide a level of protection substantially equivalent to the protections afforded under this Privacy Policy. Such requirements are enforced through contractual data processing agreements.

8.3 Acknowledgement. By continuing to use the bos67 platform, you consent to the international transfer of your personal data as described in this clause, subject always to the safeguards and data rights described in this Privacy Policy.

9.1 Active Accounts. Personal data associated with your active bos67 account is retained for the duration of your account's existence and for a minimum period of five years following permanent account closure. This retention period is necessary to satisfy anti-money-laundering record-keeping requirements, to resolve any outstanding disputes, and to comply with the obligations of bos67's offshore licensing authority.

9.2 KYC Documents. Identity verification documents — including KTP scans and selfie photographs — are retained for a minimum of five years from the date of submission or the date of account closure, whichever is later. After the applicable retention period, these documents are securely deleted using industry-standard data destruction methods.

9.3 Transaction Records. Financial transaction records (deposits, withdrawals, and bet history) are retained for a minimum of seven years from the date of the transaction to satisfy financial record-keeping and AML compliance requirements.

9.4 Marketing Data. Where you have consented to marketing communications, your marketing preferences are retained until you withdraw consent. Upon withdrawal of consent, your data will be removed from active marketing lists within 30 days, although it may be retained in suppression lists to ensure you are not inadvertently re-contacted.

9.5 Technical Logs. Server logs, session data, and IP address records are retained for a period of 90 days for security and fraud investigation purposes, after which they are automatically purged or anonymised.

10.1 What Are Cookies. Cookies are small text files that are placed on your device (computer, smartphone, or tablet) by the bos67 platform when you visit the site. They allow the platform to remember your session, maintain your login state, and collect aggregated information about how the platform is used.

10.2 Types of Cookies Used. bos67 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in during a browsing session and security cookies that help detect and prevent fraudulent access. These cookies cannot be disabled without breaking core platform functionality.
• Performance & Analytics Cookies: Collect anonymised, aggregated data about how players navigate the platform — which pages are visited most frequently, how long sessions last, and which features are used most. This data is used solely to improve platform performance and user experience. No individual player is identified through these cookies.
• Preference Cookies: Remember your platform preferences, such as display language or game category selections, so that your experience is consistent across sessions.

10.3 What We Do Not Use. bos67 does not deploy third-party advertising cookies, social media tracking pixels, or behavioural retargeting technologies on the bos67.pro platform. You will not be tracked across third-party websites as a result of visiting bos67.pro.

10.4 Managing Cookies. You may configure your browser to refuse all cookies or to alert you when a cookie is being set. Please note that disabling strictly necessary cookies will prevent you from logging into your bos67 account and accessing core platform features. Detailed instructions for managing cookies in popular browsers (Chrome, Firefox, Safari, Samsung Internet — all widely used by Indonesian players) are available through your browser's help documentation.

10.5 Consent to Cookies. By continuing to browse and use the bos67 platform after having had the opportunity to review this Privacy Policy, you consent to the placement of the cookies described above on your device. You may withdraw consent at any time by clearing your browser cookies and adjusting your browser settings as described in Clause 10.4.

bos67 respects your rights over your personal data. The following rights are available to all registered players. To exercise any right, submit a written request to [email protected] with the subject line "Privacy Request — [Right Type]" and include your registered username and email address for verification. bos67 will respond to all verifiable privacy requests within 30 calendar days.

• Right of Access: You may request a copy of all personal data bos67 holds about you, along with information about how it is being processed, who it has been shared with, and how long it will be retained.
• Right to Rectification: If any personal data bos67 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and no other legal basis applies, or where the data has been unlawfully processed. This right is subject to overriding legal and regulatory retention obligations described in Clause 9.
• Right to Restriction of Processing: You may request that bos67 restrict the processing of your data — meaning we store it but do not actively use it — while a rectification or objection request is being evaluated.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that bos67 provide your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including profiling for responsible gaming assessments, where you believe your individual circumstances override bos67's legitimate interests.
• Right to Withdraw Consent: Where processing is based solely on your consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Please note that some rights may be limited where bos67 has overriding legal obligations — for example, we cannot erase financial transaction records that we are required to retain under AML regulations, nor can we delete KYC documentation before the mandatory retention period has elapsed.

12.1 Technical Measures. bos67 implements a comprehensive set of technical security measures to protect your personal data from unauthorised access, accidental loss, alteration, or disclosure. These include: 256-bit TLS/SSL encryption for all data in transit; AES-256 encryption for data at rest; one-way cryptographic hashing for all stored passwords; network-level firewall and intrusion detection systems; regular penetration testing and vulnerability assessments of the platform infrastructure.

12.2 Organisational Measures. Access to personal data within bos67's organisation is restricted to authorised personnel on a strict need-to-know basis. All staff with access to player data are subject to binding confidentiality obligations and receive regular training on data protection best practices. Access rights are reviewed periodically and revoked promptly when no longer required.

12.3 Data Breach Response. In the event of a personal data breach that poses a risk to the rights and freedoms of affected players, bos67 will notify affected players without undue delay — and in any event within 72 hours of becoming aware of the breach — via the email address registered on their account, providing clear information about the nature of the breach, the data involved, and the steps bos67 is taking in response.

12.4 Player Responsibility. You are responsible for maintaining the security of your own bos67 account credentials. bos67 strongly recommends using a unique, strong password for your bos67 account and enabling any available two-factor authentication features. If you believe your account has been compromised, notify bos67 immediately at [email protected] or via Live Chat.

13.1 21+ Only. The bos67 platform is strictly intended for adults aged 21 and over. bos67 does not knowingly collect or process personal data from individuals under the age of 21. If bos67 becomes aware that personal data has been collected from a person under 21, that account will be immediately suspended, all associated funds will be placed on hold pending investigation, and the data will be deleted as soon as practicable in accordance with applicable data protection and regulatory requirements.

13.2 Parental Responsibility. If you share a device with individuals under 21 years of age, you are responsible for ensuring that those individuals cannot access your bos67 account or the bos67.pro website. bos67 recommends using device-level parental control software in households where minors are present. If you suspect that a minor has accessed the bos67 platform using your account, notify our support team immediately.

13.3 Age Verification Data. Date of birth and KYC identity documents are processed specifically to verify that each registered player meets the 21+ age requirement. This data is treated with the highest level of security and is retained only for the periods described in Clause 9 of this Privacy Policy.

14.1 Right to Update. bos67 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, our data processing practices, or the features and services offered on the platform. The most current version of this Privacy Policy is always accessible at https://bos67.pro/privacy-policy.

14.2 Notification of Material Changes. Where an amendment constitutes a material change to how bos67 processes your personal data — particularly any change that expands the categories of data collected, introduces new third-party sharing arrangements, or affects your privacy rights — bos67 will notify registered players via email to the address on file at least 14 calendar days before the change takes effect.

14.3 Continued Use. Your continued use of the bos67 platform following the effective date of any amended Privacy Policy constitutes your acknowledgement and acceptance of the updated terms. If you do not agree to the amended Privacy Policy, you must cease using the platform and request account closure in accordance with Clause 11.2 of the bos67 Terms & Conditions.

For all privacy-related queries, data subject access requests, or complaints regarding bos67's data processing practices, please contact our support and compliance team through any of the channels below. bos67 is committed to acknowledging all formal privacy complaints within 5 business days and resolving them within 30 calendar days where possible.

If you are dissatisfied with bos67's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection or gambling regulatory authority in the jurisdiction applicable to your complaint. bos67 will cooperate fully with any such regulatory inquiry.