Privacy Policy

bos27 ("bos27", "we", "us", "our") operates the online gaming platform accessible at https://bos27.pro (the "Platform"). As part of delivering our services — which include sports betting, live casino, togel (Indonesia's traditional numbers lottery), slots, video poker, and Domino QQ — we collect and process personal data relating to our registered players and website visitors.

We are committed to protecting your personal data and handling it with transparency, integrity, and in accordance with internationally recognised data protection principles. This Privacy Policy applies to all personal data we collect through the Platform, our live chat system, WhatsApp support channels, email correspondence, and any other interaction you have with bos27.

This policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference. By registering a bos27 account or using the Platform, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

• "Personal Data" — any information that identifies or could reasonably identify a living individual, either directly (such as a name or national ID number) or indirectly (such as a device identifier in combination with behavioural data).
• "Processing" — any operation performed on personal data, including collection, recording, storage, adaptation, retrieval, use, disclosure, transmission, restriction, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. bos27 is the Data Controller in respect of all personal data collected through the Platform.
• "Data Processor" — a third party that processes personal data on behalf of a Data Controller under a written agreement and subject to the Data Controller's instructions.
• "KYC" — Know Your Customer; the identity verification process by which bos27 confirms the identity and eligibility of Players prior to processing withdrawals.
• "Cookies" — small text files placed on your device by the Platform to enable functionality, analytics, and personalisation features.
• "DPO" — Data Protection Officer; the designated bos27 contact point for all data protection enquiries and rights requests.

bos27 collects personal data in the following categories depending on your interaction with the Platform:

3.1 Registration Data

• Full legal name (as it appears on your Indonesian KTP)
• Date of birth (to verify 21+ eligibility)
• Active mobile phone number registered in Indonesia
• Email address
• Username and hashed password (passwords are never stored in plaintext)
• Referral source (how you found bos27)

3.2 Identity Verification (KYC) Data

• Scan or photograph of your Indonesian KTP (Kartu Tanda Penduduk) or valid international passport
• Bank account details (account holder name, bank name such as BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, or BSI, and account number) in your own name
• E-wallet account details (OVO, DANA, GoPay, ShopeePay, or LinkAja) registered in your own name
• Selfie verification photograph when requested by our compliance team

3.3 Financial Transaction Data

• Deposit and withdrawal amounts, timestamps, and payment method references
• Transaction status history and any associated reference codes
• IDR Wallet balance history
• Bonus and promotional credit history

3.4 Gaming Activity Data

• Game history: titles played, bet amounts, outcomes, win/loss records
• Sportsbook wager records including markets, stake amounts, and settlement outcomes
• Session duration, frequency, and active hours
• Responsible gaming tool usage (deposit limit settings, cooling-off requests, self-exclusion requests)

3.5 Technical and Device Data

• IP address and approximate geolocation (country and city level)
• Device type, operating system, and browser version
• Unique device identifiers
• Session tokens and authentication logs
• Platform error logs and performance metrics

3.6 Communications Data

• Live chat transcripts with our support team
• WhatsApp message records with our support team
• Email correspondence content and metadata
• Feedback, complaint, and dispute records

bos27 collects personal data through the following means:

• Directly from you: When you register an account, complete the KYC process, make a deposit or withdrawal, place a bet, contact our support team, or otherwise interact with the Platform.
• Automatically via the Platform: Through cookies, session tokens, server logs, and device-fingerprinting technologies that are active whenever you access bos27.pro.
• From payment partners: When you initiate a deposit or withdrawal, our payment processing partners (banks such as BCA, BRI, BNI, and Mandiri, and e-wallet providers such as OVO, DANA, and GoPay) confirm transaction status and in some cases account-holder name details to enable us to verify ownership.
• From game providers: Third-party game studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may transmit game-round data to bos27's systems for settlement, audit, and responsible gaming monitoring purposes.
• From fraud and risk partners: We may receive data from third-party fraud detection, AML screening, and sports integrity partners where necessary to protect the security and integrity of the Platform.

