Privacy Policy
bola168 is committed to protecting the personal information of every player on our platform. This Privacy Policy explains in plain terms what data we collect, why we collect it, how it is used and stored, who we share it with, and the rights you hold as a bola168 account holder in Malaysia.
Last Updated: 1 January 2026How Bola168 Protects Your Data
These six principles summarise our approach to data privacy. The full legally binding policy follows below.
Data Minimisation
We collect only the personal information strictly necessary to operate your account, process transactions, and fulfil our legal obligations. We do not collect data for its own sake.
Secure Storage
All personal data is encrypted at rest using industry-standard AES-256 encryption and transmitted exclusively over TLS-secured HTTPS connections. KYC documents are stored in isolated, access-controlled vaults.
No Data Selling
bola168 does not sell, rent, or commercially trade your personal data to third-party advertisers, data brokers, or marketing organisations under any circumstances.
Limited Access
Access to personal data within bola168 is restricted on a strict need-to-know basis. Only compliance, support, and fraud prevention teams may access data directly relevant to their function.
Transparent Processing
We clearly state the legal basis for each type of data processing we conduct. We do not process your data for purposes incompatible with those disclosed in this policy without your prior informed consent.
Your Rights, Respected
You have the right to access, correct, delete, and export your personal data. We honour all valid data rights requests within 30 days and provide clear guidance on how to exercise each right.
Contents
- 1. Introduction
- 2. Definitions
- 3. Data We Collect
- 4. How We Collect Data
- 5. Legal Basis for Processing
- 6. How We Use Your Data
- 7. Data Sharing & Disclosure
- 8. Cookies & Tracking
- 9. Data Retention
- 10. Data Security
- 11. International Transfers
- 12. Your Rights
- 13. Children's Privacy
- 14. Third-Party Services
- 15. Amendments
- 16. Contact Us
Introduction
Bola168 ("the Platform", "we", "us", "our") is an online gaming and sports betting platform operating at https://bola168.cam, designed and marketed for players in Malaysia. We understand that the privacy of our users is a matter of serious importance, and we are committed to handling your personal data with transparency, responsibility, and the highest standard of security.
This Privacy Policy ("Policy") describes in detail what categories of personal information bola168 collects from users ("you", "your") of the Platform, the purposes for which that information is used, the parties with whom it may be shared, the measures we take to keep it secure, and the rights available to you in relation to your personal data.
This Policy applies to all personal data collected through the bola168 website, mobile applications, support interactions, and any other digital touchpoint operated by bola168. It should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy.
By creating an account, logging in to the Platform, or providing any personal information to bola168, you acknowledge that you have read and understood this Policy and consent to the collection and use of your data as described herein.
Definitions
For the purposes of this Privacy Policy, the following terms carry the definitions stated below:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information that identifies or can reasonably be used to identify a living individual, directly or in combination with other data. |
| "Processing" | Any operation performed on Personal Data — including collection, storage, retrieval, use, transmission, erasure, or combination with other data. |
| "Data Controller" | bola168, as the entity that determines the purposes and means of processing your Personal Data. |
| "Data Processor" | A third-party service provider that processes Personal Data on bola168's behalf and under bola168's documented instructions. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your Personal Data for a stated purpose. |
| "KYC Data" | Identity and address verification documents submitted by you as part of bola168's Know Your Customer process, including identity cards, passports, and proof of address. |
| "Sensitive Data" | A category of Personal Data requiring heightened protection — including financial account details, identity document numbers, and biometric data where applicable. |
Data We Collect
bola168 collects the following categories of personal data from users of the Platform:
3.1 Registration & Account Data
- Full legal name as it appears on your identity document
- Date of birth (used to verify you are aged 21 or above)
- Malaysian mobile number or international equivalent
- Email address (primary communication channel)
- Username and hashed password (passwords are never stored in plain text)
- Preferred currency (Malaysian Ringgit, MYR, by default for Malaysian users)
