bossph Privacy Policy

Introduction

This Privacy Policy (hereinafter "Policy") is issued by bossph, the operator of the online gaming platform accessible at bossph.cam (hereinafter "bossph," "we," "us," or "our"). This Policy describes how bossph collects, uses, processes, stores, shares, and protects the personal information of individuals who access or use the bossph platform — including registered players, website visitors, and anyone who contacts bossph's customer support team.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (hereinafter "DPA"), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission (NPC) of the Philippines. bossph also processes data in accordance with its PAGCOR licensing obligations, which impose independent requirements on the handling of player information.

By registering for a bossph account, accessing the platform, or otherwise providing your personal information to bossph, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your data as described herein. If you do not agree with this Policy, you should not use the bossph platform.

Data Controller

Under the Philippine Data Privacy Act of 2012, bossph acts as the Personal Information Controller (PIC) in respect of the personal data it collects from platform users. As PIC, bossph is responsible for determining the purposes and means by which personal information is processed.

bossph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the DPA and this Policy, and for serving as the primary point of contact for data privacy matters. Queries, concerns, and exercise of data subject rights may be directed to the DPO through the contact details set out in Section 14 of this Policy.

Personal Data We Collect

bossph collects personal data that is necessary and proportionate to the purposes for which it is collected. The categories of personal data we process include the following:

3.1 Registration & Identity Data

When you create a bossph account, we collect information necessary to establish and verify your identity, including:

• Full legal name as it appears on government-issued identification;
• Date of birth (for age verification — all players must be 21 years of age or older);
• Email address and Philippine mobile number;
• Username and encrypted password;
• Nationality and country of residence.

3.2 KYC & Verification Documents

In compliance with PAGCOR requirements and anti-money laundering obligations, bossph collects:

• Government-issued Philippine ID (e.g., PhilSys ID, passport, driver's license, SSS/GSIS card, Voter's ID);
• Proof of address documents;
• Source of funds documentation where required by law or risk assessment.

3.3 Financial & Transaction Data

• GCash or PayMaya account reference numbers linked to your bossph wallet;
• Bank account details for withdrawals via BPI, BDO, Metrobank, or other supported banks;
• Deposit and withdrawal transaction history;
• Wagering history, game participation records, and account balance information.

3.4 Technical & Usage Data

• IP address, device type, operating system, and browser type;
• Login timestamps and session duration;
• Pages visited, games accessed, and in-platform navigation patterns;
• Cookies and similar tracking technologies as described in Section 11.

3.5 Communications Data

• Records of live chat, email, and support ticket communications with bossph customer service;
• Responses to surveys, promotions, and feedback requests.

How We Collect Your Data

bossph collects personal data through the following channels:

1. Directly from you — when you register an account, complete KYC verification, make deposits or withdrawals, contact customer support, or participate in promotions;
2. Automatically through platform use — via cookies, server logs, and analytics tools that record technical and usage data as you navigate bossph.cam;
3. From payment processors — when you transact through GCash, PayMaya, BPI, BDO, Metrobank, or 7-Eleven, relevant transaction confirmation data is passed to bossph by those processors;
4. From identity verification services — third-party KYC and identity verification providers may pass verification outcomes to bossph as part of the account onboarding process;
5. From regulatory and law enforcement bodies — where bossph is required by law to obtain or verify information in response to regulatory instructions or legal process.

Purpose & Legal Basis for Processing

bossph processes personal data only where a lawful basis under the DPA exists. The following table sets out the primary purposes for which bossph processes personal data and the corresponding legal basis under the DPA:

Where bossph relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time by contacting our Data Protection Officer. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Data Sharing & Third Parties

bossph does not sell, rent, or trade your personal information to third-party advertisers or commercial data brokers. bossph shares personal data with third parties only in the following circumstances:

6.1 Service Providers (Personal Information Processors)

bossph engages third-party service providers who process personal data on our behalf and under our written instruction. These include payment processors (GCash, PayMaya, partner banks), identity verification services, cloud hosting providers, anti-fraud technology vendors, and customer support platform operators. These providers are contractually bound to process data only as directed by bossph and to maintain appropriate security measures.

6.2 Game Content Providers

Game providers on the bossph platform — such as JILI, Pragmatic Play, Evolution Gaming, and other licensed studios — may receive limited technical data (such as player session tokens) necessary to deliver game content. They do not receive personally identifiable information beyond what is necessary for gameplay and game integrity purposes.

6.3 Regulatory and Law Enforcement Authorities

bossph is required by law to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and relevant Philippine law enforcement agencies upon lawful request. bossph will comply with all such legally valid demands and will notify affected data subjects where permitted by law.