We process your personal data only for the purposes described below. We do not process personal data for any purpose incompatible with those listed here without your explicit consent or a valid legal basis.

bos27 processes your personal data under the following legal bases, consistent with internationally recognised data protection frameworks:

• Contractual necessity: Most processing is necessary to perform the contract between you and bos27 — specifically, to operate your account, process transactions, settle bets, and deliver gaming services.
• Legal obligation: KYC/AML processing, age verification, fraud reporting, and data retention for audit purposes are required by applicable anti-money-laundering and gaming compliance obligations.
• Legitimate interests: Fraud detection, platform security, responsible gaming monitoring, analytics for service improvement, and communications data retention for dispute resolution are processed on the basis of bos27's legitimate interests, provided those interests are not overridden by your fundamental rights.
• Consent: Where we rely on consent — for example, for optional marketing communications or non-essential cookies — you may withdraw that consent at any time by contacting our support team or updating your account preferences.

bos27 does not sell your personal data to unaffiliated third parties for their own marketing or commercial purposes. We share personal data only in the following limited circumstances:

• Payment processing partners: Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Permata, BSI) and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the transaction data necessary to process your deposits and withdrawals. These partners act as independent data controllers for their own transaction processing functions and have their own privacy policies.
• Game content providers: Third-party studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft receive your Player ID and game-round data to facilitate game delivery, random number generation certification, and regulatory audit trails. These providers do not receive your KTP data or full financial records.
• Fraud and AML screening services: bos27 may share account and transaction data with specialist third-party fraud detection and anti-money-laundering screening providers under strict Data Processing Agreements (DPAs). These providers operate solely as Data Processors on our instruction.
• Sports integrity organisations: In cases involving suspicious betting patterns, bos27 may disclose relevant betting data to recognised sports integrity bodies as part of its cooperative obligations. Such disclosures are made only where legally required or where we have a legitimate interest in protecting sporting integrity.
• Professional advisors: Our legal counsel, auditors, and compliance consultants may access personal data on a strictly need-to-know basis and are bound by professional confidentiality obligations.
• Legal and regulatory authorities: bos27 will disclose personal data to law enforcement, regulators, or courts where required by a valid legal order or where disclosure is necessary to protect the safety of any individual.

bos27 operates as an internationally hosted platform. As a result, your personal data may be transferred to and stored on servers located outside of Indonesia. Some of our third-party game providers and technical infrastructure partners are also based in jurisdictions outside Indonesia, including countries in Europe and Asia-Pacific.

Where personal data is transferred internationally, bos27 implements appropriate safeguards to ensure a level of protection equivalent to that afforded within Indonesia. These safeguards include:

• Standard Contractual Clauses (SCCs) or equivalent contractual protections in agreements with international Data Processors
• Transfers only to processors located in jurisdictions with recognised adequate data protection frameworks
• End-to-end 256-bit SSL encryption for all data in transit
• AES-256 encryption for data at rest on our servers

If you would like more information about the specific safeguards in place for any particular international transfer, please contact our Data Protection Officer using the details set out in Clause 16.

bos27 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal and compliance obligations. The following retention periods apply:

When retention periods expire, personal data is securely deleted or irreversibly anonymised using industry-standard procedures. Self-exclusion records are retained indefinitely to prevent circumvention of responsible gaming protections.

Subject to applicable law and certain limitations linked to our legal obligations (such as AML record-keeping requirements), you have the following rights in respect of your personal data held by bos27:

• Right of Access: You may request a copy of the personal data bos27 holds about you. We will provide this within 30 days of a verified request.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. For KYC-critical data (such as your name or date of birth), we may require supporting documentation.
• Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and no other legal basis applies), or where processing was unlawful. Note that we cannot delete data we are legally required to retain for AML compliance.
• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances, for example while a dispute over its accuracy is pending.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests. bos27 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, please contact our Data Protection Officer at [email protected] with the subject line "Data Rights Request — [Your Username]". We will acknowledge your request within 5 business days and provide a full response within 30 calendar days. Where a request is complex or numerous, we may extend the response period by a further 30 days with prior notice to you.

