Privacy Policy boba55 — Malaysia Member Data Protection

Boba55 collects your personal information through several channels — during the account registration process, during day-to-day platform use, through customer support, and via automated technologies such as cookies. The following are the categories of information we collect:

We only collect information that is genuinely necessary for the stated purposes. boba55 does not collect sensitive information such as biometric data, medical records or your political views. All data collection processes comply with Malaysia's Personal Data Protection Act (PDPA).

While you use the boba55 platform, our systems also automatically record technical information including your IP address, browser type and version, device operating system, pages visited, and access times. This information is used solely to enhance platform security and performance.

Every piece of information collected by boba55 is used for a lawful and specific purpose. We do not process your data excessively and always ensure data usage is proportionate to actual needs. The following are the primary purposes for which your data is used:

• Account Management: Create, verify, and maintain your boba55 member account, including the required KYC (Know Your Customer) process.
• Transaction Processing: Process your deposits, withdrawals, and all financial activity via DuitNow, FPX, Touch 'n Go eWallet, GrabPay, and Boost — quickly and securely.
• Platform Security: Detect and prevent fraud, money laundering, multi-account abuse, and other suspicious activities that could compromise platform security.
• Customer Support: Handle your inquiries, complaints, and support requests efficiently through our 24/7 live chat channel.
• Legal Compliance: Meet regulatory obligations, anti-money laundering (AML) reporting, and lawful requests from authorities.
• Service Improvement: Analyze platform usage patterns to continuously improve the user experience, game performance, and system reliability.
• Important Communications: Send you security notifications, policy updates, transaction details, and important account alerts.

Boba55 does not sell or rent members' personal data to any third party. However, there are limited situations where we need to share certain information with trusted partners or authorities to ensure smooth platform operations and legal compliance:

• Payment Providers: Required financial information is shared with our integrated payment service providers (DuitNow, FPX, Touch 'n Go, GrabPay, Boost) solely to process your transactions.
• Game Providers: Minimum necessary data is shared with our licensed game providers to ensure your game sessions, wins and wagering history are recorded accurately.
• Security Services: We use third-party fraud detection and identity verification services that comply with strict security standards.
• Legal Authorities: boba55 will disclose required information when mandated by court order, regulatory requirements, or a lawful request from a law enforcement agency.

All boba55 third-party partners are bound by strict confidentiality agreements and are only permitted to use your data for specified purposes. We conduct regular audits of all service providers to ensure their data protection standards consistently meet our requirements.

Boba55 continuously invests in cutting-edge cybersecurity infrastructure to ensure your personal data and financial information are always protected. We adopt a layered approach to data security encompassing technology, procedures, and staff training.

• 256-bit SSL Encryption: All data transmitted between your device and boba55 servers is encrypted using TLS 1.3 protocol with banking-grade 256-bit encryption. This means your information cannot be read even if intercepted.
• Two-Factor Authentication (2FA): An extra layer of protection via 2FA shields your account from unauthorized access even if your password is compromised.
• 24/7 Monitoring: The boba55 security team monitors systems around the clock every day to detect and respond to any security threats in real time.
• Data Segregation: Sensitive financial data is stored in a separate server environment isolated from the platform's main operating systems.
• Regular Security Audits: Independent security assessments are conducted periodically by accredited third-party cybersecurity firms to identify and address any system vulnerabilities.

Boba55 uses cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit the boba55 website. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session verification, language preference memory and security. These cookies cannot be disabled.
• Performance Cookies: Collect anonymous data on how you use the boba55 platform to help us improve website performance and responsiveness.
• Functional Cookies: Remember your preferences such as display language, display settings, and other choices to deliver a more personalized experience.
• Analytics Cookies: Helps us understand usage patterns, most-visited pages, and user flows within the platform for continuous improvement.

You can manage or delete cookies at any time through your web browser settings. However, disabling essential cookies may affect certain features of the boba55 platform. Modern browsers offer detailed cookie controls — please refer to your browser's help guide for more information.

As a boba55 member, you have certain rights over your personal data under Malaysia's Personal Data Protection Act (PDPA). boba55 fully respects these rights and provides easy channels for you to exercise them:

Boba55 retains your personal data only for as long as necessary to fulfil the purposes stated in this Privacy Policy, or as required by applicable laws and regulations. The following are our data retention guidelines:

• Active Account Data: For as long as your account remains active, all related personal data is retained to ensure uninterrupted and seamless service.
• Financial Transaction Records: Retained for a minimum of 7 years from the transaction date in accordance with Malaysia's anti-money laundering (AML) and tax legal requirements.
• Activity & Security Log: Retained for 24 months from the date of activity for security audit and investigation purposes if required.
• Data After Account Closure: Upon voluntary account closure, boba55 will delete or anonymise your personal data within 90 days, except for data that must be retained for legal reasons.
• Dispute Records: Information related to any dispute or legal case is retained until the matter is fully resolved and the appeal period has lapsed.

When your data is no longer needed, boba55 ensures it is securely deleted using methods that comply with recognised information security standards.

Boba55 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or improvements to our services. Members will be notified of any material changes via in-account notifications or email at least 7 days before the changes take effect.

The "Last Updated" date shown at the top of this page will always be updated to reflect the latest version of this document. Continued use of the boba55 platform after changes are published constitutes your acceptance of the amended Privacy Policy.

If you have any questions, concerns or requests regarding this Privacy Policy or the processing of your personal data by boba55, we are here to help. boba55's experienced support team can be reached through multiple channels:

• Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the bottom-right corner of the boba55 platform. Average response time is under 3 minutes.
• Email: Send an email to [email protected] with the subject "Privacy Policy Inquiry" for written requests requiring documentation.
• FAQ: Visit page FAQ us for answers to frequently asked questions about privacy and account security.

Boba55 is committed to responding to all privacy-related enquiries within 3 business days. For formal requests requiring action under the PDPA — such as data access, correction, or deletion — the processing period is up to 21 business days from the date a complete request is received.