Privacy Policy — boso1

In this Policy, the following terms carry the meanings set out below unless the context clearly requires otherwise:

boso1 collects Personal Data across several categories depending on how you interact with the Platform. The table below summarises the categories of data we hold and the context in which each is collected:

boso1 collects Personal Data through three primary channels:

3.1 Data You Provide Directly. You provide Personal Data when you: register an Account (identity and contact data); complete KYC verification (identity documents and payment proofs); make a deposit or withdrawal (financial data); contact customer support via live chat or email (communications data); respond to a survey or promotional campaign (marketing preferences and feedback); or activate responsible gaming tools (responsible gaming data).

3.2 Data Collected Automatically. When you access the Platform, our servers and tracking technologies automatically capture Technical Data and Account Activity Data. This includes your IP address, the pages and games you visit, the bets you place, the duration of your sessions, and the device and browser you are using. This data collection is a standard and necessary part of operating a secure online betting platform; it enables us to detect fraud, ensure fair play, and optimise the Platform for your device and connection conditions.

3.3 Data Received from Third Parties. boso1 may receive Personal Data from the following third-party sources:

• Payment processors and banks (BCA, BRI, BNI, Mandiri, and e-wallet providers): transaction confirmation data and, where required for fraud prevention, limited account holder verification data.
• Identity verification service providers: confirmation of the authenticity of identity documents submitted during KYC, where boso1 uses an automated document-verification service.
• Game content providers (including Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, and Spribe): session and game outcome data fed back to boso1 for bet settlement, dispute resolution, and responsible gaming monitoring.
• Fraud and risk intelligence providers: device fingerprint scoring, IP reputation data, and behavioural anomaly signals used in conjunction with boso1's internal fraud detection systems.

boso1 processes your Personal Data only where we have a valid legal basis for doing so. The table below sets out our primary processing purposes and the legal basis relied upon for each:

5.1 Principle of Minimum Disclosure. boso1 shares your Personal Data with third parties only to the extent strictly necessary to operate the Platform, comply with applicable law, or protect against fraud. We do not sell, rent, or trade your Personal Data to any third party for their own marketing or commercial purposes.

5.2 Service Providers (Data Processors). boso1 engages the following categories of third-party service providers who process Personal Data on our behalf, under written data processing agreements, and solely on boso1's documented instructions:

• Payment processors: BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon, OVO, DANA, GoPay, ShopeePay, and LinkAja — for the purpose of processing deposit and withdrawal transactions denominated in IDR.
• Identity verification providers: for automated KYC document authentication and age verification.
• Game content providers: Evolution Gaming, Pragmatic Play, PG Soft (Pocket Games Soft), NetEnt, Microgaming, and Spribe — for the purpose of delivering their licensed game content and associated game-session data.
• Fraud and cybersecurity providers: for real-time fraud detection, device fingerprinting, IP reputation scoring, and DDoS protection.
• Cloud infrastructure and hosting providers: for secure storage and processing of Platform data on servers subject to appropriate physical and technical security controls.
• Customer support platform providers: for delivery of the live-chat and ticketing system through which you communicate with boso1 agents.
• Email and notification delivery providers: for sending transactional emails (account confirmations, withdrawal notifications) and, where consented, promotional communications.

5.3 Legal Disclosures. boso1 may disclose your Personal Data to law enforcement authorities, financial intelligence units, regulatory bodies, or courts if required to do so by law or legal process, or if boso1 reasonably believes that disclosure is necessary to protect the rights, property, or safety of boso1, its players, or the public. Where legally permitted, boso1 will notify you of such a disclosure request.

5.4 Corporate Transactions. In the event of a merger, acquisition, or sale of all or a substantial part of boso1's business assets, your Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent privacy protections. You will be notified of any such transfer and your rights under this Policy will be maintained.

6.1 What Are Cookies. Cookies are small text files placed on your device when you visit a website. boso1 uses cookies and similar tracking technologies (including pixel tags and local storage objects) to recognise your device, maintain your session, remember your preferences, and analyse how the Platform is used.

6.2 Categories of Cookies Used. boso1 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform. These include session authentication cookies, security tokens, and load-balancing cookies. The Platform cannot function correctly without these cookies. No consent is required for strictly necessary cookies.
• Functional Cookies: Remember your preferences such as preferred display settings, last-visited game category, and responsible gaming notification dismissals. These improve your experience but are not essential.
• Analytics Cookies: Collect anonymised data about how Players navigate the Platform — pages visited, time on page, drop-off points — to help boso1 improve the user experience. boso1 uses privacy-friendly analytics tools that anonymise IP addresses before storage.
• Fraud-Prevention and Security Cookies: Device fingerprinting and behavioural analysis tokens used by our fraud-detection systems to identify anomalous patterns that may indicate account takeover, bonus abuse, or multi-accounting.

