Privacy Policy

The following defined terms are used throughout this Privacy Policy:

• "bos128," "We," "Us," or "Our" — the operator of the Platform at https://bos128.cam, acting as data controller in respect of personal data collected from users.
• "Platform" — the bos128 website, including all pages, features, services, and associated communication channels.
• "User," "You," or "Your" — any natural person who accesses, browses, registers on, or otherwise interacts with the Platform.
• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to names, contact details, financial information, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "KYC Data" — identity documents, photographs, and supporting materials submitted for the purpose of Know Your Customer (identity and age) verification.
• "Cookies" — small text files placed on your device by the Platform to enable functionality, analytics, and personalization features.
• "Third-Party Processors" — companies engaged by bos128 under contractual data-processing agreements to perform specific services on our behalf, such as payment processing and KYC verification.

This Privacy Policy applies to all Personal Data processed by bos128 in connection with the operation of the Platform, including data collected from:

• Users who browse the Platform without registering an account.
• Users who complete account registration and KYC verification.
• Registered users who make deposits, place wagers, or withdraw funds.
• Any individual who contacts bos128 customer support via live chat, WhatsApp, or email.

bos128 acts as the data controller for all Personal Data collected through the Platform. This means we determine the purposes and means of Processing and are responsible for ensuring that Processing is conducted lawfully, fairly, and transparently. Where bos128 engages Third-Party Processors, those parties act only on our documented instructions and are bound by contractual data-protection obligations.

bos128 collects the following categories of Personal Data:

We do not intentionally collect special-category data (such as health data, racial or ethnic origin, or religious beliefs) unless directly relevant to a responsible gaming assessment you have initiated. We do not collect payment card numbers — all card-based transactions, if applicable, are handled exclusively by our PCI-DSS-compliant payment processor and bos128 never receives or stores the full card number.

bos128 collects Personal Data through the following means:

• Direct submission: Information you provide when creating an account, completing KYC, making a deposit or withdrawal, or contacting our support team.
• Automated technologies: Cookies, web beacons, pixel tags, and server logs that collect Technical Data and Usage Data automatically as you interact with the Platform. See Section 6 for full details on our cookie practices.
• Payment processors: Transaction confirmation data received from BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, and LinkAja in order to reconcile deposits and process withdrawals accurately.
• KYC verification partners: Identity verification outcomes and fraud-risk scores returned by our licensed third-party KYC providers following document review.
• Fraud-prevention and analytics services: Aggregated or pseudonymized behavioral signals used to detect unauthorized access, bonus abuse, and multi-accounting.

bos128 processes your Personal Data only where we have a lawful basis to do so. The table below summarizes our primary Processing purposes and the corresponding legal basis for each:

Where we rely on legitimate interests as a legal basis, we have assessed that our interests are not overridden by your interests or fundamental rights. You may contact us to request details of any such balancing assessment.

bos128 uses cookies and similar tracking technologies to ensure the Platform functions correctly, to analyze usage patterns, and to personalize your experience. The types of cookies we use are described below:

• Strictly Necessary Cookies: Essential for the Platform to operate. These include session cookies that maintain your login state and security tokens. These cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your preferences (such as language settings and notification options) to enhance your experience across sessions.
• Analytics Cookies: Collect aggregated, pseudonymized data about how users navigate the Platform — pages visited, click paths, session duration — to help us improve performance and usability.
• Security Cookies: Detect and mitigate fraudulent activity, including bot traffic, credential-stuffing attacks, and session hijacking attempts.

You can manage or disable non-essential cookies through your browser settings at any time. Please note that disabling functional or analytics cookies may affect your experience on the Platform. bos128 does not use third-party advertising cookies or behavioral retargeting trackers.

bos128 does not sell, rent, or trade your Personal Data. We share your data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Processors: We share your name, bank account details, and transaction amounts with our licensed payment partners (including processors supporting BCA, BRI, BNI, Mandiri, and Indonesian e-wallets) solely to execute and reconcile your financial transactions.
• KYC & Identity Verification Providers: Your Identity Data and KYC Documents are shared with contracted third-party verification services to confirm your identity and age. These providers operate under strict data-processing agreements and are prohibited from using your data for any purpose other than verification.
• Fraud Prevention Services: Pseudonymized Technical and Usage Data may be shared with fraud-detection partners to identify and prevent unauthorized access, multi-accounting, and financial crime.
• Regulatory & Law Enforcement Authorities: We will disclose Personal Data to competent authorities — including financial regulators, tax authorities, law enforcement agencies, and courts — when required to do so by a valid legal order, warrant, or regulatory obligation. We will notify you of such disclosure where permitted by law.
• Business Transfers: In the event that bos128 undergoes a merger, acquisition, or sale of all or substantially all of its assets, your Personal Data may be transferred to the acquiring entity as part of that transaction. You will be notified in advance of any such transfer and of any changes to the applicable privacy terms.
• Professional Advisors: Lawyers, auditors, and compliance consultants may access Personal Data on a strictly need-to-know basis when providing professional services to bos128, subject to professional confidentiality obligations.

