Boskuda Privacy Policy – Personal Data Protection for Malaysian Players

Boskuda takes member privacy very seriously. This Privacy Policy has been drawn up in accordance with the requirements of Personal Data Protection Act 2010 (PDPA Malaysia) and covers all data processing activities carried out by Boskuda in connection with the use of the platform by members in Malaysia.

This policy applies to all users of the Boskuda platform, including website visitors, users in the process of registering, active registered members and former members who have closed their accounts. It covers all interaction channels — the boskuda.site website, the Boskuda mobile app (where available), and communications via email, live chat or any other support channel.

Boskuda acts as the Data Controller as defined under Malaysia's PDPA, meaning we bear full responsibility for ensuring that your personal data is processed in a lawful, fair and transparent manner at all times.

Boskuda only collects data that is necessary for clearly stated purposes. We do not collect data that is excessive or irrelevant to the platform's operations. The following are the categories of data we collect:

• Registration information — username, password (stored in unreadable hashed form), active Malaysian phone number, and email address.
• Identity verification information (KYC) — full name as per MyKad, MyKad number, date of birth and identity verification documents requested for compliance purposes.
• Payment Information — e-wallet account details (Touch 'n Go eWallet, GrabPay, Boost, ShopeePay, DuitNow) or banking information for FPX (Maybank2u, CIMB Clicks) used for deposits and withdrawals.
• Support communications — records of live chat conversations, emails and any documents you submit to the Boskuda support team.

• Technical data — IP address, web browser type, device operating system, screen resolution and device information used to access Boskuda.
• Gaming activity data — game records, total wagers, wins and losses, game titles played, session duration and Boskuda platform usage statistics.
• Transaction data — a complete record of all deposits and withdrawals, including payment method, amount, and transaction timestamp.
• Location data — approximate geographic location based on IP address for compliance and fraud prevention purposes. Boskuda does not access your device's GPS location.
• Cookie data — information collected through cookies and similar tracking technologies as described in our Cookie Policy section.

Boskuda uses your personal data only for legitimate, stated purposes. We do not use your data for any other purpose without first informing you and obtaining the appropriate consent.

• Creating and managing your Boskuda member account
• Verifying your identity and age during registration and KYC review
• Process deposits and withdrawals via your chosen Malaysian payment methods
• Providing access to all games and services on the Boskuda platform
• Sending important account-related communications, such as transaction confirmations and security notifications

• Detecting and preventing fraudulent activity, money laundering and violations of Boskuda's terms
• Monitoring account activity to identify suspicious or unusual patterns
• Comply with Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) legal requirements applicable in Malaysia
• Protecting your account from unauthorised access through an intrusion detection system

• Monitoring gameplay patterns to identify signs of problem gambling
• Enforcing the deposit limits, session time limits and self-exclusion settings you have put in place
• Maintain a self-exclusion list to ensure that members who have applied are prevented from accessing the platform

With your consent, Boskuda may send you information about promotions, bonuses and special offers — such as Hari Raya Aidilfitri bonuses or EPL and Malaysia Super League season promotions. You may opt out of marketing communications at any time via your Boskuda account settings or by contacting our support team.

In line with Malaysia's PDPA, Boskuda processes your personal data on a clear legal basis for each processing purpose. The bases we rely on are as follows:

• Contract performance — processing necessary to deliver the Boskuda services you have registered for and use, including account management and payment processing.
• Legal obligation — processing required to comply with Malaysian law, including AML requirements, KYC obligations and reporting to the relevant authorities.
• Legitimate interests — processing for fraud prevention, platform security and the improvement of Boskuda services.
• Consent — processing for marketing purposes and promotional communications — only with your explicit consent, which may be withdrawn at any time.

Boskuda does not sell, rent or transfer your personal data to third parties for their own marketing or commercial purposes. However, in the course of legitimate Boskuda platform operations, data may be shared with the following categories of recipients under specific circumstances:

Boskuda works with trusted third-party service providers to help operate the platform — including licensed game providers (Pragmatic Play, Evolution Gaming, NetEnt, and others), payment providers (Touch 'n Go, DuitNow, GrabPay, FPX gateways), server infrastructure, and cybersecurity services. These providers are only permitted to access the data necessary to perform their specific functions and are required to comply with strict security and privacy standards under contractual agreements. They are not authorised to use your data for any other purpose.

