Privacy Policy

This Privacy Policy ("Policy") is issued by boy303 ("we", "us", "our") and applies to all personal data collected from individuals who visit, register on, or interact with the boy303 Platform at https://boy303.cam. This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference.

boy303 operates as a premier international online betting and gaming platform serving English-preference users across Indonesia. We recognize that data privacy is a fundamental right and we are committed to handling your personal data transparently, securely, and in accordance with internationally recognized data protection principles.

By registering an account on boy303 or by continuing to use the Platform after this Policy has been updated, you confirm that you have read this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please do not register or continue to use the Platform.

The following defined terms are used throughout this Privacy Policy:

• "Personal Data" — any information that relates to an identified or identifiable natural person, including but not limited to name, email address, date of birth, national identification number, IP address, and financial account details.
• "Processing" — any operation performed on personal data, including collection, storage, use, disclosure, transfer, deletion, or any combination thereof.
• "Data Controller" — boy303, being the entity that determines the purposes and means of processing personal data.
• "Data Processor" — any third-party entity that processes personal data on behalf of boy303 pursuant to a written data processing agreement.
• "Data Subject" — you, the Member or visitor whose personal data is being processed.
• "Consent" — a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose.
• "KYC" — Know Your Customer; the identity and document verification process required to activate full account functionality on boy303.
• "Cookies" — small text files placed on your device by the Platform to enable session management, analytics, and personalization features.

boy303 collects personal data across several categories depending on the nature of your interaction with the Platform. The table below summarizes the categories of data we may collect:

We do not knowingly collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where a Member voluntarily discloses such information during a responsible gaming self-assessment or support interaction. In such cases, the data is used solely for the purpose of providing appropriate support.

boy303 collects personal data through the following channels and mechanisms:

boy303 processes your personal data under one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing is necessary to perform our contract with you — specifically, to provide account services, process deposits and withdrawals, and fulfill wagering transactions.
• Legal Obligation: Processing is required to comply with applicable legal obligations, including anti-money laundering (AML) record-keeping, KYC requirements, and responsible gaming mandates.
• Legitimate Interests: Processing is necessary for our legitimate interests as a business, including fraud detection, platform security, customer service quality improvement, and responsible gaming monitoring, provided those interests are not overridden by your fundamental rights.
• Consent: For non-essential processing activities — primarily direct marketing communications and non-functional cookies — we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of prior processing.

boy303 uses your personal data for the following purposes, always in accordance with the legal bases identified in Section 05:

• Account Management: Creating, maintaining, and administering your Member account, including processing login authentication and account security alerts.
• Transaction Processing: Facilitating deposits and withdrawals via your nominated local bank (BCA, BRI, BNI, Mandiri, or other supported institutions) or e-wallet (OVO, DANA, GoPay, ShopeePay, LinkAja).
• Identity Verification: Conducting KYC checks to confirm your identity, age (21+), and eligibility to use the Platform in accordance with our Terms & Conditions.
• Fraud Prevention & Security: Monitoring Platform activity to detect and prevent fraudulent transactions, collusion, multi-accounting, and unauthorized access.
• Responsible Gaming: Monitoring wagering patterns to identify potential signs of problem gambling and to enforce any deposit limits, session limits, or self-exclusion measures applied to your account.
• Customer Support: Responding to your queries, resolving disputes, and maintaining records of support interactions for quality assurance purposes.
• Legal Compliance: Maintaining records as required by applicable AML regulations and responding to lawful requests from competent authorities.
• Service Improvement: Analyzing aggregated, anonymized usage data to improve Platform performance, game selection, and user experience.
• Marketing Communications (Consent-Based): Sending promotional offers, bonus notifications, and seasonal promotions (such as Idul Fitri or Ramadhan special offers) to Members who have opted in to receive marketing communications. You may opt out at any time.

boy303 does not use your personal data for automated decision-making that produces legal or similarly significant effects on you without human review, except where such processing is strictly necessary for fraud prevention or AML compliance, in which case you retain the right to request human review of any automated decision.

boy303 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your data only in the circumstances described below, and only to the minimum extent necessary for the stated purpose:

• Payment Service Providers: Financial data is shared with authorized payment processors and local Indonesian banking partners (including BCA, BRI, BNI, and Mandiri) as necessary to complete deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Identity documents and personal details are shared with authorized third-party KYC bureaus and identity verification platforms to fulfill our verification obligations.
• Fraud & Security Screening Services: Technical and financial data may be shared with specialist fraud-screening providers to detect and prevent criminal activity on the Platform.
• Game Content Providers: Certain game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) may receive session-level technical data required to deliver their game content. These providers do not receive identity or financial data.
• Legal & Regulatory Authorities: We may disclose personal data to law enforcement agencies, regulatory bodies, or courts where we are required to do so by applicable law, court order, or in connection with legal proceedings.
• Corporate Transactions: In the event of a merger, acquisition, or asset sale involving boy303, personal data may be transferred to the successor entity, subject to equivalent privacy protections being maintained.

All third-party Data Processors engaged by boy303 are bound by written data processing agreements that require them to handle your personal data securely, to use it only for the purposes specified by boy303, and to maintain confidentiality standards equivalent to those applied by boy303 itself.

