Boss8 Privacy Policy – Our Commitment to Protecting Malaysian Members' Data

Introduction – boss8's Privacy Commitment

This Privacy Policy explains how boss8 ("we", "the Platform") collects, uses, stores, and protects your personal information when you register for and use boss8's services at boss8.pro. This covers all activity on the platform — from account registration and deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, through to Sports Betting, Live Casino games, and promotion claims.

At boss8, privacy is more than a legal obligation — it is a core value that reflects the respect we have for the trust each member places in us when they share their personal information. We take that trust seriously, because we know that without it, the boss8 platform loses its very foundation.

This Privacy Policy is written to comply with Malaysia's Personal Data Protection Act 2010 (PDPA 2010) and internationally recognised data protection principles. If at any point you feel that boss8 is not complying with this policy, please contact us directly via 24/7 live chat or email at support@boss8.pro and we will investigate and address your concerns promptly.

Personal Data We Collect

Boss8 collects several categories of personal data from our members for various purposes. The table below provides a clear overview of the types of data collected and at which stage they are gathered:

Boss8 does not collect sensitive data such as medical information, religious beliefs or political views of our members. We also do not require identity card or passport numbers except in specific identity verification situations mandated by anti-money laundering laws. In such cases, the relevant documents are processed securely and not retained longer than necessary.

How We Use Your Data

Personal data collected by boss8 is used solely for legitimate, clearly stated purposes. boss8 will not use your data for anything unrelated to the provision of our online betting and casino services without first obtaining your consent. The purposes for which data is used are as follows:

• Account management – Creating, verifying and managing your boss8 account, including secure login and identity verification
• Transaction Processing – Securely and accurately processes deposits via Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow, or FPX, as well as winnings withdrawals in MYR
• Service Provision – Enables you to access all features of the boss8 platform, including Sports Betting, baccarat, blackjack, live poker, slots, and promotion claims
• Fraud prevention – Identifies and prevents fraudulent activity, money laundering, duplicate accounts, and bonus abuse using activity and technical data
• Legal compliance – To fulfil legal obligations under PDPA 2010 and other applicable laws governing boss8's operations
• Service communications – Sends important notifications about your account, service changes, promotions you are eligible to claim, and security updates
• Platform Improvement – Uses anonymised aggregate data to understand how members use the platform, enabling us to continuously improve the user experience
• Customer Support – To process and resolve enquiries, complaints, and disputes submitted to the boss8 support team

Boss8 operates on a "purpose limitation" principle — meaning data collected for one purpose will not be used for a different purpose without your explicit consent. Whenever we wish to use your data for a new purpose not covered in this policy, we will notify you and obtain the necessary consent beforehand.

Third-Party Data Sharing & Disclosure

Boss8 does not sell, rent, or disclose members' personal data to any third party for marketing purposes. This is an absolute commitment on our part. However, there are limited situations in which boss8 needs to share member data with specific third parties to keep the platform running properly and to comply with the law:

• Payment processors – Payment service providers such as Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, and DuitNow operators, as well as banks offering FPX services, receive the transaction information necessary to process your deposits and withdrawals. These processors are bound by strict confidentiality agreements with boss8.
• Technology service providers – Companies providing technical services to boss8 such as secure server hosting, fraud detection systems and customer support platforms. All such providers are subject to data processing agreements that require them to protect boss8 member data to a standard consistent with this policy.
• Regulatory bodies and law enforcement agencies – boss8 will disclose data when required to do so by a valid court order, direction from a competent authority, or other legal obligation. In all such cases, boss8 will disclose only the minimum data necessary to satisfy the relevant legal requirement.
• Independent Audit – Independent audit firms conducting RNG system audits and operational compliance checks for boss8 may have limited access to anonymised game activity data for technical verification purposes. These firms are bound by strict confidentiality agreements.

In all cases of data sharing outlined above, boss8 ensures that only the minimum data necessary for the relevant purpose is shared. We do not grant any third party broader access than required. A list of key third parties with access to boss8 member data is available upon request through our customer support.

Cookies & Tracking Technologies

Boss8 uses cookies and similar tracking technologies to ensure the platform functions properly and to deliver a better experience for members. Cookies are small text files stored in your web browser when you visit the boss8 website. The following are the types of cookies we use:

• Essential Cookies (Required) – Required for core platform functions such as maintaining your login session, transaction security and basic navigation. These cookies cannot be disabled as they are integral to how the boss8 platform operates.
• Preference Cookies – To save your preferences such as display language, display settings, and other choices so you don't have to reconfigure them each time you log in to your boss8 account
• Analytics Cookies – Collects anonymous data on how members use the boss8 platform – which pages are visited most often, how long users spend on the platform, and general navigation patterns. This data helps us continuously improve the platform. These cookies can be disabled in your browser settings without affecting the platform's core functionality
• Security Cookies – Helps our systems identify suspicious login activity and protect your account from unauthorised access

You can manage cookies through your web browser settings. Most browsers allow you to view, manage and delete cookies. Please note that disabling essential cookies may affect the functionality of the boss8 platform and you may be unable to log in or make transactions. For guidance on managing cookies in your browser, please refer to your browser's help section.

