Privacy Policy

This Privacy Policy ("Policy") is issued by bones888 ("the Company", "we", "us", "our"), the operator of the online gaming platform accessible at https://bones888.cam and its associated services (collectively, the "Platform"). This Policy governs the collection, use, storage, disclosure, and protection of personal data relating to users of the Platform, including registered Account holders and unregistered visitors.

bones888 operates the Platform for the benefit of Malaysian users and players from other jurisdictions where access to the Platform is permitted. We are committed to processing personal data responsibly, transparently, and in accordance with applicable data protection principles.

By accessing the Platform, creating an Account, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree with any provision of this Policy, you should refrain from using the Platform.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably be used to identify a living individual, including name, email address, date of birth, financial account details, IP address, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, alteration, combination, restriction, erasure, or destruction.
• "Data Controller" means bones888, which determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means a third party engaged by bones888 to Process Personal Data on the Company's behalf, subject to contractual data protection obligations.
• "Data Subject" means the identified or identifiable individual to whom Personal Data relates — in the context of this Policy, this typically refers to you as a registered user or visitor of the Platform.
• "Cookies" means small text files placed on your device by the Platform to enable functionality, collect usage analytics, and support personalisation features.
• "KYC" means Know Your Customer — the regulatory identity verification process applied to Account holders under anti-money laundering and responsible gambling obligations.
• "Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the Processing of your Personal Data for a stated purpose.

bones888 collects Personal Data across several categories depending on your relationship with the Platform. The categories of data we collect are set out in the table below:

We do not collect sensitive categories of Personal Data (such as racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information) except where specifically required by applicable law or where voluntarily provided by you in the context of a responsible gambling self-assessment.

bones888 collects Personal Data through the following channels:

• Direct Submission: When you register an Account, complete KYC verification, make a deposit or withdrawal, contact customer support, respond to a survey, or otherwise interact with the Platform by submitting information.
• Automated Technologies: When you browse or use the Platform, we automatically collect Technical Data through cookies, web beacons, pixel tags, and server-side logging. This data is collected passively without you actively providing it.
• Third-Party Payment Processors: When you use payment methods such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or Hong Leong Bank, relevant transaction data is shared with us by those processors to confirm your deposit or facilitate your withdrawal.
• Identity Verification Partners: Where we engage third-party KYC service providers to assist in verifying identity documents, those providers may supply us with verification results and associated data as part of the KYC workflow.
• Anti-Fraud and Risk Intelligence Services: We may receive data from fraud prevention and risk intelligence services where such data is used to protect the integrity of our platform and prevent financial crime.

bones888 Processes Personal Data on one or more of the following legal bases, depending on the nature and purpose of the Processing:

• Contractual Necessity: Processing is necessary to perform the contract between you and bones888 — including account management, processing deposits, facilitating gameplay, and processing withdrawals.
• Consent: Where you have provided explicit consent for a specific Processing activity, such as receiving promotional emails or SMS marketing messages. You may withdraw consent at any time without affecting the lawfulness of prior Processing.
• Legal Obligation: Processing is required for compliance with applicable laws and regulations, including anti-money laundering (AML) obligations, Know Your Customer (KYC) requirements, responsible gambling regulations, and data retention laws.
• Legitimate Interests: Processing is necessary for the legitimate interests of bones888, provided those interests are not overridden by your fundamental rights and freedoms. This includes fraud detection, platform security, network and information security, and business analytics.
• Vital Interests: In exceptional circumstances, Processing may be necessary to protect the vital interests of a Data Subject — for example, where we are required to share information with emergency services or safeguarding authorities.

bones888 uses your Personal Data for the following specific purposes:

• Account Creation and Management: To register your Account, verify your identity, maintain your Account settings, and manage your Account lifecycle including suspension or closure where required.
• Service Delivery: To provide access to games, process bets and wagers, record gameplay outcomes, calculate winnings, and ensure the proper functioning of the Platform.
• Payment Processing: To process deposits received via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency networks; and to process your withdrawal requests in MYR or cryptocurrency.
• KYC and Regulatory Compliance: To verify your identity, age (minimum 21 years), and source of funds as required by our licensing obligations and applicable AML regulations.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, collusion, bonus abuse, money laundering, and other forms of prohibited conduct.
• Responsible Gambling: To monitor gameplay patterns, identify indicators of problem gambling, enforce self-imposed limits, administer self-exclusion requests, and comply with responsible gambling obligations under our licence.
• Customer Support: To respond to your support enquiries, resolve disputes, and maintain records of communications for quality assurance and audit purposes.
• Marketing and Promotions: Subject to your consent, to send you promotional offers, bonus notifications, VIP rewards communications, and event announcements via email or SMS.
• Platform Improvement: To analyse usage patterns, conduct performance testing, fix bugs, and develop new features using anonymised or aggregated analytics data.
• Legal and Regulatory Obligations: To comply with court orders, regulatory directives, law enforcement requests, and record-keeping requirements under applicable law.

bones888 does not sell, rent, or trade your Personal Data to any third party. We may share your data only in the following limited and controlled circumstances:

• Payment Service Providers: Transaction data is shared with payment processors including e-wallet providers (Touch 'n Go, Boost, GrabPay), banking networks (FPX, DuitNow, Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrency processors solely to facilitate your financial transactions on the Platform.
• Identity Verification Providers: Where we use third-party KYC service providers to verify identity documents, those providers receive the necessary data to complete verification. All such providers are bound by strict data processing agreements.
• Anti-Fraud and Risk Services: We may share data with industry fraud prevention networks and risk assessment services to identify and prevent prohibited conduct.
• Game Content Providers: Third-party game developers and live casino operators who supply content to the Platform may receive limited technical data (such as session identifiers) necessary to operate their games within our environment. These providers are not permitted to use this data for independent purposes.
• Regulatory and Legal Authorities: Where required by law, regulation, court order, or a legitimate request from a competent authority, we may disclose Personal Data to government bodies, regulators, or law enforcement agencies without prior notice to you.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or a substantial part of our business assets, Personal Data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations.

The bones888 Platform uses cookies and similar tracking technologies to enhance your experience, maintain session state, and collect analytics data. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies, security tokens, and load-balancing identifiers. These cookies cannot be disabled without impairing your ability to use the Platform.
• Functional Cookies: Enable the Platform to remember your preferences, such as language settings, last-visited game categories, and notification preferences, to personalise your experience between sessions.
• Analytics Cookies: Used to collect aggregated, anonymised data about how users navigate and interact with the Platform. This data helps us identify usability issues, popular features, and performance bottlenecks.
• Security Cookies: Used to support fraud detection, bot prevention, and abnormal session detection. These cookies help protect both the integrity of the Platform and the security of your Account.

You may manage your cookie preferences through your browser settings. Most modern browsers allow you to block or delete cookies. Please note that disabling certain cookie categories — particularly strictly necessary cookies — may result in reduced functionality or an inability to access the Platform.

bones888 does not use third-party advertising cookies or behavioural profiling cookies that track your activity across third-party websites outside of the Platform.

bones888 retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and contractual requirements. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in accordance with our data destruction procedures. Anonymised data may be retained indefinitely for aggregate analytics purposes, as it can no longer identify any individual.

bones888 implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Key security measures include:

• End-to-End Encryption: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS protocols. This applies to all pages on the Platform, including login, deposit, withdrawal, and account management functions.
• Encryption at Rest: Sensitive Personal Data — including identity documents, financial account details, and KYC records — is encrypted at rest in our storage systems using AES-256 encryption.
• Access Control: Strict role-based access control (RBAC) is enforced across all internal systems. Employees may only access Personal Data that is necessary for their specific job function. All access is logged and subject to periodic audit.
• Multi-Factor Authentication: Internal system access by bones888 personnel requires multi-factor authentication. We also encourage Account holders to enable two-factor authentication (2FA) on their Platform accounts.
• Penetration Testing: Regular independent security assessments and penetration testing are conducted to identify and remediate vulnerabilities in the Platform infrastructure.
• Incident Response: We maintain a documented data breach response plan. In the event of a security incident affecting your Personal Data, we will notify affected users in accordance with applicable notification requirements.