bos27 uses cookies and similar tracking technologies to operate the Platform, maintain your session, prevent fraud, and improve your experience. The categories of cookies we use are as follows:

You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will impair your ability to log in and use core Platform features. Detailed guidance on managing cookies is available through your browser's help documentation.

bos27 implements a layered security architecture to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our technical and organisational security measures include:

• 256-bit SSL/TLS encryption on every page and every data transmission across bos27.pro — no page is served over unencrypted HTTP.
• AES-256 encryption at rest for all stored personal data, KYC documents, and financial records on our servers.
• Hashed password storage using bcrypt or an equivalent strong one-way hashing algorithm. bos27 never stores plaintext passwords and cannot retrieve your password — only reset it.
• Two-factor authentication (2FA) available for all accounts and mandatory for accounts flagged for enhanced security review.
• Role-based access controls (RBAC) ensuring that bos27 staff access only the data necessary for their specific role. KYC documents are accessible only to verified compliance team members.
• Continuous intrusion detection and DDoS mitigation via our infrastructure security layer.
• Regular penetration testing and third-party security audits of the Platform and its supporting infrastructure.
• Incident response plan — in the event of a data breach, bos27 will notify affected players and relevant authorities within the timeframes required by applicable law, and no later than 72 hours after becoming aware of a breach affecting your rights and freedoms.

bos27 is strictly an adults-only platform. Access to real-money gaming services requires the Player to be 21 years of age or older. bos27 does not knowingly collect, process, or retain personal data from any individual under the age of 21.

Age verification is a mandatory step in our KYC process. Where bos27 becomes aware or has reasonable grounds to suspect that personal data has been collected from a person under the age of 21, we will:

• Immediately suspend the relevant account pending investigation
• Delete all personal data associated with the account to the extent permitted by AML obligations
• Reverse any deposits made to the account to the original payment source
• Void and forfeit any bonus balances or winnings associated with the underage account

If you are a parent or guardian and believe your child has registered a bos27 account, please contact us immediately at [email protected] or via our 24/7 live chat. We take underage gambling extremely seriously and will act on all credible reports without delay.

The Platform integrates third-party services to deliver games, process payments, and maintain security. Once you interact with a third-party service embedded in or linked from bos27 — such as a live casino stream delivered by Evolution Gaming or a payment interface operated by your bank — that provider's own privacy policy governs the data they collect directly from you.

bos27 is not responsible for the privacy practices of third-party payment providers (BCA, BRI, BNI, Mandiri, OVO, DANA, GoPay, ShopeePay, LinkAja), game studios (Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, Pocket Games Soft), or any other independent third party. We encourage you to review the privacy policies of any third-party service you interact with.

bos27.pro does not embed third-party advertising networks, social media tracking pixels, or affiliate tracking scripts that would transmit your personal data to unaffiliated commercial parties without your knowledge.

bos27 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or Platform features. The "Last Updated" date at the top of this document will be revised accordingly.

Where changes are material — for example, where we introduce a new purpose for processing, share data with a new category of third party, or alter your rights in a significant way — we will provide at least 7 days' advance notice via a prominent notice on the Platform homepage and/or by direct communication to your registered contact details.

Your continued use of the Platform after a Privacy Policy update has taken effect constitutes your acceptance of the revised terms. If you do not agree to the updated Privacy Policy, you must cease using the Platform and contact our support team to close your account.

For all data protection enquiries, rights requests, or privacy complaints, please contact bos27's Data Protection Officer (DPO) through the following channels:

• Email: [email protected] — use subject line "Privacy / DPO Request — [Your Username]"
• Live Chat: Available 24/7 directly from the bos27 Platform. State that you have a data protection or privacy request and you will be escalated to a trained compliance team member.
• WhatsApp: Our Indonesian-speaking support team is reachable around the clock and can initiate formal data rights requests on your behalf.

bos27 will acknowledge all DPO communications within 5 business days and aim to resolve standard data rights requests within 30 calendar days. Complex requests may take up to 60 calendar days, with advance notice provided to you.