Privacy Policy

This Privacy Policy ("Policy") is issued by Bolaking ("Bolaking", "we", "us", "our") and applies to all personal data collected through the Bolaking website, mobile interface, gaming platform, and related services (collectively, the "Platform") accessible at bolaking.cam.

We recognise that privacy is fundamental to trust. Malaysian players who use the Bolaking Platform — whether in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or elsewhere — entrust us with personal and financial information. This Policy explains how we handle that information responsibly, transparently, and in compliance with applicable data protection principles.

By creating an account on the Platform or otherwise providing us with your personal data, you acknowledge that you have read and understood this Policy and that you consent to the data practices described herein. If you do not agree to this Policy, please do not use the Platform.

This Policy should be read alongside our Terms & Conditions and our Responsible Gambling Policy. In the event of any conflict between these documents on the subject of data processing, this Privacy Policy shall govern.

For the purposes of this Policy, the following definitions apply:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, email address, phone number, payment details, device identifiers, and IP addresses.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, and all operations in between.
• "Data Controller" — the entity that determines the purposes and means of processing Personal Data. Bolaking acts as Data Controller in respect of all Personal Data collected from Platform users.
• "Data Processor" — a third party that processes Personal Data on behalf of Bolaking under contractual instruction.
• "KYC Data" — identity verification documentation provided by a Player for the purpose of Know Your Customer (KYC) compliance, including government-issued identification documents and proof-of-address materials.
• "Cookie" — a small text file stored on your device by a web browser, used to remember session information, preferences, and analytical data.
• "Third Party" — any entity that is not Bolaking and is not the data subject (i.e., not you, the user).

Bolaking collects Personal Data through the following categories of interaction with the Platform:

We do not knowingly collect sensitive special-category data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where strictly required by applicable KYC or anti-money laundering regulations and only to the minimum extent required.

Bolaking processes your Personal Data on one or more of the following lawful bases:

• Contractual Necessity: Processing required to perform our obligations under the Terms & Conditions that govern your account, including enabling you to deposit, play, and withdraw.
• Legal Obligation: Processing required to comply with applicable laws, including anti-money laundering (AML) regulations, KYC obligations, and financial reporting requirements.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, platform security, responsible gambling enforcement, and improving service quality — provided those interests are not overridden by your privacy rights.
• Consent: Where we rely on consent (for example, for optional marketing communications), you may withdraw that consent at any time by contacting our support team or updating your account preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Bolaking uses your Personal Data for the following purposes:

• Account Management: Creating, verifying, maintaining, and closing your account in accordance with our Terms & Conditions.
• Identity Verification (KYC): Confirming your identity and age (21+) to comply with applicable gaming regulations and to prevent underage access to the Platform.
• Payment Processing: Facilitating deposits and withdrawals via your chosen payment methods, including local e-wallets and Malaysian bank accounts.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, money laundering, account takeovers, and other unlawful activity.
• Responsible Gambling: Monitoring gameplay patterns for indicators of problem gambling behaviour, administering deposit limits and self-exclusion requests, and fulfilling our duty of care obligations.
• Customer Support: Responding to your enquiries, resolving disputes, and improving our support processes.
• Platform Improvement: Analysing anonymised usage data to improve Platform performance, game selection, user interface, and overall service quality.
• Legal Compliance: Meeting our obligations under applicable laws, including responding to lawful requests from regulatory or law enforcement authorities.
• Marketing Communications (with consent): Sending you promotional offers, bonus notifications, and relevant updates about the Platform — only where you have opted in to receive such communications.

Bolaking does not sell your Personal Data. We may disclose your data to the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Service Providers: Financial institutions and payment processors — including e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), banks (Maybank, CIMB, Public Bank, Hong Leong), and FPX / DuitNow — who process your transactions on our behalf.
• Identity Verification Services: Third-party KYC and AML compliance providers who assist with identity verification and fraud screening.
• Game Studios and Platform Providers: Licensed game studios and software providers whose games and systems are integrated into the Platform, to the minimum extent required for gameplay functionality.
• IT and Infrastructure Providers: Hosting providers, cloud services, and cybersecurity firms who operate Platform infrastructure under strict data processing agreements.
• Customer Support Tools: Third-party live chat and ticketing systems used to manage customer support interactions.
• Regulatory and Legal Authorities: Government bodies, law enforcement agencies, financial intelligence units, and courts where disclosure is required by applicable law or a lawful order.
• Professional Advisers: Legal, financial, and compliance advisers bound by professional confidentiality obligations.

All third parties with whom we share Personal Data are required to handle it in accordance with applicable data protection standards and are prohibited from using it for any purpose beyond the specific service they provide to Bolaking.

Bolaking retains your Personal Data for as long as is necessary to fulfil the purposes described in this Policy, and for such additional periods as may be required by applicable laws and regulations.

