Privacy Policy

Throughout this Privacy Policy, the following terms carry the meanings ascribed to them below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, either directly (such as a full name or national ID number) or indirectly (such as an IP address combined with a username).
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
• "Data Controller" means boss29, the entity that determines the purposes and means of processing Personal Data collected via the Platform.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of boss29 in accordance with our documented instructions and this Privacy Policy.
• "Member" / "You" means any individual who has registered an account on the Platform or otherwise interacts with our services.
• "Platform" means the boss29 website at https://boss29.cam and all associated sub-domains, mobile interfaces, and applications.
• "KYC Data" means identity and age verification documents submitted by a Member pursuant to our Know Your Customer process, including government-issued photo ID, proof of address, and selfie verification images.
• "Sensitive Data" means a special category of Personal Data that warrants heightened protection, including biometric identification data, financial account details, and identity document numbers.

boss29 acts as the Data Controller for all Personal Data collected via the Platform. As Data Controller, boss29 is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently, and that appropriate technical and organisational security measures are in place at all times.

Where boss29 engages third-party vendors — such as payment processors, identity verification providers, fraud detection services, or cloud infrastructure providers — those vendors act as Data Processors. boss29 maintains written Data Processing Agreements with all such Processors, contractually requiring them to handle your Personal Data solely in accordance with our instructions and this Privacy Policy.

For all data-related inquiries, correction requests, deletion requests, or complaints, please contact our Data Protection team at: [email protected]

boss29 collects the following categories of Personal Data in the ordinary course of operating the Platform:

We do not knowingly collect sensitive personal data beyond what is strictly required for identity verification and fraud prevention. We do not collect racial or ethnic origin data, religious beliefs, health data, or political opinions.

boss29 collects Personal Data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or participating in a promotion.
• Automated collection: Technical and Usage Data gathered automatically when you access the Platform, via server logs, cookies, pixel tags, and similar tracking technologies. See Section 11 for full details on our cookie practices.
• Third-party sources: Identity verification agencies and fraud-screening services may share verification results or risk scores with us. Payment processors such as those facilitating BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, and GoPay transactions provide transaction confirmation data. We do not receive your full bank account credentials from these providers.
• Publicly available sources: In limited circumstances — for example, where we need to verify information provided during KYC — we may consult publicly available government or corporate registries.

boss29 processes your Personal Data for the following specific, explicit, and legitimate purposes:

• Account creation and management: To register your account, authenticate your identity at login, and manage your account settings and preferences.
• KYC and age verification: To confirm that you are at least 21 years of age and that the identity you have provided is genuine, in compliance with our regulatory obligations and our Responsible Gaming policy.
• Transaction processing: To receive deposits from and process withdrawals to your nominated Indonesian bank account or e-wallet, and to maintain accurate financial records of all transactions.
• Service delivery: To make our sports betting, live casino, slots, togel (traditional numbers lottery), and other gaming products available to you on the Platform.
• Customer support: To respond to your inquiries, resolve disputes, and handle complaints through our 24/7 Indonesian-speaking support team.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, collusion, bonus abuse, and other prohibited conduct as described in our Terms & Conditions.
• Responsible Gaming compliance: To monitor wagering patterns that may indicate problem gambling behaviour, to apply self-exclusion restrictions where requested, and to enforce deposit and loss limits set by the Member.
• Legal and regulatory compliance: To comply with applicable laws, respond to lawful requests from competent authorities, and fulfil our obligations under international gaming regulations.
• Platform improvement: To analyse usage patterns, identify technical issues, and make data-informed decisions about how to improve the features and performance of the Platform.
• Marketing communications: To send you relevant promotional offers, bonus notifications, and seasonal campaign messages — but only where you have not opted out of such communications. You may unsubscribe at any time by contacting support.

boss29 relies on the following legal bases to process your Personal Data, depending on the specific purpose involved:

• Contractual necessity: Processing required to perform our obligations under the Member agreement — including account management, transaction processing, and service delivery — is carried out on the basis that it is necessary to fulfil the contract between you and boss29.
• Legal obligation: Processing necessary for us to comply with applicable law — such as retaining KYC documents, maintaining transaction records, and responding to lawful authority requests — is carried out on the basis of legal obligation.
• Legitimate interests: Processing carried out for fraud prevention, platform security, abuse detection, and internal analytics is based on our legitimate interest in operating a safe and fair betting environment, balanced against your right to privacy. We conduct a proportionality assessment before relying on this basis.
• Consent: Where we send you optional marketing communications or deploy non-essential cookies, we do so on the basis of your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

boss29 does not sell or rent your Personal Data to any third party. We share data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment processors: To facilitate deposits and withdrawals via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, Bank Danamon) and e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja), we share the minimum necessary financial and identity data with our authorised payment processing partners.
• Identity verification providers: To carry out KYC checks, we share your submitted identity documents and personal details with accredited identity verification service providers, who process this data solely on our behalf.
• Fraud and risk screening services: We share Technical Data, IP addresses, device fingerprints, and transaction patterns with fraud detection partners to identify and prevent prohibited conduct on the Platform.
• Game content providers: Game studios such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft may receive your session identifiers and wagering data for the purpose of delivering their game content within the Platform. These providers operate under their own data protection frameworks and are contractually bound to handle data securely.
• Cloud infrastructure providers: The Platform is hosted on secure cloud infrastructure. Our hosting provider processes server logs and technical data on our behalf under a strict Data Processing Agreement.
• Law enforcement and regulatory authorities: We will disclose Personal Data to competent government authorities, courts, or regulators where we are required to do so by applicable law, valid court order, or official regulatory directive. Where legally permissible, we will notify you of such a disclosure.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of boss29's business assets, your Personal Data may be transferred to the acquiring entity, subject to equivalent data protection obligations.