Despite these measures, no internet-based system is completely immune to security risks. You also bear responsibility for the security of your own Account credentials. Please use a strong, unique password and do not share your login details with any third party.

bones888 operates as an internationally licensed platform. This means that your Personal Data may be transferred to, stored in, or processed in jurisdictions outside Malaysia, including the jurisdiction in which our international gaming licence is issued, as well as the locations of our Data Processors (such as cloud infrastructure providers and KYC service providers).

Where Personal Data is transferred internationally, bones888 ensures that appropriate safeguards are in place to protect the data to a standard equivalent to, or greater than, that which would apply within Malaysia. Safeguards employed include:

• Data Processing Agreements with all third-party processors containing appropriate data protection clauses.
• Use of Data Processors that are subject to data protection frameworks recognised as providing adequate levels of protection.
• Technical encryption measures ensuring data security during transit across borders.

As a Data Subject, you hold specific rights with respect to your Personal Data held by bones888. The following rights are available to you, subject to applicable legal limitations:

• Right of Access: You have the right to request confirmation of whether bones888 holds Personal Data about you and, if so, to receive a copy of that data along with information about how it is being processed.
• Right to Rectification: If your Personal Data is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
• Right to Erasure ("Right to Be Forgotten"): In certain circumstances, you may request the deletion of your Personal Data. This right is subject to limitations where we are required by law to retain the data — for example, under AML record-keeping requirements.
• Right to Restriction of Processing: You may request that we restrict the Processing of your data in specific circumstances, such as while a dispute about data accuracy is pending.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to request its transfer to another controller where technically feasible.
• Right to Object: You may object to the Processing of your Personal Data based on legitimate interests, including profiling. You may also object at any time to the use of your data for direct marketing purposes.
• Right to Withdraw Consent: Where Processing is based on consent, you may withdraw that consent at any time. This does not affect the lawfulness of Processing carried out prior to withdrawal.

To exercise any of the above rights, please contact our Data Protection team at [email protected]. Requests will be acknowledged within 3 business days and resolved within 30 days of receipt, extended to 60 days in complex cases with prior notification to you.

The bones888 Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from persons under the age of 21. Age verification is a mandatory part of our Account registration and KYC process.

If we become aware that Personal Data has been collected from an individual who is under 21 years of age, we will take immediate steps to delete that data, close the associated Account, and void any transactions associated with that Account. Any funds deposited by an underage user may be returned at the Company's discretion following investigation.

If you believe that a person under 21 has registered on our Platform, please notify us immediately at [email protected] so that we may investigate and take appropriate action.

The bones888 Platform may contain references to third-party services — particularly in the context of payment processing (such as links that redirect you to your bank or e-wallet's login interface) or identity verification providers. Once you leave the bones888 Platform and access a third-party service, this Privacy Policy no longer applies.

bones888 is not responsible for the privacy practices of third-party websites, applications, or services. We encourage you to review the privacy policies of any third-party service before submitting your data to them. This includes the privacy notices of:

• Your bank or e-wallet provider (Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go, Boost, GrabPay, DuitNow)
• Payment network operators (FPX, DuitNow infrastructure providers)
• Cryptocurrency wallet or exchange providers

bones888 reserves the right to update or amend this Privacy Policy at any time. Where a proposed change materially affects your rights or the manner in which we process your Personal Data, we will provide advance notice via email to your registered address or by means of a prominent notification on the Platform, prior to the change taking effect.

Minor amendments — such as clarifications, corrections, or updates to reflect changes in our internal processes that do not affect your substantive rights — may be made with immediate effect. The "Last Updated" date at the top of this Policy will always reflect the date of the most recent revision.

We encourage you to review this Policy periodically. Your continued use of the Platform following publication of any amendment constitutes your acknowledgment and acceptance of the revised Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data, please contact the bones888 Data Protection team through the channels below: