Privacy Policy – bonos888 Data Practices

1. Scope and Application

This Privacy Policy applies to all personal data processed by bonos888 in connection with the operation of the bonos888 online gaming platform at bonos888.co ("the Platform"). It applies to all registered players, prospective players who submit registration information, and visitors to the bonos888 website. By accessing the Platform, registering an account, or submitting any personal information to bonos888, you acknowledge that you have read and understood this Privacy Policy.

This Policy should be read alongside the bonos888 Terms and Conditions, which govern the contractual relationship between you and bonos888. In the event of any inconsistency between this Policy and the Terms and Conditions on a privacy-related matter, this Privacy Policy shall prevail.

2. Data Controller Identity

bonos888 is the data controller in respect of personal data collected and processed through the Platform. As data controller, bonos888 determines the purposes and means by which your personal data is processed. bonos888 operates under international gaming authority licensing and is subject to the data protection requirements applicable within its licensing jurisdiction.

For all data-related enquiries, including access requests, correction requests, and complaints, please contact the bonos888 Data Protection team via the contact details set out at Section 14 of this Policy.

3. Categories of Personal Data Collected

bonos888 collects and processes the following categories of personal data in connection with the operation of the Platform:

4. How We Collect Your Data

4.1 Data You Provide Directly

The majority of personal data bonos888 holds is provided directly by you during the account registration process, during KYC verification, when making deposits or withdrawals, when contacting customer support, and when participating in promotions. The accuracy of this data is your responsibility; inaccurate data may result in payment delays or account restrictions.

4.2 Data Collected Automatically

When you access the bonos888 Platform, certain technical data is collected automatically by our systems. This includes your IP address, device identifiers, browser attributes, operating system, session duration, pages visited, and in-game activity. This data is collected via server logs, cookies, and similar technologies as described in Section 9 of this Policy.

4.3 Data from Third Parties

bonos888 may receive data about you from third-party payment processors (for transaction verification), identity verification service providers (for KYC purposes), fraud detection partners, and, where applicable, sanctions screening services. Data received from these sources is used solely for the purposes stated in this Policy and is not retained beyond the period necessary for those purposes.

5. Purposes and Legal Bases for Processing

bonos888 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the bonos888 Terms and Conditions — including operating your account, processing payments, settling bets, and providing customer support.
• Legal obligation: Processing required to comply with anti-money laundering (AML) legislation, age verification obligations under international gaming authority licence conditions, and responses to lawful requests from regulatory or law enforcement authorities.
• Legitimate interests: Processing for fraud prevention, platform security monitoring, responsible gaming monitoring, and internal analytics, where such processing does not override your fundamental privacy rights.
• Consent: Processing for direct marketing communications (promotional emails, SMS notifications), which you may withdraw at any time via your Account notification settings without affecting your right to use the Platform.

6. Disclosure of Personal Data to Third Parties

bonos888 does not sell, rent, or trade personal data to third-party marketing organisations. Personal data is disclosed to third parties only in the following circumstances:

• Payment processors and banking partners: FPX network operators, DuitNow infrastructure providers, Touch n Go, Boost, GrabPay, and USDT processing partners receive the minimum financial data required to process your transactions.
• Identity verification providers: KYC document data is shared with licensed identity verification service providers for the sole purpose of verifying your identity in compliance with our licensing obligations.
• Fraud and AML screening services: Transaction and identity data may be processed by fraud detection and anti-money laundering screening tools to identify and prevent financial crime.
• IT infrastructure and cloud service providers: Hosting, database management, and cybersecurity service providers process data on bonos888's behalf under contractual data processing agreements.
• Regulatory and law enforcement authorities: bonos888 will disclose personal data in response to a valid legal request, court order, or regulatory direction, to the extent required by law.

All third-party processors engaged by bonos888 are required to process personal data only for the specified purposes, to maintain appropriate security measures, and to comply with applicable data protection obligations.

7. International Data Transfers

bonos888 operates internationally and may transfer your personal data to service providers located outside of Malaysia. Where such transfers occur, bonos888 ensures that appropriate safeguards are in place, including data processing agreements that impose equivalent data protection standards on the recipient. By registering an Account and using the Platform, you acknowledge that your data may be processed internationally as described in this Policy.

