Privacy Policy

This Privacy Policy ("Policy") is issued by Boda8 ("Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://boda8.cam ("Platform"). This Policy applies to all personal data collected from individuals ("Users", "you") who visit, register on, or interact with the Platform, including through any associated customer support channels.

Boda8 takes data protection seriously. We operate under internationally recognised data protection principles and apply appropriate technical and organisational measures to safeguard the personal information entrusted to us. This Policy is designed to give you a clear, honest account of what data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to your data.

By using the Boda8 Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the practices described in this Policy, you should discontinue use of the Platform. For questions that are not addressed in this Policy, please contact our support team as described in Section 15.

The following terms have specific meanings throughout this Policy:

Boda8 collects personal data across several categories depending on the nature of your interaction with the Platform. The following sets out the categories of data we may collect and hold:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued identification
• Date of birth (for age verification — users must be 21 or older)
• Residential address, including city (e.g., Kuala Lumpur, Penang, Petaling Jaya, Johor Bahru, Shah Alam) and postcode
• Email address and mobile phone number
• Nationality and country of residence

3.2 Account & Authentication Data

• Username and encrypted password credentials
• Account creation date and registration IP address
• Security question responses and two-factor authentication records
• Login history, session timestamps, and device fingerprint data

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts in MYR, timestamps, and payment channel used (e.g., Touch 'n Go eWallet, DuitNow, FPX, Maybank2u, CIMB Clicks, Boost, GrabPay)
• Payment method identifiers (e-wallet registered mobile number, bank account last four digits) — we do not store full card numbers or full bank account details
• Cryptocurrency wallet addresses used for BTC or USDT transactions
• Bonus and promotional credit history

3.4 KYC Verification Documents

• Copies of government-issued photo identification (Malaysian MyKad, passport, driving licence)
• Proof of address documents
• Payment method ownership evidence as required for withdrawal verification

3.5 Technical & Usage Data

• IP address, geolocation data (country/city level), and device type
• Browser type, operating system, and screen resolution
• Pages visited, game sessions initiated, session duration, and clickstream data
• Error logs and crash reports where applicable

3.6 Communications Data

• Contents of live chat conversations with our support team
• Email correspondence sent to or from Boda8 support channels
• Feedback, complaints, and dispute records

We collect personal data through the following mechanisms:

• Direct Submission: Data you provide during account registration, KYC verification, deposit and withdrawal requests, and communications with our support team.
• Automated Collection: Technical and usage data collected automatically when you access the Platform, including via cookies, pixel tags, and server-side logging. See Section 9 for full details on our use of cookies.
• Payment Processors: Transaction confirmation and status data shared by payment service providers (e.g., FPX gateway, e-wallet operators) in connection with deposits and withdrawals you initiate.
• Identity Verification Partners: Confirmation data returned by our KYC verification service providers following document checks. We receive a verification outcome and relevant data fields, not raw document copies held by third parties.
• Fraud Prevention & Security Systems: Risk signals and device reputation data from fraud prevention services used to protect your account and the integrity of our Platform.

Boda8 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

The personal data we collect is used for the following purposes:

• Account Management: Creating, maintaining, and administering your Boda8 account, including processing login authentication, managing your balance, and recording your gaming activity.
• Payment Processing: Facilitating deposits and withdrawals via Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank Online, Hong Leong Connect, and cryptocurrency.
• Identity Verification: Conducting KYC checks to verify your identity and age (minimum 21 years), comply with anti-money laundering obligations, and prevent fraud.
• Customer Support: Responding to your enquiries, resolving disputes, and providing technical assistance in English, Bahasa Melayu, or Mandarin.
• Responsible Gaming: Monitoring account activity patterns to identify indicators of problem gambling behaviour and applying the appropriate responsible gaming tools where necessary.
• Security & Fraud Prevention: Detecting and investigating suspicious activity, unauthorised access attempts, bonus abuse, and other violations of our Terms & Conditions.
• Platform Improvement: Analysing usage patterns, technical performance data, and player feedback to improve the quality and reliability of our services.
• Marketing Communications: Sending promotional communications, bonus offers, and platform updates, but only where you have provided explicit consent and have not subsequently withdrawn that consent.
• Legal & Regulatory Compliance: Fulfilling obligations imposed by applicable law, court orders, or requests from competent regulatory or law enforcement authorities.

Boda8 does not sell your personal data to third parties. We do not share your information with advertisers or data brokers. We may, however, disclose your personal data to the following categories of recipients where strictly necessary:

• Payment Service Providers: Malaysian payment gateway operators and e-wallet platforms (including FPX, DuitNow, and e-wallet operators) receive transaction data necessary to process your deposits and withdrawals. Each provider is bound by their own data protection obligations.
• KYC & Identity Verification Providers: Third-party verification services that process your identity documents on our behalf to confirm eligibility and comply with AML requirements. These providers act as data processors under contractual data protection agreements with Boda8.
• Cloud Infrastructure & Technology Providers: Hosting, database, and security service providers that process data on our behalf to operate and maintain the Platform. All such providers are vetted and bound by data processing agreements.
• Fraud Prevention & Security Services: Third-party providers of fraud detection, device intelligence, and risk-scoring services that help us protect the Platform and your account.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or regulatory directive, we may disclose personal data to competent authorities. We will disclose only what is legally required and, where permitted, will notify you of such disclosure.
• Corporate Transactions: In the event of a merger, acquisition, or sale of substantially all of Boda8's assets, user data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

Boda8 operates using infrastructure that may be located in jurisdictions outside Malaysia. As a result, your personal data may be transferred to and processed in countries other than your country of residence. These transfers are made where necessary to deliver the services described in this Policy.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, which may include: contractual clauses that impose data protection obligations equivalent to internationally recognised standards; transfers to jurisdictions that have been assessed as providing an adequate level of data protection; or other legally recognised transfer mechanisms.

