Privacy Policy

1. Introduction

bolaking ("bolaking", "we", "us", "our") is committed to protecting and respecting the privacy of every individual who uses the bolaking Platform at bolaking.asia (the "Platform"). This Privacy Policy ("Policy") explains how bolaking collects, uses, discloses, retains, and protects personal data relating to Members and visitors of the Platform.

This Policy should be read alongside bolaking's Terms & Conditions, which govern your use of the bolaking Platform. By registering an Account or continuing to use the Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

bolaking operates with reference to the Malaysia Personal Data Protection Act 2010 (PDPA) and applicable international data protection standards. We take our obligations under these frameworks seriously and have implemented appropriate technical and organisational measures to give effect to them.

2. Data Controller

For the purposes of applicable data protection legislation, bolaking is the data controller in respect of personal data collected through the Platform. bolaking is responsible for determining the purposes and means of processing personal data submitted by or collected about Members and Platform visitors.

If you have any questions regarding the identity of the data controller or our data processing practices, please contact us at the details set out in Section 16 of this Policy.

3. Personal Data We Collect

bolaking collects the following categories of personal data from or about its Members and Platform visitors:

3.1 Identity Data

• Full legal name as appearing on official identification documents;
• Date of birth;
• Malaysian identity card number (MyKad) or passport number;
• Copies of identity documents submitted during KYC verification.

3.2 Contact Data

• Email address;
• Malaysian mobile telephone number;
• Residential or correspondence address.

3.3 Account & Transaction Data

• Account username and encrypted password credentials;
• Deposit and withdrawal history, including payment method details (e.g., Touch n Go eWallet reference, Maybank account holder name);
• Wagering history, game activity logs, and bet records;
• Bonus and rewards programme participation history;
• Account balance and financial transaction records.

3.4 Technical Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser type and version;
• Session timestamps and login activity logs;
• Cookies and similar tracking technologies (see Section 10).

3.5 Communications Data

• Records of live chat, email, or other communications with bolaking customer support;
• Preferences expressed regarding marketing communications.

4. How We Collect Your Data

bolaking collects personal data through the following means:

• Direct interactions: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated technologies: Technical data collected automatically as you interact with the Platform, including through cookies, server logs, and analytics tools;
• Third parties: Identity verification data from KYC service providers; fraud prevention data from risk management partners; payment transaction data from payment processors such as Touch n Go, Boost, and banking institutions.

5. Purposes of Processing

bolaking processes your personal data for the following purposes:

6. Legal Basis for Processing

bolaking processes your personal data on the following legal bases:

• Performance of a contract: Processing necessary to fulfil bolaking's obligations to you as a Member, including account administration, payment processing, and service delivery;
• Legal obligation: Processing required to comply with applicable laws, including AML obligations, KYC requirements, and directions from regulatory and licensing authorities;
• Legitimate interests: Processing necessary for bolaking's legitimate business interests, including fraud prevention, Platform security, and service improvement, where such interests are not overridden by your rights;
• Consent: Processing for direct marketing communications, where you have given explicit consent. You may withdraw this consent at any time.

7. Sharing Your Personal Data

bolaking does not sell, rent, or trade your personal data. We may disclose your personal data to the following categories of recipients:

• KYC and identity verification providers: To verify your identity and age in accordance with our legal obligations;
• Payment processors: Including Touch n Go eWallet, Boost, Maybank, CIMB, and other payment service providers, to process deposits and withdrawals;
• Game technology providers: Licensed game studios and platform operators whose software powers bolaking's Games, to the extent necessary to provide those services;
• Fraud prevention and AML partners: Risk management and anti-fraud service providers who assist in protecting the Platform and its Members;
• Regulatory and licensing authorities: Where required by law, court order, or direction from a competent regulatory or gaming authority;
• Professional advisers: Including auditors, legal counsel, and IT security consultants, subject to confidentiality obligations;
• Successor entities: In the event of a merger, acquisition, or sale of all or substantially all of bolaking's business assets, Member data may be transferred to the acquiring entity.

All third-party service providers who receive personal data from bolaking are required to process that data only for the specified purpose and in accordance with applicable data protection requirements.

8. International Data Transfers

bolaking's operations and service providers may involve the transfer of personal data to countries outside Malaysia. Where such transfers occur, bolaking takes appropriate steps to ensure that your personal data remains protected to a standard that is consistent with the PDPA and this Policy, including through the use of contractual protections with recipient entities.

