Privacy Policy
— How boso1 Protects Your Data

boso1 ("we", "us", "our") operates the online gaming platform accessible at boso1.cam (the "Platform"). This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by boso1.

We are committed to protecting and respecting your privacy. This policy applies to all members who register and use the boso1 Platform, including residents of Indonesia and other jurisdictions where boso1 accepts registrations. It covers all personal data collected through the Platform website, mobile interface, customer support channels, and any other services operated under the boso1 brand.

Please read this Privacy Policy carefully before using the Platform. By registering an account, making a deposit, or continuing to use our services, you acknowledge that you have read and understood this policy and consent to the processing of your personal data as described herein. If you do not agree with the terms of this Privacy Policy, you must not use the Platform.

In this Privacy Policy, the following terms carry the meanings set out below:

boso1 collects the following categories of Personal Data in the course of operating the Platform and delivering our services to Members:

3.1 Registration & Account Data

• Full legal name and date of birth
• Indonesian National Identity Card number (KTP) or passport number
• Residential address (including city — Jakarta, Surabaya, Bandung, Medan, Bali, or elsewhere in Indonesia)
• Email address and mobile phone number
• Username and encrypted password
• Security questions and answers

3.2 KYC Verification Data

• Scanned or photographed copies of government-issued photo identification (KTP, passport)
• Proof of residential address documents (bank statements, utility bills)
• Selfie or liveness-check images used to confirm document ownership
• Source-of-funds documentation submitted for anti-money laundering (AML) compliance

3.3 Financial & Transaction Data

• Indonesian bank account details (BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, BSI)
• E-wallet identifiers (OVO, DANA, GoPay, ShopeePay, LinkAja)
• Deposit and withdrawal amounts, dates, and reference numbers
• Betting and wagering history, including game type, stake size, and outcomes
• Bonus credit and wagering progress records

3.4 Technical & Device Data

• IP address and approximate geolocation (country/city level)
• Device type, operating system, and browser version
• Session timestamps, login history, and logout records
• Clickstream data and navigation patterns within the Platform
• Error logs and crash reports

3.5 Communications Data

• Customer support correspondence (email, live chat transcripts)
• Feedback, complaints, and dispute records
• Responses to surveys or promotional campaigns where you voluntarily participate

3.6 Responsible Gaming Data

• Self-imposed deposit, loss, and session time limit settings
• Self-exclusion requests and their effective periods
• Voluntary disclosures made in connection with responsible gaming support requests

boso1 collects Personal Data through the following channels:

• Directly from you: when you register an account, complete the KYC verification process, make a deposit or withdrawal, place a bet, contact our support team, or submit a responsible gaming request.
• Automatically through the Platform: via cookies, server logs, and analytics tools that record your device information, session activity, and navigation behavior each time you use the Platform.
• From third-party service providers: including KYC verification partners, payment processors (banks and e-wallet providers), fraud detection services, and game content providers — where such data sharing is necessary to deliver and secure our services.
• From publicly available sources: in limited circumstances where required for AML compliance, such as sanctions screening databases and politically exposed persons (PEP) lists.

boso1 processes your Personal Data for the following purposes:

boso1 processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions you accept when registering, including account management, payment processing, and wagering activity.
• Legal Obligation: Processing necessary to comply with applicable anti-money laundering (AML) laws, age verification requirements, and any other legal obligations applicable to boso1's operations.
• Legitimate Interests: Processing carried out for boso1's legitimate business interests, including fraud prevention, Platform security, customer support quality assurance, and analytics — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your explicit consent, including the sending of direct marketing communications and the use of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

boso1 does not sell, rent, or trade your Personal Data. We may share your data only in the limited circumstances described below:

• Payment Processors: We share financial account details and transaction data with Indonesian local banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, BSI, Bank Permata) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) as necessary to execute deposit and withdrawal transactions.
• KYC Verification Partners: Identity and age verification data is shared with our contracted KYC service providers for the purpose of confirming your identity and eligibility to use the Platform.
• Game Content Providers: Limited technical data (session identifiers, bet amounts) is shared with third-party game providers including Pragmatic Play, Evolution Gaming, Pocket Games Soft, and Spribe as necessary to deliver game functionality and resolve disputes.
• Fraud Detection Services: Device fingerprint data, IP addresses, and behavioral signals may be shared with fraud detection partners to identify and prevent prohibited activities.
• Legal & Regulatory Authorities: We may disclose Personal Data to competent legal, regulatory, or law enforcement authorities where required by applicable law, a valid court order, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of boso1 or others.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of boso1's assets, your Personal Data may be transferred to the successor entity, subject to equivalent privacy protections.

boso1 retains your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable law. The following retention periods apply:

• Account & Registration Data: Retained for the duration of your membership and for a minimum of 5 years following permanent account closure, in accordance with AML record-keeping obligations.
• KYC Verification Documents: Retained for a minimum of 5 years from the date of submission or from the date of account closure, whichever is later.
• Financial & Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in line with financial record-keeping requirements.
• Customer Support Correspondence: Retained for 3 years from the date of the most recent communication in a support thread.
• Marketing Preference Records: Retained until you withdraw consent or for 3 years following your last interaction with a marketing communication, whichever is sooner.
• Technical & Session Logs: Retained for up to 12 months, after which they are anonymized or deleted.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymized in a manner that prevents its reconstruction or re-identification.

boso1 applies comprehensive technical and organizational security measures to protect your Personal Data against unauthorized access, accidental loss, destruction, or disclosure. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the boso1 Platform is encrypted using industry-standard TLS protocols. You can verify this by checking for the padlock symbol in your browser address bar.
• Encrypted Storage: Personal Data and financial records stored on our servers are encrypted at rest using AES-256 encryption.
• Access Controls: Access to Personal Data is strictly limited to authorized boso1 personnel and contracted Data Processors on a need-to-know basis. All access is logged and audited.
• Two-Factor Authentication: We offer two-factor authentication (2FA) to all Members and strongly encourage its use to protect account access.
• Penetration Testing: Our Platform infrastructure undergoes regular third-party penetration testing and vulnerability assessments.
• Incident Response: In the event of a data security incident that affects your rights and freedoms, boso1 will notify affected Members and relevant authorities within the timeframes required by applicable law.

boso1 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyze usage patterns, and deliver a more personalized experience. The following categories of cookies are used:

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair your ability to log in or use core Platform features. Analytics and functional cookies can be disabled without affecting core functionality.

As a Member of boso1, you hold the following rights in relation to your Personal Data. To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and provide a substantive response within 30 days.

• Right of Access: You may request a copy of all Personal Data that boso1 holds about you, together with information about the purposes for which it is processed and who it has been shared with.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you have the right to request its correction. Please ensure your account details are kept up to date via your account settings where possible.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing was unlawful. Note that this right is subject to boso1's legal record-keeping obligations, which may require retention of certain data after account closure.
• Right to Restriction of Processing: You may request that boso1 restrict processing of your Personal Data in certain circumstances, such as while the accuracy of data you have contested is being verified.
• Right to Data Portability: You may request a copy of your Personal Data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You have the right to object to processing of your Personal Data based on legitimate interests, and to opt out of direct marketing communications at any time by updating your notification preferences in your account settings or by contacting support.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

The boso1 Platform is strictly intended for adults aged 21 and above. We do not knowingly collect Personal Data from individuals under the age of 21. Age verification is a mandatory step in the account registration and KYC process.

If boso1 discovers or is notified that Personal Data has been collected from a person under 21, we will take immediate steps to:

• Suspend and permanently close the account in question.
• Void and forfeit any wagers placed or winnings accumulated by the underage individual.
• Securely delete all Personal Data associated with the account, subject to any legal obligations to retain records for a limited period for AML and fraud investigation purposes.

If you are a parent or guardian and believe that a person under 21 in your care has registered on boso1 without your knowledge, please contact us immediately at [email protected]. We will respond and act on confirmed reports within 24 hours. For further guidance on protecting young people from online gambling, please visit our Responsible Gaming page.

boso1 operates as an internationally licensed platform. As a result, your Personal Data may be transferred to and processed in countries outside Indonesia. Transfers to third-party Data Processors in other jurisdictions occur only where:

• The transfer is necessary to perform the services described in these Terms (e.g., processing payments via internationally operated e-wallet platforms), and
• Appropriate safeguards are in place, such as contractual clauses that impose data protection obligations equivalent to those described in this Privacy Policy.

boso1 does not transfer Personal Data to jurisdictions that do not offer an adequate level of data protection without implementing appropriate contractual or technical safeguards. If you have questions about the specific countries to which your data may be transferred, please contact our support team.

The boso1 Platform may contain references to third-party game providers and payment services. boso1 does not control these external services and is not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of boso1, including your bank (BCA, BRI, BNI, Mandiri) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja).

This Privacy Policy applies exclusively to data processed by boso1. It does not cover data collection or processing carried out independently by third-party game studios, payment processors, or platform infrastructure providers operating under their own privacy frameworks.

boso1 reserves the right to update or replace this Privacy Policy at any time to reflect changes in our data processing activities, applicable legislation, or best practices in data protection. When material changes are made, we will:

• Update the "Effective Date" displayed at the top of this page.
• Post a prominent notice on the Platform homepage summarizing the key changes.
• Where practicable, send an email notification to registered Members at the email address on file.

Your continued use of the boso1 Platform following the effective date of any revised Privacy Policy constitutes your acknowledgment and acceptance of the updated terms. If you do not agree with the revised policy, you must cease using the Platform and request account closure before the effective date of the change.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data by boso1, please contact our support team using the details below. For formal data rights requests (access, rectification, erasure, portability, objection), please include "Data Rights Request" in the subject line of your communication.

For responsible gaming data requests — such as retrieving your self-exclusion history or deposit limit records — please visit our dedicated Responsible Gaming page for additional guidance.