3.2 Identity Verification (KYC) Data
- Scan or photograph of government-issued identity document (MyKad, Driver's Licence, or Passport)
- Proof of current residential address (utility bill, bank statement, or equivalent)
- Selfie photograph holding the identity document
3.3 Financial & Transaction Data
- Deposit and withdrawal transaction records including amounts, timestamps, and method used (e.g., Touch 'n Go eWallet, DuitNow, Maybank FPX, CIMB, Boost, GrabPay, USDT TRC20)
- Payment account identifiers (e-wallet phone numbers, bank account last digits, wallet addresses) — full account numbers are not stored
- Bonus and promotion claim history
- Account Wallet balance history
3.4 Gaming & Betting Data
- Bet placement records including market, stake, odds, and outcome
- Game session logs including duration, game type, and results
- Platform navigation and feature usage data
3.5 Technical & Device Data
- IP address and approximate geolocation derived from IP
- Device type, operating system, and browser version
- Session timestamps and login history
- Cookie and tracking data (see Section 8)
3.6 Communication Data
- Records of support interactions via live chat and email
- Content of communications you initiate with our team
- Feedback, complaints, and dispute records
How We Collect Data
bola168 collects personal data through the following channels and methods:
- Directly from you — when you register an account, complete a KYC submission, make a deposit or withdrawal request, contact our support team, or participate in any promotion.
- Automatically through platform technology — when you interact with the Platform, our servers automatically log technical data including IP address, device identifiers, session activity, and browser characteristics.
- Through cookies and tracking technologies — session cookies, persistent cookies, and analytics tools are used to maintain your login state, analyse platform usage patterns, and detect fraud. Full details are provided in Section 8.
- From payment processors — when you initiate a transaction via a third-party payment provider (such as DuitNow, FPX, or Touch 'n Go eWallet), we receive transaction confirmation data sufficient to credit or debit your account. We do not receive your full payment credentials directly.
- From fraud prevention and compliance partners — where applicable, bola168 may receive information from authorised data sources used to verify identity, detect fraudulent activity, or comply with anti-money laundering obligations.
Legal Basis for Processing
bola168 processes your personal data under the following legal bases, depending on the purpose of processing:
| Processing Purpose | Legal Basis |
|---|---|
| Account registration & management | Performance of a contract — necessary to provide the gaming services you have requested. |
| Identity verification (KYC) | Legal obligation — required to comply with anti-money laundering, age verification, and fraud prevention obligations. |
| Transaction processing | Performance of a contract — necessary to process your deposits and withdrawals. |
| Fraud detection & security monitoring | Legitimate interests — bola168 has a legitimate interest in protecting the platform, its users, and financial systems from fraudulent activity. |
| Platform analytics & improvement | Legitimate interests — improving the platform experience and operational performance. |
| Direct marketing communications | Consent — we will only send promotional communications where you have opted in. You may withdraw consent at any time. |
| Responsible gambling monitoring | Legal obligation and legitimate interests — to fulfil our duty of care and comply with player protection requirements. |
How We Use Your Data
bola168 uses the personal data we collect for the following specific purposes:
- To create and manage your bola168 Account, including authentication and Account settings.
- To verify your identity and age (21+ requirement) in compliance with our KYC obligations prior to processing withdrawals.
- To process deposits and withdrawals via your chosen payment method (DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, cryptocurrency).
- To detect, investigate, and prevent fraudulent transactions, money laundering, collusion, and other prohibited activities on the Platform.
- To calculate and award bonuses, cashback, and VIP tier benefits under our loyalty programme.
- To provide 24/7 customer support and respond to your queries, complaints, and dispute submissions.
- To monitor player behaviour for responsible gambling purposes, including detecting signs of problem gambling and administering self-exclusion or deposit limit requests.
- To send you transactional communications including deposit confirmations, withdrawal receipts, account security alerts, and important policy updates.
- To send promotional communications (with your prior consent only) regarding bonuses, new games, Liga Super Malaysia betting markets, and other relevant offers.