6.3 Managing Cookies. You can control non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the Platform. Detailed instructions for managing cookies in commonly used browsers (Chrome, Firefox, Safari, and the browsers embedded in OVO, DANA, and GoPay mobile apps) are available in each browser's help documentation.

6.4 Do Not Track. boso1's Platform does not currently respond to browser-level "Do Not Track" signals, as there is no universally accepted technical standard for how such signals should be interpreted. Our Analytics Cookies section above describes the limited, anonymised manner in which we conduct Platform analytics.

7.1 General Principle. boso1 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by applicable law. When data is no longer needed, it is securely deleted or irreversibly anonymised.

7.2 Retention Periods by Category. The following retention periods apply to the main categories of data we hold:

7.3 Self-Excluded Accounts. Where an Account is permanently self-excluded, boso1 retains sufficient identity data to prevent re-registration by the same individual, in addition to the standard post-closure retention periods above. This is considered a responsible gaming safeguard and is not removable by a data deletion request.

8.1 Technical Controls. boso1 implements the following technical security measures to protect your Personal Data:

• Encryption in transit: All data exchanged between your device and boso1 servers is encrypted using TLS 1.2 or higher (256-bit). The Platform enforces HTTPS on all connections; unencrypted HTTP requests are automatically redirected.
• Encryption at rest: Sensitive data fields — including national identity numbers, bank account details, and KYC document files — are encrypted at rest using AES-256 encryption.
• PCI-DSS compliance: Payment card and financial account data handling follows PCI-DSS (Payment Card Industry Data Security Standard) requirements, including restricted access, tokenisation where applicable, and regular vulnerability assessments.
• Access controls: Access to Personal Data within boso1's systems is restricted on a strict need-to-know basis using role-based access controls. All access events are logged and reviewed.
• Penetration testing and vulnerability management: boso1 conducts regular penetration testing and vulnerability scans on the Platform infrastructure. Critical vulnerabilities are remediated within defined SLA windows.
• Multi-factor authentication (MFA): MFA is enforced for all boso1 staff accessing internal systems that contain Personal Data. Players are encouraged to use strong, unique passwords for their Accounts.
• DDoS protection: The Platform is protected by enterprise-grade distributed denial-of-service mitigation to maintain availability and protect against volumetric attacks.

8.2 Organisational Controls. In addition to technical measures, boso1 applies the following organisational safeguards: mandatory data protection training for all staff who handle Personal Data; contractual data processing obligations with all third-party service providers; a documented incident response plan covering notification procedures for data breaches; and periodic internal audits of data processing activities.

8.3 Data Breach Response. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, boso1 will notify affected Players without undue delay and take all reasonable steps to contain and remediate the breach. boso1 will also fulfil any applicable regulatory notification obligations arising from the breach.

8.4 Your Responsibilities. While boso1 takes extensive measures to protect your data, the security of your Account also depends on you. You are responsible for: keeping your Account password confidential and not sharing it with any other person; logging out of the Platform when using a shared or public device; using a strong, unique password that is not reused across other websites; and notifying boso1 support immediately if you suspect unauthorised access to your Account.

You have a number of rights with respect to the Personal Data that boso1 holds about you. These rights are described below. To exercise any of these rights, please contact the boso1 support team via live chat or at [email protected] (plain text — not a clickable link). boso1 will respond to all verifiable rights requests within 30 calendar days of receipt.

• Right of Access: You have the right to request a copy of the Personal Data that boso1 holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: You have the right to request that boso1 correct any inaccurate or incomplete Personal Data held about you. You can update most Account information directly in your Account settings; for KYC-verified data fields, a formal rectification request and supporting documentation may be required.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your Personal Data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you have objected to processing and there are no overriding legitimate grounds; or (d) the data has been processed unlawfully. Note that this right is subject to boso1's legal obligations to retain certain data (as described in Clause 7) and the responsible gaming safeguard for self-excluded accounts.
• Right to Restriction of Processing: You have the right to request that boso 1 restrict the processing of your Personal Data in certain circumstances — for example, while a rectification request is being assessed, or while an objection to processing is being considered.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, machine-readable format (such as CSV or JSON), and to transmit that data to another controller.
• Right to Object: You have the right to object, on grounds relating to your particular situation, to processing of your Personal Data that is based on boso1's legitimate interests. You also have an unconditional right to object to processing of your Personal Data for direct marketing purposes at any time — to exercise this right, you may update your marketing preferences in your Account settings or contact support directly.
• Right to Withdraw Consent: Where boso1 processes your Personal Data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right Not to be Subject to Solely Automated Decisions: boso1 uses automated systems for certain fraud-detection and risk-scoring functions. Where such automated processing produces a decision that significantly affects you — such as Account suspension based on fraud flags — you have the right to request human review of that decision. Contact support to invoke this right.

10.1 The boso1 Platform is strictly restricted to individuals who are 21 years of age or older. boso1 does not knowingly collect, process, or retain any Personal Data relating to individuals under the age of 21. This restriction applies regardless of the legal age of majority in any jurisdiction.

