boss67 Privacy Policy

In this Privacy Policy, the following terms carry the meanings defined below.

This Privacy Policy applies to all personal data collected by boss67 in connection with your use of the boss67 platform, including the website at boss67.app, any mobile-browser interface, and all related services, communications, and customer support interactions.

boss67 acts as the data controller in respect of the personal data collected from players. As data controller, boss67 determines the purposes and means by which your personal data is processed. Certain processing activities are carried out by Service Providers acting as data processors on boss67's behalf, under contractual data processing agreements that require them to handle your data only in accordance with boss67's instructions.

This policy is addressed primarily to individuals located in Indonesia. If you are accessing boss67 from a jurisdiction other than Indonesia, you should be aware that data handling practices may be subject to different legal frameworks in your country of residence.

boss67 collects the following categories of personal data, depending on the nature of your interaction with the platform:

boss67 does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, except where specifically required by applicable law or where you voluntarily provide such information in a support context (e.g., disclosing a medical condition in connection with a responsible gaming request).

boss67 collects personal data through the following channels:

• Direct provision by you: Information you enter during account registration, KYC verification, deposit and withdrawal requests, promotional opt-ins, and communications with customer support.
• Automated collection: Technical and usage data collected automatically when you access the boss67 platform, via server logs, session cookies, and analytics tools.
• Third-party sources: Identity verification results from KYC service providers; fraud-risk signals from fraud detection partners; payment confirmation data from banking and e-wallet payment processors (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja).

boss67 processes your personal data only where there is a legitimate legal basis for doing so. The primary purposes and their corresponding legal bases are set out below:

• Account creation and management: Processing is necessary for the performance of the contract between you and boss67 (the Terms & Conditions you accepted at registration).
• Payment processing — deposits and withdrawals: Necessary for the performance of the contract, and to comply with anti-money-laundering and financial record-keeping obligations.
• Identity and age verification (KYC): Necessary to comply with legal obligations, including the enforcement of the 21+ age restriction and applicable anti-money-laundering requirements.
• Fraud prevention and security: Necessary for the legitimate interests of boss67 and its players — specifically, to protect the platform against unauthorized access, fraudulent transactions, and abuse.
• Customer support: Necessary for the performance of the contract, and to pursue the legitimate interest of resolving player issues efficiently.
• Platform analytics and improvement: Pursued on the basis of boss67's legitimate interests in understanding how the platform is used and improving the player experience. Where analytics rely on cookies, your consent is sought in accordance with clause 8.
• Promotional and marketing communications: Where you have opted in to receive promotional emails or notifications, processing is based on your explicit consent. You may withdraw consent at any time by contacting support or updating your notification preferences.
• Responsible gaming monitoring: Necessary for compliance with responsible gaming obligations and for the legitimate interest of protecting players from gambling-related harm.

boss67 does not sell, rent, or commercially trade your personal data. We may share your personal data with the following categories of recipients where strictly necessary:

• Payment processors: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the financial data necessary to process your deposits and withdrawals. These entities operate under their own privacy policies and applicable Indonesian financial regulations.
• KYC and identity verification providers: Third-party identity verification services that process your KYC documents on boss67's behalf under data processing agreements.
• Fraud detection and risk management providers: Services that analyze transaction patterns and behavioral signals to identify and prevent fraudulent activity. These providers act as data processors under contractual controls.
• Game content providers: Game studios (including Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, Spribe, and others) may receive your Player ID and session data to facilitate game session delivery. These providers do not receive your full identity or financial data.
• Cloud infrastructure and hosting providers: Entities providing server infrastructure, database hosting, and content delivery network services on which the boss67 platform operates.
• Legal and regulatory authorities: Where required by law, court order, or a lawful request from a competent authority, boss67 may disclose personal data to law enforcement agencies, financial intelligence units, or other regulatory bodies.
• Professional advisers: Legal counsel, auditors, and other professional advisers who are bound by confidentiality obligations and who receive personal data only to the extent necessary to provide their services.

All Service Providers who process personal data on boss67's behalf are required to maintain appropriate technical and organizational security measures and to process data only in accordance with boss67's documented instructions.

Some of the Service Providers engaged by boss67 operate infrastructure or processing facilities in countries outside Indonesia. When personal data is transferred to a country that does not provide an equivalent level of data protection, boss67 implements appropriate safeguards, which may include:

• Standard contractual clauses approved by recognized data protection authorities, incorporated into data processing agreements with the relevant Service Provider.
• Contractual obligations requiring the recipient to apply data security standards equivalent to those applied by boss67.
• Where applicable, reliance on adequacy decisions or equivalent recognized transfer mechanisms for the destination country.

By creating a boss67 account and using the platform, you acknowledge that your personal data may be transferred to, stored, and processed in countries outside Indonesia in the circumstances described in this clause, subject to the safeguards above.