- To conduct internal analytics for the purpose of improving the bola168 Platform, identifying technical issues, and optimising the user experience.
- To comply with applicable legal, regulatory, and law enforcement requirements.
We do not use your data for automated decision-making that has legal or similarly significant effects on you, without providing a means to request human review of that decision.
Data Sharing & Disclosure
bola168 does not sell, rent, or commercially disclose your personal data to third parties for their own marketing or commercial use. We may share your personal data with the following categories of parties, strictly for the purposes described:
7.1 Service Providers and Data Processors
We engage trusted third-party service providers who process data on our behalf under contractual data processing agreements that require them to maintain confidentiality and comply with our data protection standards. These include:
- Payment processors — to facilitate deposits and withdrawals via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency networks.
- KYC and identity verification providers — to perform automated and manual document verification.
- Fraud prevention and anti-money laundering (AML) screening services.
- Cloud infrastructure and data hosting providers — all subject to security and confidentiality obligations.
- Customer support platform providers — for the purpose of managing and logging support interactions.
- Game content providers — live casino studios and sportsbook data providers may receive limited session data necessary to deliver their services.
7.2 Legal and Regulatory Disclosure
bola168 may disclose personal data to law enforcement agencies, courts, regulators, or other public authorities where required to do so by applicable law, valid legal process, or regulatory direction. We will, where legally permissible, endeavour to notify you of such disclosures.
7.3 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets involving bola168, your personal data may be transferred to the acquiring or successor entity as part of that transaction. You will be notified of any such change affecting this Policy.
Cookies & Tracking Technologies
bola168 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file stored on your device by your browser when you visit a website. We use the following types:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Maintain your login session, remember preferences, and ensure Platform functionality. Cannot be disabled without affecting Platform operation. | Session |
| Analytics | Understand how users navigate the Platform, identify technical errors, and measure engagement with features. | Up to 13 months |
| Fraud & Security | Detect and prevent fraudulent login attempts, account takeovers, and suspicious patterns of platform use. | Session / Persistent |
| Preference | Remember your language settings, display preferences, and notification configurations. | Up to 12 months |
Most browsers allow you to block or delete cookies through their settings. Blocking strictly necessary cookies may impair the functionality of your Account. Blocking analytics or preference cookies will not prevent you from accessing the Platform but may affect some personalisation features.
Data Retention
bola168 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by law. The following general retention periods apply:
- Account and registration data: Retained for the duration of your Account and for a minimum of 5 years following Account closure, to comply with anti-money laundering and regulatory record-keeping obligations.
- KYC documents: Retained for a minimum of 5 years following Account closure or the date of the last verified transaction, in accordance with applicable AML requirements.
- Transaction records: Retained for a minimum of 5 years from the date of each transaction.
- Support and communication records: Retained for a minimum of 2 years from the date of the interaction, or longer where relevant to an ongoing dispute or legal matter.
- Marketing consent records: Retained until you withdraw consent and for a further 3 years thereafter, to demonstrate compliance.
- Technical and log data: Retained for a maximum of 13 months unless longer retention is required for a specific investigation.
At the end of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.
Data Security
bola168 implements a layered set of technical and organisational security measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction. These include:
- AES-256 encryption for all personal data stored at rest.
- TLS 1.2 or higher encryption for all data in transit between your device and our servers.
- Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
- Two-factor authentication enforced for all internal staff accounts with access to user data systems.
- Regular penetration testing and vulnerability assessments conducted by independent security specialists.
- Isolated, access-controlled storage for KYC documents, separate from general application databases.
- Security incident response procedures with defined notification timelines in the event of a data breach.
Security Reminder: bola168 will never request your Account password via email, live chat, or any other communication channel. If you receive any such request, please treat it as a phishing attempt and report it immediately to [email protected].