Boss8 Data Security Measures

Boss8 invests seriously in the security of our members' data. Data protection is not simply a compliance checkbox — it is built into the core infrastructure of our platform. The key security measures we have in place are as follows:

• 256-bit SSL Encryption – All communications between your device and boss8 servers are encrypted using the latest TLS protocol with 256-bit key strength. This is the same standard used by Malaysia's leading banking institutions, including Maybank and CIMB, to protect their customers' online transactions.
• Secure Password Storage – boss8 account passwords are never stored in plain text. We use industry-recognised one-way hashing algorithms with a unique salt for each account. This means that even if our data were accessed by an unauthorised party, your password would remain unreadable
• Two-factor authentication (2FA) – Two-factor authentication is available to all boss8 members as an additional security layer for logins and withdrawals. We strongly encourage all members to enable 2FA for maximum account protection
• Database segregation – Members' personal data is stored in databases that are separate from game and operational data. Access to each database is restricted to staff who require it to carry out their specific duties only
• Continuous monitoring – Our systems are monitored 24/7 to detect any unusual or suspicious activity. Any security alerts are promptly reviewed by our technical security team.
• Regular penetration testing – boss8 conducts regular penetration testing using independent security specialists to identify and address any vulnerabilities before they can be exploited

While we take all reasonable steps to protect your data, no system can be guaranteed 100% secure against every cyber threat. In the event of a data breach affecting boss8 members, we are committed to notifying affected members within the timeframe stipulated by the PDPA 2010 and to taking appropriate remedial action promptly.

Data Retention & Transfer

Boss8 retains members' personal data for as long as necessary for the purposes stated in this policy, or for as long as required by applicable law. Generally, active account data is retained for the duration of the active account period plus 5 years following account closure, in order to meet legal requirements relating to anti-money laundering and financial record retention.

Once the required retention period has ended, boss8 will securely delete or anonymise your personal data in a way that is irreversible. We will not retain your data longer than necessary simply for convenience or commercial gain.

Regarding international data transfers – boss8's servers may be located outside Malaysia. In such cases, boss8 ensures that all data transfers outside Malaysia are carried out with protections equivalent to or exceeding the standards set by PDPA 2010. This includes the use of standard data transfer agreements, data protection assessments of recipient countries, and additional technical safeguards where necessary. You can find out more about our data processing locations by contacting boss8 customer support.

Your Rights Under PDPA 2010

As a boss8 member whose personal data is processed by us, you hold certain rights under Malaysia's Personal Data Protection Act 2010. boss8 fully respects these rights and provides straightforward ways for you to exercise them. Your key rights are as follows:

• Right to Access – You have the right to request a copy of the personal data we hold about you. We will provide this within 21 days of receiving a valid request
• Right to Rectification – If any personal data we hold about you is inaccurate, outdated or incomplete, you have the right to request a correction. You can update most profile information directly in your boss8 account settings.
• Right to object – You have the right to object to the processing of your data for direct marketing purposes at any time. Once we receive your objection, we will immediately cease using your data for that purpose.
• Right to Restrict Processing – In certain circumstances, you may request that we restrict how we use your data while a particular issue or query is being resolved
• Right to withdraw consent – Where the processing of your data is based on your consent, you have the right to withdraw that consent at any time. This will not affect the validity of any processing carried out prior to the withdrawal

To exercise any of the rights above, please contact the boss8 privacy team by email at support@boss8.pro, stating your request type and relevant account details. We will process your request within the timeframe stipulated by PDPA 2010 and inform you of the action taken.

Children's Data Protection

Boss8's services are not intended for individuals under the age of 18. boss8 does not knowingly collect or process the personal data of anyone under 18. Every boss8 account registration process requires confirmation that the user is at least 18 years of age.

If boss8 discovers that personal data belonging to an individual under 18 years of age has been collected without our knowledge – whether through age falsification during registration or by any other means – we will take immediate steps to delete that data and close the account in question. Parents or guardians who believe their child may have registered a boss8 account are encouraged to contact us promptly at support@boss8.pro so that we can take the appropriate action.

Changes to This Privacy Policy

Boss8 reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or service improvements. When we make material changes to this policy, we will take the following steps to notify our members:

• Updating the "Last Updated" date at the top of this page
• Displaying notifications within the boss8 platform to all active members
• Sending an email to active members with verified email addresses when changes are significant

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Continued use of the boss8 platform after any changes to the Privacy Policy take effect will be deemed acceptance of the updated terms. If you do not agree with the changes made, you have the right to close your account and request deletion of your data in accordance with the procedures outlined in Section 8.

Previous versions of this Privacy Policy are available to members upon request through boss8 customer support. We maintain a record of each version along with its effective date, as part of our commitment to transparency and accountability in how we handle member data.