Privacy Policy Bospay — Personal Data Protection for Malaysia Players

Bospay collects various types of personal information to enable us to provide our platform services safely, efficiently, and responsibly. This data collection occurs in several different situations:

Data you provide directly:

• Registration information — full name, date of birth, email address, phone number, and password.
• KYC information — copy of identification document (MyKad or passport), proof of address, and identity verification selfie.
• Financial information — bank account or e-wallet details used for deposits and withdrawals.
• Support communications — records of live chat conversations, emails, and any written communications with the bospay team.

Data collected automatically:

• Device and technical information — IP address, browser type, operating system, screen resolution, and device identifier.
• Usage data — pages visited, session duration, games played, bets placed, and activity patterns on the platform.
• General location data — country and region based on IP address for compliance and security purposes.

Every piece of data collected by bospay is used for a specific and permitted purpose. We do not process your personal data for any purpose not stated in this policy without first obtaining your renewed consent.

Bospay never uses your personal data to make fully automated decisions that significantly affect you without human involvement, except with your explicit consent.

Bospay takes a strictly limited approach to sharing personal data. We does not sell your data to any party. However, in certain limited situations, data may be shared with:

• Payment providers: Payment service providers such as banks and e-wallet operators receive the data necessary to process your deposit and withdrawal transactions. They are subject to strict data protection agreements.
• Technical service providers: Companies that provide server infrastructure, cloud services and analytics tools that help operate the bospay platform — all bound by confidentiality agreements.
• Regulatory and law enforcement bodies: When required by law or a valid court order, Bospay will disclose the necessary information to the relevant authorities.

Bospay never shares players' personal data with advertisers, third-party marketing companies, or any other commercial entity for marketing purposes without your explicit consent. If you receive marketing communications from Bospay, it is only because you provided consent during registration or through the preference settings in your account.

Bospay uses cookies and similar tracking technologies to enhance your experience on the platform. Cookies are small text files stored in your web browser when you visit the Bospay platform.

We use three main types of cookies:

• Essential Cookies: Required for core platform functions such as login verification and session security. These cookies cannot be disabled without affecting your ability to use the platform.
• Performance Cookies: Collecting anonymous information about how players use the platform — most visited pages, load times, and errors encountered. Helps us improve platform performance.
• Preference Cookies: Saving your preferences such as language settings and display preferences so you do not need to reconfigure them each time you log in.

You can manage your cookie settings through your web browser at any time. Please note that disabling essential cookies may affect the functionality of the Bospay platform.

Bospay retains your personal data only for as long as it is needed for the purposes stated in this policy or as required by applicable law.

• Active account data: Retained for the duration of the active account and for 7 years after account closure to meet financial and audit legal requirements.
• Transaction data: Deposit, withdrawal and betting records are retained for a minimum of 7 years in compliance with anti-money laundering (AML) requirements.
• Support communication data: Customer support conversation records are kept for 3 years for quality control and dispute resolution purposes.
• Log and security data: Access logs and security data are retained for 12 months for security incident investigation purposes.

Bospay takes data security seriously because we understand that players' financial and personal information is highly sensitive. The security measures we implement cover both technical and organisational aspects.

Technical protections:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers.
• Encryption at rest for all sensitive data stored in the database.
• Two-factor authentication (2FA) is available and encouraged for all player accounts.
• 24/7 network monitoring and an active intrusion detection system (IDS).
• Security testing and penetration audits conducted regularly by third-party experts.

Organisational controls:

• Access to player data is restricted to staff who require it based on their role only.
• All staff undergo regular data security awareness training.
• Binding confidentiality agreements are signed by all staff and contractors with access to player data.
• Clear incident response procedures that are regularly tested.

You have the following rights regarding your personal data held by Bospay. To exercise any of these rights, contact our support team via live chat in your account:

Bospay takes the protection of minors very seriously. Our platform is intended exclusively for individuals aged 18 and above and we do not knowingly collect or process personal data from minors.

Steps we take to prevent underage registration include:

• Date of birth verification is mandatory during registration.
• A KYC process that requires identity documents verifying age.
• An automated detection system that flags profiles showing signs of potential underage users.

Bospay reserves the right to update this Privacy Policy from time to time to reflect changes in our privacy practices, legal requirements, or the services we offer. We are committed to notifying you of any material changes.

When significant changes are made to this Privacy Policy, Bospay will:

• Sending an email notification to your registered address at least 14 days before the changes take effect.
• Displaying a clear notice on the platform when you log in until you acknowledge the changes.
• Updating the "effective date" at the top of this document.

Continued use of the bospay platform after the notice period is considered acceptance of the updated Privacy Policy. If you do not agree with the changes, you have the right to close your account before they take effect.

If you have any questions, concerns, or requests regarding your privacy and personal data at bospay, our team is ready to help. We take every privacy enquiry seriously and are committed to providing a satisfactory response.

You can contact the Bospay Data Protection Officer through the following channels:

• Live Chat: Via the chat icon in your bospay account — available 24/7, response within minutes.
• Email: Submit your written enquiry to our privacy team at [email protected] — response within 3 business days.
• In Account: The "Privacy Settings" section in your Bospay account lets you manage many privacy preferences directly.

For data subject rights requests (access, correction, deletion), please include the following in your request: registered full name, account email address, type of request and relevant details. This helps us process your request more quickly and accurately.