By using the bolaking Platform, you acknowledge and consent to the transfer of your personal data to countries outside Malaysia where necessary for the purposes described in this Policy.

9. Data Retention

bolaking retains personal data for as long as is necessary for the purposes set out in this Policy, taking into account applicable legal, regulatory, licensing, and business requirements. In particular:

• Account and transaction records are typically retained for a minimum of five (5) years following Account closure, in accordance with applicable AML and licensing requirements;
• KYC documentation is retained for the period required by applicable law and licensing conditions;
• Technical logs and session data are typically retained for up to twelve (12) months;
• Marketing consent records are retained for as long as you remain a bolaking Member or until consent is withdrawn.

Upon expiry of the applicable retention period, bolaking will securely delete or anonymise your personal data in accordance with its data disposal procedures.

10. Cookies & Similar Technologies

bolaking uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that help bolaking improve your experience and analyse Platform usage.

Types of Cookies Used

• Strictly necessary cookies: Required for the Platform to function. These cannot be disabled without affecting core functionality (e.g., session authentication, security tokens);
• Performance cookies: Collect anonymous information about how visitors use the Platform to help bolaking improve the user experience;
• Functionality cookies: Remember your preferences (e.g., language settings, display preferences) between sessions;
• Analytics cookies: Used by bolaking's analytics tools to understand aggregate usage patterns. Data collected is anonymised where possible.

You may configure your browser to refuse cookies or to alert you when cookies are being sent. Please note that disabling certain cookies may affect the functionality of the bolaking Platform. bolaking does not use cookies to serve third-party advertising.

11. Your Data Rights

Subject to applicable law and any overriding legal obligations (such as AML record-keeping requirements), you have the following rights in relation to your personal data held by bolaking:

• Right of access: Request a copy of the personal data bolaking holds about you;
• Right to rectification: Request correction of inaccurate or incomplete personal data;
• Right to erasure: Request deletion of your personal data where bolaking no longer has a lawful basis to retain it;
• Right to restriction: Request that bolaking restrict the processing of your data in certain circumstances;
• Right to object: Object to processing based on legitimate interests, including direct marketing;
• Right to data portability: Request that bolaking provide your data in a structured, machine-readable format where technically feasible;
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact bolaking at [email protected]. bolaking will respond to verified requests within thirty (30) days. We may require proof of identity before processing a request.

12. Children's Privacy

The bolaking Platform is strictly for individuals aged 21 years and older. bolaking does not knowingly collect personal data from individuals under the age of 21. If bolaking becomes aware that it has inadvertently collected personal data from a person under 21, it will take steps to delete that data promptly and close the associated Account. 21+

If you believe that a person under 21 has registered an Account with bolaking, please contact our support team immediately at [email protected].

13. Security Measures

bolaking implements appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• TLS (Transport Layer Security) encryption for all data transmitted between your device and the bolaking Platform;
• Encrypted storage of sensitive data, including passwords (stored as salted hashes) and financial information;
• Role-based access controls restricting staff access to personal data on a need-to-know basis;
• Regular internal and external security audits and penetration testing;
• Two-factor authentication (2FA) available for Member accounts and mandatory for administrative access;
• Incident response procedures to detect, report, and address personal data breaches in a timely manner.

Notwithstanding these measures, no data transmission over the internet or storage system can be guaranteed to be 100% secure. If you become aware of any security vulnerability or incident affecting your bolaking Account, please notify bolaking immediately.

14. Third-Party Platforms

The bolaking Platform may reference third-party services (such as game providers or payment processors) whose own privacy practices are governed by their respective privacy policies. bolaking is not responsible for the privacy practices of third parties and encourages Members to review the privacy policies of any third-party services they use in connection with the Platform.

15. Changes to This Policy

bolaking reserves the right to update or revise this Privacy Policy at any time. Where material changes are made, bolaking will provide reasonable notice to Members via the registered email address or a prominent notice on the Platform prior to the changes taking effect. The "Last Updated" date at the top of this page reflects the date of the most recent revision.

Your continued use of the bolaking Platform following notification of changes constitutes your acceptance of the revised Policy. If you do not agree with any changes, you should discontinue use of the Platform and may request Account closure.

16. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or bolaking's data practices, please contact us:

• Email: [email protected]
• Live Chat: 24/7 support available through the bolaking Platform
• Response Time: Within 3 minutes via live chat; within 24 hours via email

For data rights requests, please include "Data Rights Request" in your email subject line and provide sufficient information to verify your identity. bolaking will acknowledge your request within 72 hours and respond within 30 calendar days.