Given the sensitive nature of financial data, boy303 applies heightened controls to all payment-related personal data. The following measures are in place specifically to protect your financial information:

• Bank account numbers, e-wallet identifiers, and transaction records are stored in a dedicated, access-controlled database segment, separate from general account profile data.
• Access to financial data is restricted to authorized personnel on a strict need-to-know basis, with full audit logging of every access event.
• Full bank account numbers are masked in our internal systems after the initial verification step; only the last four digits and account name are retained in the active operational environment.
• boy303 does not store card numbers, CVV codes, or card expiry dates. If card-based payment methods are introduced in future, they will be processed exclusively by PCI-DSS certified payment gateways.
• Withdrawal destination accounts are verified against the identity of the registered Member during KYC. Withdrawals to unverified or mismatched accounts are blocked as a fraud prevention measure.

All Indonesian Rupiah (IDR) transactions — whether via BCA, BRI, BNI, Mandiri, CIMB Niaga, or supported e-wallets including OVO, DANA, GoPay, ShopeePay, and LinkAja — are logged with a full audit trail for AML and responsible gaming compliance purposes. Transaction records are retained for a minimum of five years post-account closure.

boy303 uses cookies and similar tracking technologies to operate the Platform efficiently and to improve your experience. The following categories of cookies may be placed on your device when you visit or use the Platform:

You may manage your cookie preferences at any time through your browser settings. Please note that disabling strictly necessary cookies will prevent the Platform from functioning correctly. Withdrawing consent for analytics or marketing cookies will not affect your access to core Platform features.

boy303 does not use fingerprinting technologies, supercookies, or any form of persistent tracking that circumvents standard browser-level cookie controls.

boy303 has implemented a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, disclosure, alteration, or destruction. Our security framework includes:

• Encryption in Transit: All data transmitted between your device and the boy303 Platform is encrypted using TLS 1.3. We enforce HTTPS across all Platform endpoints and apply HSTS headers to prevent protocol downgrade attacks.
• Encryption at Rest: All personally identifiable data stored in our databases is encrypted using AES-256. Encryption keys are managed by a dedicated key management service with strict rotation schedules.
• Access Controls: Access to personal data is governed by a role-based access control (RBAC) system. All internal access events are logged, monitored, and subject to regular audit review.
• Penetration Testing: boy303 commissions independent security assessments and penetration tests on a periodic basis to identify and remediate potential vulnerabilities before they can be exploited.
• Incident Response: In the event of a data security incident affecting your personal data, boy303 will notify affected Members without undue delay and will take all necessary remediation steps to contain the breach and prevent recurrence.
• Staff Training: All personnel with access to personal data undergo mandatory data privacy and security training at onboarding and on an annual basis thereafter.

boy303 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any legal retention obligations that require a longer minimum period. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized in accordance with industry-standard data destruction procedures. Where anonymization is not technically feasible, the data is permanently deleted from all active and backup systems.

As a data subject, you hold the following rights with respect to your personal data processed by boy303. To exercise any of these rights, please contact our support team at [email protected] with a clear description of your request and sufficient information to verify your identity.

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is being processed, the categories of data held, and the recipients to whom it has been disclosed.
• Right to Rectification: You may request that we correct any inaccurate or incomplete personal data we hold about you. Where the inaccuracy relates to KYC-verified data, we may require you to submit updated documentation.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. This right is subject to our legal retention obligations — financial and KYC records cannot be deleted within the mandatory retention period.
• Right to Restrict Processing: You may request that we temporarily restrict the processing of your personal data while a rectification request is pending or while you contest the legal basis for processing.
• Right to Object: You may object at any time to processing based on our legitimate interests, including processing for direct marketing purposes. Where you object to marketing, we will cease that processing immediately.
• Right to Data Portability: You may request that we provide your personal data to you in a structured, commonly used, machine-readable format (e.g., JSON or CSV), or transmit it directly to another service provider where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

We will respond to all valid data rights requests within 30 calendar days of receipt. Where a request is complex or numerous, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day window.

The boy303 Platform is strictly intended for adults aged 21 years and older. We do not knowingly collect personal data from individuals under the age of 21. Registration by minors is expressly prohibited under our Terms & Conditions.

If we become aware that we have inadvertently collected personal data from a person under the age of 21, we will immediately suspend the relevant account, delete the personal data concerned, and reverse any financial transactions associated with that account. If you have reason to believe that a minor has registered an account on boy303, please notify us immediately at [email protected].

boy303 operates internationally and some of the third-party Data Processors we engage — including KYC verification providers, fraud-screening services, and game content providers — may be located in jurisdictions outside Indonesia. Where personal data is transferred to a third country, boy303 ensures that appropriate safeguards are in place to protect your data, including:

• Execution of standard contractual clauses (SCCs) with the recipient entity, requiring it to maintain data protection standards equivalent to those applied by boy303.
• Verification that the recipient jurisdiction offers an adequate level of data protection as recognized by applicable international standards.
• Where neither of the above is available, we will seek your explicit consent before transferring your data internationally, and will fully inform you of the associated risks.

By registering on boy303 and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data to the countries in which our authorized Data Processors operate, subject to the safeguards described above.

boy303 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — for example, a change to the categories of data we collect, a new sharing relationship with a third party, or a change to your rights — we will provide reasonable advance notice by updating the "Last Updated" date at the top of this page and, where practicable, by notifying active Members via their registered email address.

Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any material change, you may request account closure and data deletion in accordance with the procedures described in Section 12.

We recommend that you review this Privacy Policy periodically to stay informed of how boy303 is protecting your personal data. Archived versions of this Policy are available on request from our support team.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way in which boy303 handles your personal data, please contact us using the details below. Our privacy and support team will respond to all data-related enquiries within 30 calendar days.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority in your jurisdiction. boy303 will cooperate fully with any regulatory inquiry or investigation relating to our data processing practices.