• Active Account Data: Retained for the duration of your account relationship with Bolaking, plus any legally mandated period following account closure.
• KYC and AML Records: Retained for a minimum of five (5) years following the end of your account relationship, in accordance with anti-money laundering regulations applicable to gaming operators.
• Transaction Records: Retained for a minimum of five (5) years following the relevant transaction date, to satisfy financial record-keeping obligations.
• Support Communications: Retained for up to three (3) years following the closure of a support case, for quality assurance and dispute resolution purposes.
• Technical and Usage Data: Retained in anonymised or aggregated form for analytical purposes; individual-level technical data is deleted or anonymised after twelve (12) months.

Upon the expiry of the applicable retention period, your data will be securely deleted or irreversibly anonymised in accordance with our internal data destruction procedures.

Bolaking implements a multi-layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption across all Platform connections and data transmissions.
• Encrypted data storage for sensitive fields including payment details, identity documents, and authentication credentials.
• Two-factor authentication (2FA) available to all registered Players as an optional additional layer of account security.
• Role-based access controls ensuring that internal staff can only access Personal Data relevant to their specific operational role.
• Regular security assessments including penetration testing and vulnerability scanning of Platform infrastructure.
• 24/7 transaction monitoring for anomalous activity indicative of fraud, account compromise, or money laundering.
• Incident response procedures designed to detect, contain, and notify affected parties of any personal data breach within legally required timeframes.

While we take all reasonable and commercially practicable steps to protect your Personal Data, no electronic transmission or storage system is completely secure. You are responsible for keeping your account credentials confidential and for notifying us immediately if you suspect any unauthorised access to your account.

The Bolaking Platform uses cookies and similar tracking technologies (including browser localStorage and session identifiers) to ensure the Platform functions correctly and to help us understand how players use it. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in and security tokens that protect against cross-site request forgery. These cookies cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display configurations, and responsible gambling tool settings across sessions.
• Analytical Cookies: Collect anonymised information about how Players navigate the Platform — which pages are visited most, how long sessions last, and where users encounter difficulties. This data helps us improve the Platform. Analytics are processed at an aggregated, non-identifiable level.
• Security Cookies: Support fraud detection systems by capturing session fingerprint data, including IP addresses and device identifiers, for anomaly detection.

You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will affect your ability to log in and use the Platform. For guidance on managing cookies in your browser, refer to your browser's help documentation.

Subject to applicable laws, you hold the following rights in respect of your Personal Data held by Bolaking. To exercise any of these rights, please contact us using the details in Section 14 below.

We will respond to all valid data rights requests within a reasonable timeframe and in any event within thirty (30) days of receipt. We may ask you to verify your identity before processing a request to protect against unauthorised disclosure.

The Bolaking Platform is strictly for individuals aged 21 years and above. We do not knowingly collect Personal Data from individuals under the age of 21. Registration on the Platform requires confirmation that the applicant meets this age requirement, and KYC verification procedures include age verification as a mandatory step.

If we become aware that Personal Data belonging to an individual under the age of 21 has been collected — through any means including self-disclosure, parental report, or internal detection — we will immediately suspend the relevant account, initiate deletion of the associated Personal Data (subject to any legally mandated retention requirements), and, where applicable, report the matter to the appropriate regulatory authority.

If you are a parent or guardian and believe that a minor has registered an account on our Platform, please contact our support team immediately at [email protected].

As an online platform serving Malaysian players with infrastructure and service providers potentially located in multiple jurisdictions, Personal Data collected by Bolaking may be transferred to and processed in countries outside Malaysia. Such transfers may include data processed by our hosting infrastructure providers, KYC verification services, payment processors, and support system providers.

Where Personal Data is transferred internationally, Bolaking ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that applied within Malaysia, including through:

• Contractual data processing agreements incorporating data protection obligations aligned with internationally recognised standards;
• Transferring data only to jurisdictions or organisations that provide adequate data protection as assessed by applicable regulatory guidance;
• Applying supplementary technical and organisational safeguards where required.

Bolaking reserves the right to update or amend this Privacy Policy at any time. When we make material changes to how we collect or use Personal Data, we will notify registered Players by email (to the address associated with their account) and/or by posting a prominent notice on the Platform prior to the changes taking effect.

The "Last Updated" date at the top of this Policy reflects when the most recent version was published. We encourage you to review this Policy periodically to remain informed of our current data practices.

Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of and agreement to the updated Policy. If you do not agree to the revised Policy, you should cease using the Platform and contact us to request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way Bolaking handles your Personal Data, please contact us through the following channels:

• 24/7 Live Chat Support: Available directly on the Bolaking Platform — our fastest channel for general enquiries.
• Email: [email protected] — for formal data rights requests, please mark your subject line "Privacy Request – [Your Username]".

Our team is available in English, Bahasa Melayu, and Mandarin. We aim to acknowledge all privacy-related emails within 2 business days and to provide a substantive response within 30 calendar days of receipt. Where a request is particularly complex or numerous, we may extend this period by a further 30 days; in such cases we will notify you of the extension and the reasons for it.

For responsible gambling concerns, self-exclusion requests, or problem gambling support, please visit our dedicated Responsible Gambling page.