By using the Boda8 Platform, you acknowledge and consent to the international transfer of your personal data as described in this section, subject to the safeguards described above.

The Boda8 Platform uses cookies and similar tracking technologies to deliver, maintain, and improve the Platform experience. The following categories of cookies are used:

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use the Platform. We do not use advertising or third-party marketing cookies.

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law or regulatory obligations. The following general retention periods apply:

• Active Account Data: Retained for the full duration of your active account relationship with Boda8.
• Transaction Records: Financial transaction records are retained for a minimum of five years from the date of the transaction, in compliance with anti-money laundering record-keeping obligations.
• KYC Documents: Identity verification documents are retained for a minimum of five years following the closure of your account, or longer if required by applicable law.
• Support Communications: Live chat transcripts and email correspondence are retained for up to two years from the date of the conversation, unless the matter forms part of an ongoing dispute or legal proceeding.
• Closed Account Data: Following voluntary account closure, personal data is retained for a minimum of five years before secure deletion or anonymisation, to comply with legal obligations and to enable dispute resolution if required.
• Marketing Consent Records: Records of consent for marketing communications are retained for the duration of your account and for one year following withdrawal of consent.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical and analytical purposes.

Depending on the laws of your jurisdiction, you may have certain rights in relation to the personal data Boda8 holds about you. Boda8 acknowledges and respects the following internationally recognised data subject rights:

• Right of Access: You may request a copy of the personal data Boda8 holds about you, along with information about how that data is used and with whom it is shared.
• Right to Rectification: You may request that inaccurate or incomplete personal data held about you be corrected or completed.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected. This right may be limited where we are required to retain data by law or to fulfil contractual obligations.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on your consent or on a contract, you may request that we provide your personal data in a structured, machine-readable format so that it can be transferred to another service provider.
• Right to Object: You have the right to object to processing of your personal data for direct marketing purposes at any time. You also have the right to object to processing based on legitimate interests, though this right may be overridden where we can demonstrate compelling grounds.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our support team via live chat or at [email protected] (plain text — not a clickable link). We will respond to verified requests within 30 days. We may need to verify your identity before processing certain requests.

Boda8 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser and the Platform is encrypted using TLS 1.2 or TLS 1.3 protocols. Our SSL certificate is visible in your browser's address bar.
• Encryption at Rest: Sensitive personal data fields stored in our databases are encrypted using industry-standard algorithms.
• Access Controls: Access to personal data within Boda8 is restricted on a strict need-to-know basis. All internal access to production data requires multi-factor authentication and is logged for audit purposes.
• Penetration Testing: The Platform undergoes regular security assessments including vulnerability scanning and third-party penetration tests.
• Fraud Monitoring: Automated and human-reviewed systems monitor account activity continuously for signs of unauthorised access or suspicious behaviour.
• Incident Response: We maintain a documented data breach response procedure. In the event of a confirmed data breach affecting your personal data, we will notify affected users and relevant authorities in accordance with applicable legal obligations.

While we take every reasonable precaution to protect your data, no online platform can guarantee absolute security. You also play a role in keeping your account secure by using a strong, unique password and enabling two-factor authentication where offered.

The Boda8 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under 21, you must not register, attempt to register, or use the Boda8 Platform in any capacity.

If Boda8 becomes aware that personal data has been collected from a person under the age of 21 without verifiable parental or guardian consent, we will take immediate steps to delete that data and close the associated account. If you believe a minor has registered on the Platform, please contact us immediately via live chat or at [email protected] so that we may investigate and take appropriate action.

Boda8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, we will update the "Last Updated" date at the top of this Policy. For significant changes that materially affect how we process your personal data, we may also provide notice via email to your registered address or via a prominent in-Platform notification.

Your continued use of the Boda8 Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised Policy. If you do not agree to the amended terms, you should discontinue use of the Platform and may request account closure in accordance with our Terms & Conditions.

We recommend reviewing this Policy periodically. The date of the most recent revision is always displayed prominently at the top of this page.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way in which Boda8 processes your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly on the Platform. This is the fastest channel for data-related enquiries — average response time under 5 minutes.
• Support Email: [email protected] (plain text — not a clickable link). Please include "Privacy Request" in your subject line for data rights requests.
• Languages: Data-related enquiries can be handled in English, Bahasa Melayu, or Mandarin.

For data access requests, erasure requests, or other formal exercises of your data subject rights, please be prepared to verify your identity before we process your request. We aim to respond to all verified data rights requests within 30 calendar days of receipt.

For matters relating to our general Terms of Use, please visit our Terms & Conditions page. For responsible gaming enquiries and tools, please visit our Responsible Gambling page.