All third-party Data Processors are contractually required to implement appropriate technical and organisational security measures and to process your data solely for the purposes specified by boss29.

boss29 operates as an international platform, and some of our Data Processors may be located in countries outside of Indonesia. Where Personal Data is transferred internationally, boss29 ensures that appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) or equivalent contractual protections approved by the applicable supervisory authority;
• Transfers to countries or jurisdictions recognised as providing an adequate level of data protection by relevant regulatory bodies;
• Binding corporate rules where transfers are made within a group of companies.

You may request details of the specific safeguards applicable to any international transfer of your Personal Data by contacting us at the address provided in Section 15.

boss29 retains your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting anonymised data may be retained indefinitely for aggregate statistical analysis.

As a Member of boss29, you hold the following rights with respect to your Personal Data. To exercise any of these rights, please contact our support team using the details in Section 15. We will acknowledge your request within 5 business days and aim to resolve it within 30 calendar days.

boss29 uses cookies and similar tracking technologies on the Platform to ensure it functions correctly, to secure your session, and to analyse how Members use our services. The following categories of cookies are in use:

• Strictly necessary cookies: These are essential for the Platform to operate. They manage your login session, maintain your Account authentication state, and enable core security features. These cookies cannot be disabled without preventing you from using the Platform.
• Functional cookies: These remember your preferences — such as your preferred language, display settings, and notification choices — to personalise your experience. You may disable these, but doing so may reduce Platform functionality.
• Analytics cookies: These collect anonymised or pseudonymised usage data — such as pages visited, session duration, and feature interactions — to help us understand how Members use the Platform and identify areas for improvement. No personally identifiable data is shared with analytics providers through these cookies.
• Fraud prevention cookies: These track device fingerprints, IP addresses, and behavioural signals across sessions to detect suspicious patterns, prevent account takeover, and identify potential bonus abuse.

You may manage your cookie preferences through your browser settings at any time. Blocking all cookies will prevent you from logging in to your boss29 Account. Detailed cookie names, durations, and provider information are available on request from our support team.

The Platform is strictly intended for adults aged 21 and over. boss29 does not knowingly collect Personal Data from any person under the age of 21. If we discover or are notified that we have inadvertently collected Personal Data from an individual under 21, we will immediately close the relevant Account, delete all associated Personal Data, and refund any net deposited funds after deducting any winnings generated.

If you believe that a person under the age of 21 has registered an account on the Platform, please notify us immediately at [email protected] so that we can take appropriate action. We take our obligation to prevent underage gambling with the utmost seriousness.

boss29 implements a comprehensive suite of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit TLS/SSL encryption on all data transmissions between your device and our servers.
• AES-256 encryption at rest for all stored Personal Data and KYC documents on our secure cloud infrastructure.
• Multi-factor authentication (MFA) available to all Members for Account login, strongly recommended for enhanced security.
• Role-based access controls limiting employee access to Personal Data strictly to those whose job functions require it, enforced through least-privilege principles.
• Continuous intrusion detection and monitoring systems scanning for anomalous activity across our infrastructure 24/7.
• Regular independent security audits and penetration testing carried out by accredited third-party cybersecurity firms.
• Incident response procedures enabling us to detect, contain, and notify Members of any data breach in a timely manner.

While we implement these robust measures, no digital system can guarantee absolute security. You play an important role in protecting your own data by using a strong, unique password for your boss29 Account and by not sharing your login credentials with any other person.

boss29 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered Members by email to their registered address and by displaying a prominent notice on the Platform for a period of at least 14 days following the update.

The "Last Updated" date shown at the top of this page indicates when the current version took effect. We encourage you to review this Privacy Policy periodically to stay informed of how we are protecting your data. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgment of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the boss29 Data Protection team using the details below. We are committed to responding to all data-related inquiries within 5 business days.

Customer Support: Available 24/7 via live chat on the Platform. Native Indonesian-speaking agents are available around the clock (WIB, UTC+7) to assist with any query, including data rights requests.

Email: [email protected] — please include "Privacy Request" in your subject line, together with your registered username and Account ID, to ensure your query is directed to the Data Protection team promptly.

Complaints: If you are not satisfied with our handling of your Personal Data or our response to a data rights request, you have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction. We would, however, appreciate the opportunity to address your concerns directly before you approach a regulatory authority, and we commit to handling all complaints fairly and transparently.