Bostoto Privacy Policy

Bostoto operates an online sports betting, live football and casino platform accessible at bostoto.cam, serving players from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and across Malaysia. This Privacy Policy describes how bostoto collects, uses, stores, shares and protects personal information in connection with the registration and use of any bostoto service.

By creating an account, making a MYR deposit, placing a wager or otherwise using bostoto, you acknowledge that you have read and understood this policy. If you do not agree with how bostoto handles personal information as described here, you should not register or continue using the platform.

This policy applies to data collected through the bostoto website and any associated account management interface. References to "you", "your" or "player" mean any individual who accesses or registers on bostoto. References to "bostoto", "we", "us" or "our" mean the operator of the platform.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• Personal data means any information relating to an identified or identifiable natural person, including name, contact details, payment information and device identifiers.
• Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure, restriction, erasure or destruction.
• Account means the registered bostoto profile through which a player accesses sports betting, live casino and related services.
• Payment method means a bank account, e-wallet or transfer service linked to a bostoto account, including Maybank2u, CIMB, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow and FPX.
• Cookies means small data files placed on a device by the bostoto website to maintain sessions and collect usage information.
• Third-party service provider means a company engaged by bostoto to provide technical, payment, fraud prevention, analytics or support services in connection with platform operations.

3.1 Information You Provide Directly

When you register with bostoto, you supply personal information that may include your full legal name, date of birth, Malaysian identity document number, residential address, email address, mobile number and preferred payment method details. You may later be asked to provide supporting documents such as a copy of your MyKad, passport, driver's licence or a recent utility bill or bank statement to complete identity verification.

When you deposit or withdraw in MYR, bostoto collects transaction details including the amount, payment method, bank or e-wallet reference, timestamp and account ownership evidence required by fraud prevention or anti-money-laundering procedures.

When you contact support, bostoto retains the content of your communication together with related account context and resolution records.

3.2 Information Collected Automatically

Bostoto and its third-party service providers automatically collect technical information when you access the platform. This includes IP address, device type and model, operating system, browser type and version, network carrier, session duration, pages viewed, events interacted with, referring URL and geolocation at the level of city or region.

Wagering history, bet amounts, game choices, withdrawal patterns, promotional participation and responsible gambling tool usage are recorded as part of account records necessary for platform operations, security and regulatory compliance.

3.3 Information from Third Parties

Bostoto may receive identity or fraud-related information from payment processors, banking partners operating FPX, DuitNow or e-wallet services, and identity verification or screening services where permitted by applicable law.

Bostoto uses personal data for the following purposes:

• Account creation and management — establishing your bostoto account, maintaining your profile, verifying identity and age, and administering login credentials.
• Payment processing — facilitating MYR deposits through Maybank2u, CIMB, Public Bank, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX and other available methods, and processing withdrawal requests to your nominated account.
• Fraud prevention and security — detecting suspicious activity, verifying payment ownership, monitoring for duplicate registrations and protecting account integrity.
• Legal and regulatory compliance — meeting anti-money-laundering, know-your-customer and other obligations imposed by the licensing regime under which bostoto operates.
• Sports betting and casino operations — recording wagers on Liga Super Malaysia, EPL, UFC, live football and casino markets, settling results, managing bonuses and maintaining accurate account balances.
• Responsible gambling — monitoring account patterns for indicators of problem gambling, applying player-requested limits, maintaining self-exclusion records and communicating relevant support information.
• Customer support — investigating account queries, payment questions, technical issues and complaints submitted by email or the support interface.
• Service improvement — analysing aggregated usage data to improve site performance, navigation, payment flows and game availability.
• Marketing communications — sending promotional updates and bonus information to players who have not opted out, consistent with applicable permissions.

Bostoto processes personal data on the following grounds:

• Contractual necessity — processing required to provide the bostoto account, execute MYR transactions and deliver sports betting and casino services as agreed in the Terms & Conditions.
• Legal obligation — processing necessary to comply with anti-money-laundering, know-your-customer, licensing and record-keeping requirements applicable to the jurisdiction under which bostoto operates.
• Legitimate interests — fraud detection, security monitoring, responsible gambling management, platform improvement and aggregated analytics, balanced against the privacy interests of players.
• Consent — where bostoto has specifically requested and recorded your agreement, such as for direct marketing communications. Consent may be withdrawn at any time by contacting support.

