Privacy Policy

1. Who We Are

1.1 This Privacy Policy is issued by the operator of boleh88 (hereinafter referred to as "boleh88", "we", "us", or "our"), the online casino and sports betting platform accessible at boleh88.win.

1.2 boleh88 is the data controller in respect of all personal data collected from members, registered users, and visitors to the boleh88 Platform. As data controller, boleh88 determines the purposes and means by which personal data is processed.

1.3 This Policy should be read together with boleh88's Terms and Conditions, which govern the overall relationship between boleh88 and its members, including eligibility requirements and account rules.

2. Personal Data We Collect

2.1 boleh88 collects and processes the following categories of personal data depending on the nature of your interaction with the Platform:

Identity Data:

• Full legal name as appearing on government-issued identification.
• Date of birth and age verification documentation (e.g., copy of MyKad or passport).
• Gender (where disclosed).
• Photographic identification and selfie verification where required for enhanced KYC.

Contact Data:

• Email address registered at account creation.
• Malaysian mobile phone number used for account verification and OTP delivery.
• Residential address provided for identity verification purposes.

Financial Data:

• Payment instrument details sufficient to process deposits and withdrawals (e.g., bank account name, masked account numbers, eWallet identifiers).
• Transaction histories including deposit amounts, withdrawal requests, and bonus activity.
• Source-of-funds documentation where required for enhanced due diligence.

Technical Data:

• IP address and geolocation data at time of access.
• Device type, operating system, and browser type.
• Session duration, pages visited, and game interaction logs.
• Cookies and similar tracking technologies as described in Section 8.

Usage Data:

• Bet history, game selections, wager amounts, win/loss records.
• Bonus redemption and wagering progress data.
• Customer support interaction records including live chat transcripts.

2.2 boleh88 does not collect or store full payment card numbers. Where card payments are processed, boleh88 utilises PCI-DSS compliant third-party payment processors. boleh88 retains only the minimum payment reference data necessary to reconcile transactions.

3. How We Collect Personal Data

3.1 boleh88 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, contacting support, or submitting withdrawal requests.
• Automated collection: Technical data collected automatically as you interact with the boleh88 Platform, including through cookies, server logs, and analytics tools.
• Third-party sources: Identity verification data obtained from approved KYC service providers and payment processors in connection with account verification and transaction processing.
• Public records: Where necessary for fraud prevention and anti-money laundering compliance, boleh88 may cross-reference data against publicly available information and databases maintained by regulatory authorities.

4. Purposes & Legal Basis for Processing

4.1 boleh88 processes personal data for the following purposes, under the corresponding legal bases:

• Account creation and management — Necessary for the performance of the contract between boleh88 and the member.
• Identity verification and KYC compliance — Required to comply with legal obligations imposed by boleh88's licensing authority and applicable anti-money laundering frameworks.
• Processing deposits and withdrawals — Necessary for the performance of the contract and to comply with financial regulatory requirements.
• Fraud prevention and security monitoring — Necessary for boleh88's legitimate interests in protecting the integrity of the Platform and preventing financial crime.
• Responsible gaming monitoring — Required to comply with legal and regulatory obligations, including detecting patterns associated with problem gambling and enforcing the 21+ age requirement.
• Customer support provision — Necessary for the performance of the contract and boleh88's legitimate interest in maintaining service quality.
• Platform analytics and improvement — Necessary for boleh88's legitimate interest in understanding Platform usage and improving the member experience.
• Marketing communications — Where the member has provided explicit consent to receive promotional materials from boleh88. Consent may be withdrawn at any time via account settings or by contacting support.
• Legal and regulatory compliance — Necessary to comply with applicable laws, court orders, and regulatory directives.

4.2 boleh88 does not process personal data for purposes incompatible with those disclosed in this Policy without first obtaining the member's explicit consent or identifying a fresh legal basis.

5. Disclosure of Personal Data

5.1 boleh88 may disclose personal data to the following categories of recipients, to the extent necessary for the purposes described in Section 4:

• Game providers and technology partners: Certified studios and platform technology providers who require access to session and account data to deliver game services. These partners operate under data processing agreements with boleh88.
• Payment processors: Malaysian and international payment service providers facilitating deposit and withdrawal transactions, including eWallet operators (Touch n Go, Boost) and banking institutions (Maybank, CIMB, Public Bank).
• KYC and identity verification providers: Third-party identity verification services engaged to support boleh88's member verification programme.
• Fraud prevention and AML service providers: Specialist third parties engaged to detect and prevent fraud and money laundering activity.
• Regulatory and licensing authorities: boleh88's licensing authority and any government body with lawful authority to require disclosure of member information.
• Law enforcement agencies: Where boleh88 is legally required to disclose data in response to a court order, warrant, or equivalent legal instrument.

5.2 boleh88 does not sell, rent, or commercially share personal data with unaffiliated third parties for their own marketing purposes under any circumstances.

5.3 All third-party service providers engaged by boleh88 are bound by contractual data protection obligations consistent with applicable data protection standards. boleh88 exercises due diligence in selecting and monitoring its processors.

6. International Data Transfers

6.1 boleh88's Platform infrastructure and some of its service providers may be located outside Malaysia. Where personal data is transferred outside Malaysia, boleh88 ensures that adequate safeguards are in place, including contractual protections equivalent in effect to those required by applicable Malaysian data protection law.

6.2 By registering for and using the boleh88 Platform, members acknowledge and consent to the international transfer of their personal data in circumstances where such transfer is necessary to provide the Platform's services.

7. Data Retention

7.1 boleh88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, as described in Section 4, or as required by applicable legal and regulatory obligations.

7.2 In practice, boleh88 applies the following indicative retention periods:

• Active account data: Retained throughout the lifetime of the member's Account and for a minimum of five (5) years following Account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction records: Retained for a minimum of seven (7) years from the date of the transaction, as required by applicable financial regulations.
• KYC documentation: Retained for a minimum of five (5) years from the date of Account closure.
• Technical and log data: Typically retained for up to twelve (12) months for fraud prevention and platform security purposes, unless longer retention is required by law or legitimate security investigation.
• Marketing consent records: Retained until consent is withdrawn and for a reasonable period thereafter to evidence the consent history.

7.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

8. Cookies & Tracking Technologies

8.1 boleh88 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function correctly, including session management, authentication state, and security tokens. These cannot be disabled without impairing Platform functionality.
• Analytics cookies: Used to understand how members interact with the Platform, identify technical issues, and improve the user experience. Data collected is aggregated and does not identify individual members by name.
• Preference cookies: Store member preferences such as language settings and interface configurations to provide a personalised experience on return visits.

8.2 Members may manage their browser's cookie settings to restrict or delete non-essential cookies. Please note that disabling certain cookies may affect the functionality of the boleh88 Platform, including authentication and session persistence.

8.3 boleh88 does not use third-party advertising or behavioural targeting cookies. Tracking on the Platform is limited to internal analytics and Platform operation purposes.

9. Security Measures

9.1 boleh88 implements industry-standard technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between member devices and boleh88 servers.
• Password storage using cryptographic hashing with per-record salting.
• Multi-factor authentication support via SMS OTP for Account access.
• Role-based access controls limiting employee access to personal data to the minimum necessary for their function.
• Regular penetration testing and vulnerability assessments conducted by qualified third parties.
• Physical and logical security controls on data centre infrastructure used by boleh88.

9.2 Notwithstanding these measures, no electronic transmission or storage system is entirely free of risk. Members are reminded of their responsibility to maintain the security of their Account credentials and to notify boleh88 immediately of any suspected unauthorised access.

10. Your Rights

10.1 Subject to applicable law and relevant exemptions, members have the following rights in relation to their personal data held by boleh88:

• Right of access: The right to request a copy of the personal data boleh88 holds about you and information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of personal data where it is no longer necessary for the purpose for which it was collected, subject to boleh88's legal retention obligations.
• Right to restriction: The right to request that boleh88 restricts processing of your data in certain circumstances, such as where accuracy is contested.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract performance.
• Right to object: The right to object to processing based on legitimate interests, including processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of prior processing.

10.2 To exercise any of the above rights, members should contact boleh88 via the live chat support channel or in writing to [email protected]. boleh88 will respond to all data subject requests within 30 calendar days of receipt.

10.3 boleh88 may request proof of identity before processing a data subject rights request to prevent unauthorised disclosure of personal data.

11. Children's Privacy

11.1 The boleh88 Platform is strictly intended for adults aged 21 and above. boleh88 does not knowingly collect personal data from individuals under the age of 21.

11.2 If boleh88 becomes aware that personal data has been collected from a person under the age of 21, that data will be deleted promptly and the associated Account will be closed in accordance with boleh88's Terms and Conditions. Any relevant authorities will be notified as required by applicable law.

11.3 Parents and guardians who believe a minor has accessed the boleh88 Platform and provided personal data are encouraged to contact boleh88 support immediately via live chat.

12. Amendments to This Policy

12.1 boleh88 reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, boleh88's data processing practices, or Platform functionality. The effective date at the top of this Policy will be updated upon each revision.

12.2 Continued use of the boleh88 Platform following publication of a revised Privacy Policy constitutes acceptance of the revised terms. Where changes are material, boleh88 will endeavour to notify registered members via the Platform or their registered email address.

13. Contact Us

13.1 For any queries, concerns, or requests relating to this Privacy Policy or boleh88's data processing practices, please contact the boleh88 data protection team:

• Via live chat: Available 24/7 on the boleh88 Platform.
• Via email: [email protected]

13.2 boleh88 aims to acknowledge all privacy-related enquiries within 2 business days and to provide a substantive response within 30 calendar days of receipt of all relevant information.