The boss67 platform uses cookies and similar tracking technologies to support platform functionality, maintain your session, and collect analytics data. The following categories of cookies are used:

• Strictly necessary cookies: Required for the platform to function correctly, including maintaining your login session, storing your language and currency preferences, and securing the cashier process. These cookies cannot be disabled without impairing platform functionality.
• Functional cookies: Remember your preferences (e.g., last-viewed game category, preferred payment method) to provide a more personalized experience on subsequent visits.
• Analytics cookies: Collect aggregated, anonymized data about how players interact with the boss67 platform — pages visited, session duration, game category engagement — to inform platform improvements. Analytics cookies are deployed only with your consent.
• Fraud-prevention cookies: Support the detection of suspicious session behavior and unauthorized login attempts. These are deployed as part of boss67's security infrastructure.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the boss67 platform. Disabling analytics cookies will not affect your ability to bet or access games.

boss67 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law or regulation. The general retention principles applied by boss67 are:

• Account data and transaction records: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in accordance with anti-money-laundering record-keeping requirements.
• KYC documents: Retained for a minimum of five (5) years from the date of the KYC check, or five (5) years from the end of the account relationship, whichever is later.
• Customer support communications: Retained for three (3) years following the resolution of the relevant support interaction, or until the account is closed, whichever is later.
• Technical and usage logs: Retained for up to twelve (12) months, then aggregated and anonymized for analytics purposes or deleted.
• Marketing consent records: Retained for as long as you remain opted in, plus a period of two (2) years after withdrawal of consent for audit purposes.

At the end of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be used to identify you.

As a player whose personal data is processed by boss67, you hold the following rights in respect of that data. To exercise any of these rights, contact the boss67 support team as described in clause 15.

boss67 will respond to data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case boss67 will notify you of the extension and the reason for it within the initial 30-day window.

Please note that certain rights may be limited where the requested processing is necessary to comply with a legal obligation — for example, AML record-keeping requirements that mandate retention of transaction data regardless of a deletion request.

The boss67 platform is strictly intended for adults aged 21 and over. boss67 does not knowingly collect personal data from any individual under the age of 21. If you are under 21, you must not use the boss67 platform, create an account, or provide any personal data to boss67.

If boss67 becomes aware that personal data has been collected from an individual under 21, that data will be deleted without delay and the associated account will be closed immediately. If you have reason to believe that a minor has registered or is using a boss67 account, please contact our support team immediately so that the matter can be investigated and resolved.

boss67 implements a layered set of technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and boss67 servers.
• Encryption at rest for sensitive stored personal data, including financial data and KYC documents.
• Access controls limiting access to personal data to authorized personnel on a strict need-to-know basis, with role-based access management and multi-factor authentication for internal systems.
• Brute-force login protection and anomalous session detection to identify and block unauthorized account access attempts.
• Penetration testing and security audits conducted periodically to identify and remediate vulnerabilities in the platform infrastructure.
• Incident response procedures ensuring that confirmed security incidents are contained, investigated, and communicated to affected players without undue delay.

While boss67 takes data security seriously and maintains robust protective measures, no digital platform can guarantee absolute security. You are also responsible for maintaining the security of your own account credentials — see clause 5 of the boss67 Terms & Conditions for your obligations in this regard.

The boss67 platform may contain references to third-party services — including game providers, payment processors, and sports data feeds — that operate under their own privacy policies. boss67 is not responsible for the privacy practices of any third-party service, and this Privacy Policy does not apply to any website, application, or service that is not directly operated by boss67.

When you interact with a third-party service through the boss67 platform (for example, initiating a transfer via your BCA or OVO account), that interaction is governed by the privacy policy and terms of the third-party provider. boss67 recommends that you review the privacy policies of any third-party service you use in connection with your boss67 account.

boss67 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or platform functionality. When we make material changes, we will update the "Last Updated" date at the top of this page.

For significant changes that materially affect your rights or the way your data is processed, boss67 will use reasonable efforts to provide advance notice via the platform or to your registered email address. Your continued use of the boss67 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms.

boss67 recommends reviewing this page periodically to stay informed of how your personal data is being handled. Previous versions of this Privacy Policy are available upon request by contacting the boss67 support team.

If you have any questions about this Privacy Policy, wish to exercise a data right, or want to raise a concern about how boss67 processes your personal data, please contact us using the details below:

• Live Chat: Available 24/7 through the boss67 platform after login. Indonesian-speaking agents are available on every shift and can handle data rights requests, privacy queries, and general account inquiries.
• Email: [email protected] — please copy this address manually to your email client. Do not use any mailto link.

When submitting a data rights request by email, please include your registered username, the email address on your account, a description of the right you wish to exercise, and — where relevant — the specific data or processing activity your request relates to. boss67 may require identity verification before processing a data rights request to ensure data is not disclosed to an unauthorized party.

If you are not satisfied with boss67's response to a privacy concern, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your country of residence.