8. Data Retention

bonos888 retains personal data for the period necessary to fulfil the purposes set out in this Policy, subject to the following minimum retention periods driven by legal and regulatory obligations:

• Account and KYC records: Retained for a minimum of five (5) years from account closure, in compliance with anti-money laundering record-keeping requirements under our licensing obligations.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction.
• Responsible gaming records (self-exclusion, limit settings): Retained for a minimum of five (5) years to prevent circumvention of responsible gaming commitments.
• Support correspondence: Retained for three (3) years from the date of the last interaction, for dispute resolution purposes.
• Technical and security logs: Retained for up to twelve (12) months unless extended by an active security investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

9. Cookies and Tracking Technologies

bonos888 uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for Platform functionality, including maintaining your login session, security tokens, and account state. These cannot be disabled without impairing Platform operation.
• Security cookies: Used to detect and prevent fraudulent access, session hijacking, and cross-site request forgery (CSRF) attacks.
• Analytics cookies: Aggregate, anonymised usage data is collected to understand how players interact with the Platform, enabling product improvements. This data is not linked to individual identities.

bonos888 does not deploy third-party advertising or retargeting cookies. You may control cookie settings through your browser's privacy settings. Disabling essential cookies will affect your ability to log in and use the Platform.

10. Your Data Subject Rights

As an individual whose personal data is processed by bonos888, you have the following rights, exercisable by contacting bonos888 via the details in Section 14:

• Right of access: Request a copy of all personal data bonos888 holds about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data, subject to our legal retention obligations (data that must be retained under AML or licensing requirements cannot be deleted prior to the end of the mandatory retention period).
• Right to restriction: Request that processing of your data be restricted pending a resolution of an accuracy dispute or a legitimate interests objection.
• Right to data portability: Request your account and transaction data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including profiling for responsible gaming monitoring purposes.
• Right to withdraw consent: Withdraw consent to marketing communications at any time via your Account notification settings.

bonos888 will respond to verified data subject requests within thirty (30) days. Complex requests may be extended by a further two months with notice. Identity verification will be required before any request is actioned to ensure data is not disclosed to unauthorised parties.

11. Children and Minors

The bonos888 Platform is strictly for individuals aged 21 years and above. bonos888 does not knowingly collect or process personal data from individuals under the age of 21. If bonos888 becomes aware that it has inadvertently collected data from an individual under 21, that data will be deleted immediately and the associated account closed. If you believe a minor has registered on the Platform, please contact bonos888 support immediately.

12. Security Measures

bonos888 implements technical and organisational security measures proportionate to the risk posed by the processing of personal data, including:

• Transport Layer Security (TLS) encryption for all data in transit between your device and bonos888 servers;
• Encryption at rest for sensitive personal and financial data stored in bonos888 databases;
• Role-based access controls limiting staff access to personal data to those with a documented business need;
• Audit logging of all access to personal data records;
• Regular penetration testing and vulnerability assessments of the Platform infrastructure;
• Incident response procedures for detecting, containing, and notifying affected individuals in the event of a personal data breach.

While bonos888 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are encouraged to protect your own bonos888 Account by using a strong, unique password and enabling two-factor authentication.

13. Changes to This Privacy Policy

bonos888 reserves the right to update this Privacy Policy from time to time. Material changes will be communicated to registered players via email or via a prominent notice on the Platform before the revised Policy takes effect. The date of the most recent revision is displayed at the top of this page. Continued use of the Platform following notification of a material change constitutes your acceptance of the revised Privacy Policy. Where changes require renewed consent (for example, for new marketing communications purposes), bonos888 will obtain fresh consent before processing begins.

14. Contact and Complaints

For all data protection enquiries — including access requests, correction requests, erasure requests, or complaints about how bonos888 has handled your personal data — please contact our Data Protection team via live chat support within your bonos888 Account dashboard, or via the email address displayed in the footer of this page. All enquiries will be acknowledged within five (5) business days.

If you are not satisfied with bonos888's response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in the jurisdiction applicable to your complaint, or to the independent dispute resolution service designated under bonos888's international gaming authority licence.