Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how boss01 ("we", "us", "our", "the Platform") collects, uses, stores, shares, and protects personal information belonging to users ("you", "your", "Player") who access or register on the boss01 website at https://boss01.cam.

This Policy forms part of and should be read in conjunction with the boss01 Terms & Conditions. By registering an Account or continuing to use the Platform after this Policy has been published or updated, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

If you have any objections to this Policy, you should immediately cease using the Platform and may request Account closure by contacting our support team. boss01 is committed to complying with applicable international data protection principles and practices as relevant to the markets in which it operates, including Indonesia.

2. Definitions

• "Personal Data" means any information that identifies or can identify a natural person, either directly (e.g., full name, email address) or indirectly (e.g., IP address, device ID).
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means boss01, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means any third party that processes Personal Data on behalf of boss01 under a contractual arrangement.
• "Sensitive Data" means a category of Personal Data that warrants heightened protection, such as national identification numbers (KTP) or financial account details.
• "Cookie" means a small text file stored on your device by a web browser that records information about your visit to the Platform.
• "KYC" (Know Your Customer) means the identity verification process we are required to conduct before processing withdrawals.

3. Data We Collect

boss01 collects only the data necessary to provide, maintain, and improve our services. The categories of Personal Data we process include:

4. How We Collect Your Data

4.1 Directly From You

The majority of your Personal Data is collected directly when you interact with the Platform, including during Account registration, KYC document submission, deposit and withdrawal requests, bonus claim forms, live chat and email support sessions, and when you update your Account settings or responsible gaming preferences.

4.2 Automatically

When you access the Platform, our servers and analytics tools automatically record Technical Data and Usage Data. This is standard practice for all web platforms and enables us to ensure stability, prevent fraud, and personalize your experience. This data is collected through server logs, session cookies, and analytics pixels.

4.3 From Third Parties

We may receive supplementary information from trusted third parties in limited circumstances, including:

• Payment processors: Transaction confirmation and status from BCA, BRI, BNI, Mandiri, CIMB Niaga, Bank Permata, and other partner banks;
• Fraud detection services: Risk scores and flagged activity from third-party fraud prevention vendors;
• Identity verification providers: Document authenticity confirmation services used to supplement KYC review;
• Analytics providers: Aggregated, anonymized behavioral data used to improve platform performance.

5. Purpose of Processing

boss01 processes your Personal Data only for specific, legitimate purposes. The primary purposes are outlined in the table below:

6. Legal Basis for Processing

boss01 processes your Personal Data on the following legal grounds:

• Contractual necessity: Processing required to perform our obligations under the Terms & Conditions, including operating your Account, processing transactions, and delivering gaming services;
• Legal obligation: Processing required to comply with applicable anti-money laundering (AML), know-your-customer (KYC), and age verification requirements;
• Legitimate interests: Processing required for fraud prevention, platform security, and service quality improvement, balanced against your rights and interests;
• Consent: Processing for optional purposes such as promotional email communications, where you have provided explicit consent that you may withdraw at any time.

8. International Data Transfers

boss01 operates internationally, and your Personal Data may be transferred to and stored on servers located outside Indonesia. Where such transfers occur, we take appropriate steps to ensure that your data receives a level of protection consistent with applicable international data protection standards.

Protective measures we apply to international transfers include:

• Contractual clauses requiring recipient parties to adhere to equivalent data protection standards;
• Data processing agreements with all third-party vendors that restrict further onward transfer;
• Transfer only to vendors and jurisdictions that maintain adequate security infrastructure;
• Encryption of data both in transit (TLS 1.2+) and at rest (AES-256) during all cross-border transfers.

9. Data Retention

boss01 retains your Personal Data only for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable law. The following retention periods apply as a general guide:

Upon expiry of the applicable retention period, your Personal Data will be securely deleted or irreversibly anonymized. Where data must be retained beyond your Account closure for legal reasons, it will be isolated from active systems and access will be restricted to authorized personnel only.