International Transfers
Some of the third-party service providers engaged by bola168 — including cloud infrastructure providers, KYC verification services, and game content studios — may be located in countries outside Malaysia. Where personal data is transferred internationally, bola168 ensures that appropriate contractual safeguards are in place to maintain the standard of protection required by this Policy, including the use of data processing agreements with binding data protection obligations.
bola168 will not transfer personal data to a third country unless that country provides an adequate level of data protection or appropriate contractual safeguards have been put in place.
Your Rights
As a user of the bola168 Platform, you hold the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 16. We will respond to valid requests within 30 days.
Right of Access
Request a copy of the personal data bola168 holds about you, together with information about how it is processed.
Right to Rectification
Request correction of inaccurate or incomplete personal data held in your Account or our records.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the original purpose, subject to our legal retention obligations.
Right to Restriction
Request that we restrict processing of your data in certain circumstances, for example while a data accuracy dispute is being resolved.
Right to Data Portability
Request a structured, machine-readable export of the personal data you have provided to us, for transfer to another service where technically feasible.
Right to Withdraw Consent
Where processing is based on your consent (such as marketing communications), withdraw that consent at any time. Withdrawal will not affect the lawfulness of prior processing.
Right to Object
Object to processing carried out on the basis of bola168's legitimate interests, including profiling. We will cease such processing unless we can demonstrate compelling legitimate grounds.
Right to Lodge a Complaint
If you are dissatisfied with how bola168 has handled your personal data, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.
Children's Privacy
The bola168 Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that an Account has been registered by a person under 21, we will immediately suspend the Account, investigate, and take appropriate action including deletion of the associated data.
If you believe that a minor has registered an Account on bola168, please contact our support team immediately using the contact details in Section 16. We take this matter with the highest seriousness.
Third-Party Services
The bola168 Platform may contain integrations with third-party services such as payment gateways, live game streaming providers, and customer support tools. These third parties operate under their own privacy policies and data practices, over which bola168 has no direct control.
When you interact with a third-party service through the bola168 Platform (for example, when confirming a DuitNow or Touch 'n Go eWallet transaction), your interaction with that service is subject to the relevant third party's own privacy terms. bola168 recommends that you review the privacy policies of any third-party services you use in connection with your Account.
bola168 conducts due diligence on all third-party service providers before engagement and requires them to maintain data protection standards consistent with this Policy. However, bola168 accepts no liability for the independent privacy practices of third-party providers.
Amendments to This Policy
bola168 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. The date of the most recent revision will be prominently displayed at the top of this document.
Where changes to this Policy are material — meaning they significantly affect your rights or the way we use your personal data — we will notify registered Account holders via in-Platform notification or email to your registered address prior to the changes taking effect.
Your continued use of the bola168 Platform following the posting of an updated Policy constitutes your acceptance of the changes. If you do not agree with any amendment, you should cease use of the Platform and close your Account. We encourage you to review this Policy periodically.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the way bola168 processes your personal data, please contact our Privacy and Data Protection team using the following details. All correspondence should be submitted in English to ensure the fastest possible response.
Data Protection Contact — Support Email:
[email protected]
Response Time:
We aim to acknowledge all privacy-related enquiries within 2 business days and to provide a substantive response within 30 calendar days of receipt. Complex or multi-faceted requests may require additional time, of which we will notify you.
When submitting a data rights request, please include your registered email address and Account username, a clear description of your request or concern, and, where relevant, the specific data or processing activity your request relates to. This helps us locate your records and process your request efficiently.
For responsible gambling-related matters — including self-exclusion requests, deposit limit applications, and account cooling-off — please contact support directly or visit our Responsible Gambling page for detailed guidance.
Important: bola168's support team will always respond from our official email domain. Be cautious of any communications purporting to be from bola168 that originate from unofficial addresses or ask you to provide personal data through unsecured channels.
Questions About Your Privacy?
Our support team is available around the clock to assist with any privacy-related query, data rights request, or concern about how bola168 handles your personal information.
See also our Terms & Conditions and Responsible Gambling Policy. For players aged 21 and above only.