Bones88 Privacy Policy – Malaysia Personal Data Protection

Bones88 collects members' personal data not because we enjoy collecting data — but because it is necessary to provide a safe, fair, and quality service to every one of our Malaysian players. The following are the specific purposes for which this data is collected:

• Account management: To securely create, verify, and maintain your bones88 member account.
• Transaction processing: To process deposits via Touch 'n Go eWallet, GrabPay, DuitNow, FPX, Boost, ShopeePay, and Bank Transfer, as well as to process withdrawals of your winnings.
• Identity verification (KYC): To verify that you are who you claim to be, prevent identity fraud, and meet anti-money laundering (AML) legal requirements.
• Gaming services provision: To give you access to slots, live casino, EPL Sports Betting, badminton, cricket, e-sports, and all other games on bones88.
• Fraud prevention & security: To detect and prevent fraudulent activity, multiple account usage, and hacking attempts on your account.
• Customer support: To enable our Malay-speaking support team to effectively handle your enquiries, complaints, and assistance requests.
• Responsible gambling: To monitor gameplay patterns and identify members who may benefit from self-exclusion or responsible gaming tools.
• Legal compliance: To fulfil reporting obligations to Malaysian regulatory bodies and authorities where required by law.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), bones88 has valid legal grounds for processing your personal data. These grounds are as follows:

• Consent: By registering a bones88 account, you consent to the processing of your personal data for the purposes set out in this Privacy Policy. You may withdraw this consent at any time — though doing so may mean we are no longer able to provide our services to you.
• Contract performance: Some data processing is necessary to fulfil the contract between you and bones88 — for example, processing your deposits and withdrawals.
• Legal obligation: Certain data processing — particularly relating to AML and KYC — is a legal obligation that we are unable to opt out of.
• Legitimate interest: bones88 has a legitimate interest in processing data for platform security, fraud prevention, and service improvement — provided that interest does not override your privacy rights.

The data we collect is used for specific purposes only and does not go beyond its original intent. Here is a more detailed breakdown:

For account management and security: Your personal identification data and login credentials are used to verify your identity each time you log in, process account recovery requests, and detect unauthorised access attempts. bones88's two-factor authentication (2FA) system uses your registered phone number to send verification codes.

For payment processing: Your e-wallet or bank account details are used solely to process deposits and withdrawals. bones88 does not store credit card numbers or bank account details directly — all transactions are handled through PCI-DSS certified third-party payment gateways.

For personalising your experience: Your gameplay history allows us to surface relevant games, recommend slots based on your preferences, and tailor bonus offers to match your playing style. This is to enhance your experience — not to manipulate your gaming habits.

For service communications: Your phone number and email address are used to send important account notifications — such as deposit confirmations, successful withdrawal alerts, and security notices. These are not marketing communications and cannot be unsubscribed from, as they are essential to the security of your account.

For analytics and improvement: Aggregated platform usage data (not individual-level) is used to understand usage patterns, identify technical issues, and make decisions about new features to introduce. Individual data is never used for this purpose in isolation.

Bones88 does not sell your personal data. However, there are limited situations where sharing your data with specific parties is necessary to deliver our services:

• Technology service providers: Server hosting companies, payment gateway providers (for processing Touch 'n Go, GrabPay, DuitNow, FPX, and similar transactions), and security software vendors that support our platform operations. All third parties are bound by strict confidentiality agreements and may only use your data for purposes we have specified.
• Game providers: For live casino games and slots, certain gameplay session data is shared with providers such as Evolution Gaming, Pragmatic Play, and SA Gaming for technical and dispute resolution purposes. These providers maintain their own privacy policies and are subject to strict confidentiality requirements.
• Regulatory bodies and authorities: bones88 may be required by law to disclose certain data to Malaysian authorities or regulatory bodies — for example, in financial crime investigations or money laundering cases. Such disclosures are made only where there is a clear legal obligation to do so.
• Business transfers: If bones88 undergoes a merger, acquisition, or asset sale, member data may be transferred as part of those business assets. In such circumstances, you will be notified in advance and the same or stronger privacy protections will continue to apply.

Bones88 stores members' personal data on secure servers protected by multiple layers of security. Here is how and how long your data is retained:

Data retention period: Active account data is retained for the duration of your membership and for up to 5 years after account closure to meet legal requirements. Financial transaction data is retained for 7 years in line with the Companies Act and Malaysia's AML regulations. Customer support communication data is retained for 3 years from the date of the last communication.

Technical security measures implemented:

• 256-bit SSL/TLS encryption for all data in transit
• AES-256 encryption for data stored in the database
• Role-Based Access Control — bones88 staff can only access the data required to perform their specific responsibilities
• Continuous access log auditing to detect any suspicious access
• Regular data backups stored at secure, separate locations
• Annual third-party penetration testing by independent specialists
• Intrusion detection system (IDS) active 24/7

While bones88 implements comprehensive security measures, no system can be guaranteed 100% secure. In the event of a data breach that affects you, we will notify you within 72 hours of becoming aware of it — in line with industry best practices.

Under Malaysia's PDPA and global data protection best practices, you have the following rights regarding your personal data at bones88. All requests relating to these rights can be sent to us at support@bones88.best and will be processed within 14 working days.

Bones88 uses cookies to enhance your experience on our platform. Cookies are small text files stored on your device when you visit our website. Below are the types of cookies we use:

You can manage or delete cookies through your browser settings. However, disabling essential cookies may affect the core functionality of the bones88 platform — including the ability to remain logged in.

Due to the global nature of the online casino industry, some of your personal data may be processed or stored outside Malaysia — particularly by international game providers such as Evolution Gaming and Pragmatic Play, which operate servers across multiple countries.

Bones88 ensures that any cross-border data transfers are carried out with adequate safeguards:

• All data recipients outside Malaysia are bound by data processing agreements that establish protection standards equivalent to or higher than Malaysia's PDPA.
• Data transfers only take place to countries or organisations that provide adequate data protection — or where appropriate contractual safeguards are in place.
• You have the right to inquire about the specific safeguards used for any cross-border data transfers. Reach us at support@bones88.best for more information.

Bones88 strictly does not accept registration or use of the platform by individuals under the age of 18. This is a non-negotiable policy and forms part of our commitment to responsible gaming.

We do not knowingly collect personal data from underage children or minors. Should we discover that we have collected personal data from anyone under the age of 18, we will promptly delete that data and close the account in question.

Bones88 may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data protection best practices.

• Members will be notified of any significant changes to this Privacy Policy via in-platform notifications or their registered email at least 14 days before it takes effect.
• Minor changes such as spelling corrections or clarification of terms may be made without prior notice.
• The date of the most recent update is always displayed at the top of this page.
• Continued use of the bones88 platform after changes take effect will be considered your acceptance of the updated policy.
• Previous versions of this Privacy Policy are available upon request via email for reference purposes.

If you have any questions, concerns, or requests regarding this Privacy Policy or how bones88 handles your personal data, please contact us through any of the channels below. Our team operates 24 hours a day and will aim to respond within 24 hours for general enquiries, and 14 days for formal data rights requests.