10. Data Security

boss01 employs a comprehensive, layered approach to data security. Our technical and organizational measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and our servers;
• AES-256 encryption at rest for all stored Personal Data and financial records;
• Multi-factor authentication options available for Player Accounts;
• Firewalls and intrusion detection systems monitoring all network traffic in real time;
• Role-based access controls ensuring that only authorized staff members can access specific categories of data;
• Regular third-party security audits and penetration testing conducted by independent cybersecurity firms;
• Automated anomaly detection that flags unusual login patterns or transaction behavior;
• Secure data centers with physical access restrictions, redundant power, and environmental controls.

Despite these measures, no online platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights and interests, boss01 will notify affected players within 72 hours of becoming aware of the breach, and will take immediate steps to contain and remediate the incident.

11. Cookies & Tracking Technologies

11.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They allow the Platform to recognize your browser across sessions, remember your preferences, maintain your login state, and gather aggregate analytics data. boss01 uses both first-party cookies (set directly by us) and third-party cookies (set by our analytics and fraud detection partners).

11.2 Types of Cookies We Use

• Essential cookies: Required for the Platform to function, including session management and security tokens. These cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences such as language settings, responsible gaming limits, and last login method.
• Analytics cookies: Collect anonymized data about how players use the Platform, enabling us to identify performance issues and improve user experience.
• Fraud prevention cookies: Help us identify suspicious behavior patterns that may indicate unauthorized Account access or bonus abuse.

11.3 Managing Cookies

You may configure your browser to reject non-essential cookies or to alert you when cookies are being set. However, disabling essential cookies will impair your ability to log in and use core Platform features. Instructions for managing cookies are available in your browser's help documentation. Note that boss01 does not currently respond to browser "Do Not Track" signals, as no universally accepted standard exists for this feature.

12. Your Data Rights

boss01 respects your rights over your Personal Data. Subject to applicable law and verification of your identity, you may exercise the following rights:

• Right of Access: Request a copy of the Personal Data we hold about you, along with information on how it is processed.
• Right to Rectification: Request correction of any inaccurate or incomplete Personal Data we hold.
• Right to Erasure: Request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to Restriction: Request that we limit our processing of your data in certain circumstances, such as while a dispute is being resolved.
• Right to Data Portability: Request a copy of the data you provided to us in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, or to the use of your data for direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and respond substantively within 30 days. We may ask you to verify your identity before processing your request. Requests that are manifestly unfounded or excessive may be declined with written justification.

13. Minors & Age Policy

The Platform is strictly intended for adults aged 21 and over. boss01 does not knowingly collect or process Personal Data from individuals under the age of 21. Age verification is a mandatory step in our KYC process, and we employ automated screening tools to detect potentially underage registrations.

If we discover or are notified that an Account has been registered by a person under 21 years of age, we will immediately close the Account, delete all associated Personal Data that we are not legally required to retain, and void any winnings or bonuses associated with that Account. If you believe a minor has registered on our Platform, please notify us immediately at [email protected].

14. Third-Party Links

The Platform may contain references to third-party services, game studios, or payment providers. This Policy applies exclusively to data processed by boss01. Any data you submit to a third-party service — including payment gateways or game providers — is governed by that party's own privacy policy. boss01 is not responsible for the privacy practices or content of third-party services and encourages you to review their policies before sharing any personal information.

15. Policy Updates

boss01 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. The "Last Updated" date at the top of this page indicates when the most recent revision was made. For material changes — such as significant new data uses or new categories of data collected — we will provide advance notice via email or an in-platform notification at least 14 days before the change takes effect.

Your continued use of the Platform following any update to this Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you should close your Account and discontinue use of the Platform prior to the effective date of the change.

16. Contact Us

If you have any questions, concerns, or complaints relating to this Privacy Policy, or if you wish to exercise any of your data rights, please reach out to our team using the details below:

We take all privacy-related queries seriously and are committed to resolving concerns promptly and transparently. If you are unsatisfied with our response, you retain the right to escalate the matter to the relevant data protection authority in your jurisdiction.