Bostoto does not sell personal data to third parties. Data may be shared in the following circumstances:

• Payment service providers — banks, FPX operators, DuitNow infrastructure providers, Touch 'n Go eWallet, Boost, GrabPay and other processors required to execute MYR transactions.
• Identity and fraud screening services — suppliers engaged to conduct know-your-customer checks, age verification and financial crime monitoring.
• Technology and hosting providers — infrastructure, cloud hosting, content delivery and platform security companies operating under data processing agreements with bostoto.
• Regulatory and legal authorities — where required by the applicable licensing regime, a court order, law enforcement request or other legal obligation.
• Auditors and legal advisers — professional service providers engaged in connection with platform compliance, dispute resolution or corporate matters, subject to confidentiality obligations.

Where personal data is transferred to service providers located outside Malaysia, bostoto requires that appropriate contractual or equivalent safeguards are in place to ensure a comparable level of data protection.

Bostoto retains personal data for as long as your account remains active and for a further period required to meet licensing, anti-money-laundering or financial record-keeping obligations. Minimum retention periods are typically five to seven years from the date of the last account transaction, in accordance with the requirements of the international licensing framework applicable to bostoto.

Where data is no longer required and no legal obligation requires its retention, bostoto applies deletion or anonymisation procedures. Anonymised aggregated data used for statistical analysis does not identify individual players and may be retained indefinitely.

Bostoto implements technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration or destruction. These measures include transport-layer encryption for all website connections, secure credential storage, access controls limiting data access to authorised personnel, and fraud monitoring on payment and account activity.

You are responsible for protecting your own login credentials, one-time authentication codes and device access. Bostoto will never ask for your password by email, live chat or telephone. If you suspect that your account has been compromised, contact bostoto support immediately.

No method of electronic transmission or storage is completely secure. Bostoto cannot guarantee absolute security but applies commercially reasonable protective measures and reviews them periodically.

Bostoto uses cookies and similar technologies to operate the platform, maintain your session, remember preferences and measure usage patterns. The principal categories of cookies used are:

• Strictly necessary cookies — required for login sessions, security tokens and core platform functionality. These cannot be disabled without preventing normal account use.
• Performance and analytics cookies — used to measure page load times, navigation paths, error rates and game loading performance to improve the platform experience.
• Functional cookies — used to remember your language setting, currency display preference and previously selected options to improve usability across sessions.
• Marketing cookies — where applicable, used to measure the effectiveness of communications or promotional campaigns associated with your bostoto account.

You may manage cookie settings through your browser controls. Disabling certain cookies may affect the functionality of the platform, including session continuity and payment flows. Continued use of bostoto with cookies enabled constitutes consent to their use as described.

Subject to applicable law and the retention obligations described in Section 7, you have the following rights regarding personal data held by bostoto:

• Right of access — you may request a copy of the personal data bostoto holds about you.
• Right to rectification — you may ask bostoto to correct inaccurate or incomplete personal data.
• Right to erasure — you may request deletion of personal data where it is no longer required for the purpose for which it was collected, subject to legal retention obligations.
• Right to restriction — you may ask bostoto to suspend processing of your data in certain circumstances while a query or objection is reviewed.
• Right to object — you may object to processing based on legitimate interests, including direct marketing communications.
• Right to withdraw consent — where processing relies on your consent, you may withdraw it at any time without affecting processing that took place before withdrawal.

To exercise any of these rights, contact bostoto support at the address shown in Section 13. Bostoto will respond within a reasonable period and may request identity verification before releasing or modifying data.

Bostoto is strictly for adults aged 21 and above. Bostoto does not knowingly collect personal data from persons under 21 years of age. If bostoto identifies or suspects that an account holder is under 21, it will suspend the account, conduct identity verification and, where a minor is confirmed, close the account and handle associated funds in accordance with applicable obligations.

Parents or guardians who believe a minor has accessed bostoto should contact support immediately. Age verification documents may be requested at registration or at any time during account use.

Bostoto may update this Privacy Policy from time to time to reflect changes in data handling practices, platform features, legal requirements or operational procedures. Material changes may be communicated by a notice displayed within the bostoto account interface or on the website.

The effective date shown at the top of this page indicates when the current version came into force. Continued use of bostoto after the updated policy takes effect constitutes acceptance of the revised terms. If you do not accept a revised policy, you should cease using bostoto and may request account closure in accordance with the Terms & Conditions.

For questions, data subject rights requests or privacy-related complaints, contact the bostoto support team. Please include your registered account email address, a description of your query and any relevant transaction or account reference to help us respond promptly.

Do not include passwords, one-time codes or sensitive payment credentials in any support communication.