10.2 During the Account registration process, all applicants are required to confirm that they are at least 21 years old. boso1's KYC verification process includes mandatory age verification against a government-issued identity document (such as a KTP) to confirm compliance with this requirement before a Player is permitted to make deposits, place bets, or request withdrawals.

10.3 If boso1 discovers or is notified that an Account has been opened by or used by a person under the age of 21, boso1 will: immediately suspend that Account; conduct a review of all transactions associated with the Account; reverse any remaining balance to the depositing payment method; permanently close the Account; and delete or anonymise all Personal Data associated with it, subject only to any overriding legal obligation to retain records of the minor-access incident.

10.4 If you are a parent or guardian and believe that a minor in your care has registered an Account on the boso1 Platform, please contact our support team immediately via live chat or at [email protected]. We will investigate and act promptly.

11.1 The boso1 Platform may from time to time display links to promotional landing pages, game-provider information pages, or payment-method help resources operated by third parties. This Privacy Policy does not apply to those third-party websites or services. boso1 has no control over the content or privacy practices of external sites and accepts no responsibility for them. We encourage you to read the privacy notice of any third-party site you visit.

11.2 Game Content Providers. Games on the boso1 Platform are provided by licensed third-party studios including Evolution Gaming, Pragmatic Play, PG Soft, NetEnt, Microgaming, and Spribe. When you play a game provided by one of these studios, certain gameplay data (session start and end timestamps, bets placed, game outcomes, and your Player reference ID) is transmitted to the relevant studio's systems for the purpose of game operation, bet settlement, and provably fair verification. This data sharing is governed by boso1's data processing agreements with each studio.

11.3 Payment Provider Interfaces. When you initiate a deposit or withdrawal via a local bank transfer (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, or Bank Danamon) or an e-wallet (OVO, DANA, GoPay, ShopeePay, or LinkAja), you may interact directly with that provider's interface or app. The personal data you submit within that provider's own interface is governed by that provider's own privacy policy, not this Policy.

12.1 boso1 operates an international platform and uses service providers located in various countries. As a result, your Personal Data may be transferred to, stored in, and processed in countries outside Indonesia. Such countries may have data protection laws that differ from those applicable in Indonesia.

12.2 Where boso1 transfers Personal Data internationally, it ensures that appropriate safeguards are in place to protect that data. These safeguards include: contractual clauses in data processing agreements that require recipient processors to apply data protection standards equivalent to those described in this Policy; selecting service providers that maintain recognised international security certifications (such as ISO 27001 or SOC 2 Type II); and limiting international transfers to those that are strictly necessary for the operation of the Platform.

12.3 If you would like further information about the specific safeguards boso1 has in place for international data transfers, or if you wish to obtain a copy of the relevant contractual clauses, please contact our support team at [email protected].

13.1 boso1 reserves the right to amend this Privacy Policy at any time. Material changes — those that meaningfully alter the scope of data collection, the purposes of processing, or your rights — will be communicated to you by email to your registered address and/or by a prominent notice displayed on the Platform at least 14 calendar days before the change takes effect. Where a material change requires your fresh consent (for example, a new processing purpose based on consent), boso1 will seek that consent before the change takes effect.

13.2 Non-material amendments — such as corrections of typographical errors, clarifications that do not change the substantive meaning of a clause, or updates to reflect new payment providers — may take effect immediately upon publication on the Platform without advance notice.

13.3 The current version of this Privacy Policy, as published at https://boso1.org/privacy-policy, supersedes all prior versions. The "Last updated" date at the top of this page reflects when the most recent change was made. We encourage you to review this Policy periodically. Continued use of the Platform following publication of any amendment constitutes acknowledgement of the revised Policy.

13.4 If you do not agree with any amendment to this Policy, your sole remedy is to cease using the Platform and contact support to request Account closure and deletion of your Personal Data (subject to the retention obligations described in Clause 7).

If you have any questions about this Privacy Policy, wish to exercise a data rights request, or have a concern about how boso1 handles your Personal Data, please contact us through any of the following channels:

• Live Chat: Available 24/7 directly from any page on the boso1 Platform. This is the fastest channel for Account-related data queries and is staffed by native Indonesian-speaking agents around the clock, including during Ramadhan, Idul Fitri, and all Indonesian public holidays.
• Email: [email protected] (plain text — not a clickable link). For formal data rights requests and written correspondence regarding this Policy, email is the recommended channel. boso1 aims to respond to all data rights requests within 30 calendar days (WIB).

Where boso1 has appointed a Data Protection Officer (DPO) or equivalent privacy compliance contact, that individual can be reached through the same email address above, with the subject line "Data Protection Officer — Privacy Enquiry". The DPO is responsible for overseeing boso1's compliance with applicable data protection obligations and serves as the point of contact for data protection authorities and Players in relation to the processing of Personal Data.