All Third-Party Processors engaged by bos128 are required to implement data-protection standards no less stringent than those described in this Privacy Policy and are contractually prohibited from using your data for their own purposes.

bos128 operates on an internationally regulated basis and may store or process your Personal Data on servers located outside of Indonesia. Where data is transferred to countries that may not provide the same level of data protection as Indonesia, we take appropriate safeguards to ensure your data remains protected, including:

• Entering into data-processing agreements with Third-Party Processors that incorporate internationally recognized standard contractual clauses.
• Verifying that recipient countries or organizations have adequate data-protection frameworks in place.
• Applying encryption and access controls to all data in transit and at rest, regardless of the storage location.

By using the bos128 Platform, you acknowledge and consent to the transfer of your Personal Data to servers and processors located in jurisdictions outside Indonesia where this is necessary for the operation of our services.

bos128 retains your Personal Data only for as long as is necessary to fulfill the purpose for which it was collected, or to meet our legal and regulatory obligations. Our standard retention periods are as follows:

When data is no longer required for any lawful purpose, we securely delete or irreversibly anonymize it. Anonymized and aggregated data (from which you cannot be identified) may be retained indefinitely for statistical analysis and Platform improvement.

bos128 implements a comprehensive, layered security framework to protect your Personal Data against unauthorized access, accidental loss, alteration, and disclosure. Our key technical and organizational measures include:

• Transport Encryption: All data in transit is protected by 256-bit SSL/TLS encryption. Our Platform enforces HTTPS exclusively; unencrypted HTTP connections are automatically redirected.
• At-Rest Encryption: Databases containing Personal Data and KYC Documents are encrypted at rest using AES-256 encryption.
• Access Controls: Internal access to Personal Data is restricted on a strict need-to-know basis using role-based access controls (RBAC). All staff with data access undergo background checks and regular security training.
• Two-Factor Authentication: Privileged internal accounts require two-factor authentication (2FA) for all access. We strongly encourage users to enable 2FA on their own bos128 accounts as well.
• Intrusion Detection & Monitoring: Our infrastructure is monitored 24/7 by automated intrusion-detection systems. Anomalous access patterns trigger immediate security alerts and investigation.
• Regular Security Audits: We conduct periodic penetration testing and vulnerability assessments of our Platform and infrastructure, with findings remediated promptly.
• Data Breach Response: In the event of a confirmed data breach that poses a risk to your rights, bos128 will notify affected users and relevant authorities within the timeframes required by applicable law.

Subject to applicable law and our legitimate regulatory obligations, you have the following rights with respect to your Personal Data held by bos128:

• Right of Access: You may request a copy of the Personal Data we hold about you, together with information about how it is being processed.
• Right of Rectification: You may request that inaccurate or incomplete Personal Data be corrected or updated without undue delay.
• Right to Erasure: You may request the deletion of your Personal Data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where Processing is unlawful. Note that certain data must be retained to meet our legal and regulatory obligations even after an account is closed.
• Right to Restrict Processing: You may request that we temporarily restrict the Processing of your Personal Data in certain circumstances — for example, while a correction request is being verified.
• Right to Data Portability: Where Processing is based on your consent or on contract performance, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to Processing based on legitimate interests at any time. You have an absolute right to object to Processing for direct marketing purposes, and we will cease such Processing immediately upon receiving your objection.
• Right to Withdraw Consent: Where Processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of Processing carried out before withdrawal.

To exercise any of the above rights, please contact our Data Protection team at [email protected] (plain text — not a clickable link). We will acknowledge your request within 3 business days and aim to fulfill it within 30 calendar days. Complex requests may take up to 60 days; we will notify you if an extension is required.

We may need to verify your identity before processing a data rights request. This is to protect your data from unauthorized disclosure to third parties claiming to act on your behalf.

If you are a parent or guardian and you believe that a minor under your care has registered on bos128 or submitted personal data to us without your knowledge, please contact our support team immediately at [email protected] (plain text only). We will investigate and take appropriate action promptly.

The bos128 Platform does not contain links to third-party websites, social media platforms, or external services that are outside our control. In the event that any such link appears on the Platform in the future, this Privacy Policy will not apply to those external sites. We encourage you to review the privacy policies of any website you visit independently of bos128. We accept no responsibility or liability for the privacy practices of any third-party website.

bos128 reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, Platform functionality, or applicable legal requirements. When material changes are made, we will notify registered users via email and/or a prominent notice on the Platform at least 7 days before the revised policy takes effect.

The current version of this Privacy Policy, together with the effective date, is always published on this page. We recommend reviewing this page periodically to stay informed about how we protect your Personal Data. Your continued use of the Platform after the effective date of any revision constitutes your acceptance of the updated policy.

The version of this Privacy Policy dated 1 January 2026 supersedes all previous versions.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way bos128 handles your Personal Data, please contact our Data Protection team:

• Email: [email protected] (plain text — not a clickable link)
• Response time: We aim to acknowledge all privacy-related inquiries within 3 business days and to provide a substantive response within 30 calendar days.
• Support availability: 24/7 via live chat on the Platform, including Indonesian public holidays. Our team includes native Indonesian-speaking agents for users who prefer to communicate in Bahasa Indonesia, even though the Platform itself is operated in English.

If you are not satisfied with our response to your complaint, you have the right to escalate your concern to the relevant data-protection authority or gaming regulatory body in the jurisdiction governing our license. Details of the applicable authority will be provided upon request.

For responsible gaming concerns — including requests for self-exclusion, deposit limits, or guidance on problem gambling — please visit our dedicated Responsible Gaming page or contact support directly. For a full overview of the rules governing your account and use of bos128, please refer to our Terms & Conditions.