6.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or a portion of bossph's business, personal data held by bossph may be transferred as part of that transaction. Affected players will be notified in advance where required by the DPA, and the acquiring entity will be bound by the terms of this Policy or required to issue a successor policy with equivalent protections.

International Data Transfers

bossph's primary data processing infrastructure is located within the Philippines. However, certain service providers — including cloud infrastructure partners and game content providers — may process or store data in server locations outside the Philippines.

Where personal data is transferred to a jurisdiction outside the Philippines, bossph ensures that appropriate safeguards are in place in accordance with the DPA, including contractual protections (such as data processing agreements with equivalent privacy standards) or transfers to jurisdictions that offer comparable levels of data protection. bossph will not transfer personal data to a foreign jurisdiction where adequate protection cannot be assured.

Data Retention

bossph retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law or regulation. Key retention principles include:

• Account and KYC records are retained for a minimum of five (5) years from the date of account closure, as required under PAGCOR regulations and AMLA;
• Financial transaction records are retained for a minimum of five (5) years;
• Customer support communications are retained for three (3) years from the date of the interaction;
• Marketing consent records are retained for the duration of your marketing consent plus three (3) years;
• Technical and usage logs may be retained for up to twelve (12) months for security and fraud detection purposes.

Upon expiry of applicable retention periods, personal data is securely deleted, anonymised, or — where physical documents are involved — destroyed in a manner that prevents reconstruction. bossph does not archive personal data beyond what is proportionate to its legitimate retention purposes.

Security Measures

bossph implements a multi-layered approach to personal data security, combining technical, organizational, and procedural controls to protect your information against unauthorized access, accidental loss, alteration, or disclosure. Security measures in place at bossph include:

• 256-bit SSL/TLS encryption for all data in transit between your device and bossph servers;
• Encryption at rest for sensitive data categories, including KYC documents and payment information;
• Role-based access controls limiting data access to authorised personnel with a demonstrated need;
• Multi-factor authentication requirements for internal system access;
• Regular penetration testing and vulnerability assessments by independent security professionals;
• Fraud detection and anomaly monitoring systems operating continuously;
• Staff training on data privacy and security obligations under the DPA;
• Incident response procedures aligned with NPC notification requirements.

Your Data Rights

Under the Philippine Data Privacy Act of 2012, you hold the following rights in relation to the personal data bossph holds about you. bossph will respond to all rights requests within thirty (30) calendar days of receipt, or within such extended timeframe as permitted by the DPA where the request is complex or numerous.

To exercise any of the rights above, please contact bossph's Data Protection Officer using the details in Section 14. bossph may need to verify your identity before processing a rights request to prevent unauthorized disclosure of personal data.

Cookies & Tracking Technologies

bossph uses cookies and similar tracking technologies on bossph.cam to ensure the platform functions correctly, to maintain your session state after login, to remember your preferences, and to gather aggregate analytics data that helps us improve the platform.

11.1 Types of Cookies Used

11.2 Managing Cookies

You may control cookie behaviour through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking strictly necessary cookies will impair your ability to use the bossph platform, as they are required for session management and authentication. Analytics and functional cookies can be declined without affecting core platform access.

Minors

bossph's platform is strictly intended for individuals who are twenty-one (21) years of age or older, as mandated by PAGCOR. bossph does not knowingly collect personal data from individuals under 21 years of age. Age verification is a mandatory component of the bossph registration process.

If bossph becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted immediately, the associated account will be permanently suspended, and the matter will be escalated in accordance with applicable regulatory obligations.

Updates to This Privacy Policy

bossph reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, platform operations, regulatory requirements, or applicable law. Material changes to this Policy will be communicated to registered players via the email address on file and/or through a notice displayed on the bossph platform prior to the change taking effect.

The "Last Updated" date displayed at the top of this Policy reflects the most recent revision. Your continued use of the bossph platform after the effective date of any amendment constitutes your acceptance of the updated Policy. If you do not agree with a material change, you should close your account before the amendment takes effect.

bossph recommends that you review this Privacy Policy periodically to stay informed about how your personal data is being handled. Previous versions of this Policy are available on request from the Data Protection Officer.

Contact & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or to the exercise of your data rights under the DPA, please contact the bossph Data Protection Officer using the contact details below. All privacy-related requests will be acknowledged within five (5) business days and resolved within thirty (30) calendar days where possible.

14.1 Complaints to the National Privacy Commission

If you believe that bossph has not adequately addressed a concern relating to the handling of your personal data, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent regulatory body responsible for the enforcement of the Data Privacy Act of 2012. Contact information for the NPC is publicly available through the Philippine government's official channels.

bossph encourages data subjects to contact the bossph DPO in the first instance before escalating to the NPC, as many concerns can be resolved directly and more efficiently through bossph's internal process.