Boskuda may disclose personal data to the relevant Malaysian authorities when required by law — such as to the Royal Malaysia Police (PDRM), Bank Negara Malaysia, the Malaysian Communications and Multimedia Commission (MCMC) or a court tribunal, where a valid court order, criminal investigation or statutory compliance reporting obligation exists. In such circumstances, Boskuda will endeavour to notify you in advance unless prohibited by law from doing so.

If Boskuda is involved in any merger, acquisition, or transfer of company assets, members' personal data may be transferred as part of that transaction. In such circumstances, Boskuda will ensure that the receiving party is bound by data protection standards at least equivalent to this Privacy Policy, and members will be notified of any such changes.

Boskuda implements a range of appropriate technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration or destruction. These include:

• 256-bit SSL/TLS Encryption — all data transmitted between your browser and Boskuda's servers is fully encrypted. You can verify this by checking the padlock icon in your browser's address bar when accessing boskuda.site.
• Passwords hashed with bcrypt — your Boskuda account password is never stored in plain text. It undergoes a one-way hashing process, meaning no one — including Boskuda's own technical team — can read your actual password.
• Two-factor authentication (2FA) — Boskuda supports additional verification via OTP to your Malaysian phone number to protect your account from unauthorised access.
• Intrusion detection system (IDS) — a real-time monitoring system that detects and blocks unauthorised access attempts or suspicious behaviour on the Boskuda platform.
• Strict internal access controls — only Boskuda staff with a legitimate business need are permitted to access members' personal data, and every instance of access is logged for audit purposes.
• Secure data backup — critical data is backed up regularly to a secure, separate location to ensure service continuity and protection against data loss.

Boskuda adheres to the data retention limitation principles established under PDPA Malaysia — we retain your data only for as long as is necessary for the stated purpose or as required by law.

• Active account data — retained for as long as your account is active and for the legally required period following account closure.
• Financial transaction records — retained for a minimum of 7 years following the transaction, in line with Malaysia's tax and AML legal requirements.
• KYC Records — retained for 5 years after account closure or the date of the last related transaction.
• Support communication logs — retained for 2 years for reference and dispute resolution purposes.
• Session cookie data — deleted when you close your browser session.

Once the retention period has expired, or when you request data deletion (subject to applicable legal obligations), Boskuda erases your data using methods that ensure it cannot be recovered. This includes secure deletion from databases, removal of logs and backups, and the deletion or anonymisation of data held in archival systems.

Boskuda uses cookies and similar technologies to enhance the platform experience, maintain account security, and understand how players in Malaysia interact with our platform. Cookies are small text files stored in your browser when you visit boskuda.site.

You can manage your cookie preferences through your browser settings. However, disabling mandatory and security cookies may affect the functionality and security of your Boskuda account. For guidance on managing cookies in major browsers, please refer to the official documentation for Chrome, Firefox, or Safari respectively.

Under the Personal Data Protection Act 2010 (PDPA Malaysia), you have the following rights regarding the personal data held by Boskuda. Boskuda is committed to fully respecting and facilitating the exercise of these rights.

The Boskuda platform is strictly for individuals aged 18 and above. Boskuda does not knowingly collect or process personal data from individuals under the age of 18. Boskuda's registration system is designed with age verification controls to prevent sign-ups by minors.

Should Boskuda discover that personal data belonging to someone under the age of 18 has been collected, we will take immediate steps to delete that data and close the account in question, with no liability to Boskuda. Parents and guardians who believe their child may have registered an account with Boskuda are advised to contact our support team immediately at support@boskuda.site.

Boskuda reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data handling practices, the latest legal requirements in Malaysia, or relevant technological developments. The most current version of the Privacy Policy will always be available on this page, showing the latest "Updated" date.

For material amendments that significantly affect your privacy rights, Boskuda will provide reasonable notice via an in-platform notification or an email to your registered address at least 14 days before the changes take effect. Your continued use of the Boskuda platform after the effective date of any amendment will be considered acceptance of the revised policy.

If you have any questions, concerns, or requests regarding Boskuda's Privacy Policy or the handling of your personal data, please contact us through the following channels:

• Privacy Email — support@boskuda.site (please include "Data Privacy Enquiry" in the subject line). Responses within 2–5 business days.
• 24/7 Live Chat — for general privacy enquiries, Boskuda's support team is available via live chat within the platform and can assist within minutes.
• Help Centre — check the Boskuda FAQ for answers to frequently asked questions on privacy and account security.

Boskuda is committed to handling all privacy-related enquiries and complaints seriously, and to providing a clear and satisfactory response within a reasonable timeframe. Your trust is the foundation of our relationship with you as a member and as a platform.