Privacy Policy

Version: 1.0  |  Last Updated: 10 November 2026

1. Introduction

Welcome to Casinobossy ("we", "us", "our"), operated through the website bossy-online.casino (the "Platform"). We are committed to protecting the personal information of every individual who visits, registers with, or transacts on our Platform. This Privacy Policy ("Policy") explains what personal data we collect, why we collect it, how we use and share it, how long we retain it, and what rights you hold in relation to your information.

This Policy forms part of a broader legal framework that also includes our Terms & Conditions and our Responsible Gaming page. By accessing or using our Platform, you acknowledge that you have read, understood, and agreed to the practices described in this Policy. If you do not agree, please discontinue use of the Platform immediately.

We may update this Policy from time to time. The version number and "Last Updated" date at the top of this document reflect the most current revision. Continued use of the Platform after any update constitutes acceptance of the revised Policy.

2. Data We Collect

We collect personal data through several channels: information you provide directly, information generated by your use of the Platform, and information received from trusted third parties. The categories of data we collect are described below.

2.1. Information You Provide Directly

• Identity Data: Full name, date of birth, gender, and copies of government-issued identification documents (such as Aadhaar card, PAN card, or passport) provided during account registration or identity verification.
• Contact Data: Email address, phone number, and residential address (including city, state, and PIN code).
• Account Credentials: Username and encrypted password chosen at registration.
• Financial Data: Payment instrument details, including UPI IDs, bank account numbers, Paytm wallet identifiers, Skrill or Neteller account references, card type and last four digits, and transaction history associated with your account.
• Communications Data: Content of messages you send us via live chat, email, or support tickets, as well as responses to surveys or promotional campaigns.
• Responsible Gaming Data: Self-imposed deposit limits, cooling-off periods, self-exclusion requests, and any declarations you make regarding your gaming behaviour as described in our Responsible Gaming policy.

2.2. Information Collected Automatically

• Technical Data: IP address, device type, operating system, browser type and version, screen resolution, and unique device identifiers.
• Usage Data: Pages visited, games played, session duration, click-stream data, search queries within the Platform, and features accessed.
• Transaction Data: Records of deposits, withdrawals, bets placed, winnings, and bonus redemptions.
• Geolocation Data: Approximate location derived from IP address to verify eligibility and comply with applicable restrictions.

2.3. Information From Third Parties

• Identity Verification Providers: Results of Know Your Customer (KYC) and Anti-Money Laundering (AML) checks performed by third-party verification partners.
• Payment Processors: Confirmation of payment success or failure, fraud-risk scores, and chargeback notifications from processors such as UPI networks, Paytm, PhonePe, Skrill, or Neteller.
• Analytics and Marketing Partners: Aggregated audience data used to improve our services and personalise communications, subject to the consents you have granted.

3. How We Use Your Data

We process your personal data only for specified, explicit, and legitimate purposes. The principal purposes for which we use your data are set out below, together with the operational activities they support.

3.1. Account Management and Service Delivery

We use your identity, contact, and credentials data to create and maintain your account, authenticate your login sessions, deliver the gaming services you request, process deposits and withdrawals in Indian Rupees (INR), and issue account statements. Without this processing, we cannot provide the Platform to you.

3.2. Regulatory Compliance and Fraud Prevention

We are obliged to verify your identity before allowing financial transactions, to screen against sanctions lists, and to monitor transactions for potential money laundering or fraud. We retain records of this verification to demonstrate compliance when required. Where suspicious activity is identified, we may report it to the relevant authorities as required by applicable law.

3.3. Responsible Gaming

We use your gaming behaviour data, self-declared limits, and account history to enforce responsible gaming controls, to identify patterns that may indicate problematic behaviour, and to communicate with you about support resources. This processing is explained in greater detail on our Responsible Gaming page.

3.4. Customer Support

When you contact our support team, we use your identity, contact, and communications data to investigate your query, resolve disputes, and improve the quality of our assistance. Support interactions may be recorded and stored for training, audit, and dispute-resolution purposes.

3.5. Marketing and Personalisation

Subject to your marketing preferences and applicable consent requirements, we may use your contact data, usage data, and transaction data to send you promotional offers, personalise game recommendations, and present relevant advertisements. You may withdraw marketing consent at any time by updating your account preferences or contacting us at [email protected].

3.6. Analytics and Platform Improvement

We use aggregated and, where necessary, identifiable usage data to analyse Platform performance, identify and resolve technical issues, conduct A/B testing, and develop new features. Where possible, we anonymise or pseudonymise data before using it for analytics purposes.

4. Legal Bases for Processing

We rely on distinct legal bases for each category of processing activity. The table below summarises our primary reliance for the most significant processing operations.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms, taking into account the safeguards we apply. Where we rely on consent, you retain the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

5. Data Sharing & Third Parties

We do not sell, rent, or otherwise trade your personal data to third parties for their own marketing purposes. We share your data only in the circumstances described in this section, and always subject to appropriate contractual safeguards.

5.1. Service Providers and Data Processors

We engage carefully vetted third-party companies to perform services on our behalf. These processors act solely on our documented instructions and are prohibited from using your data for their own purposes. Categories of processors include:

• Payment processors: UPI-based networks, Paytm, PhonePe, Google Pay, Skrill, Neteller, AstroPay, Visa/Mastercard networks, RuPay, Net Banking/IMPS providers, and cryptocurrency gateways, as applicable.
• Identity and KYC verification providers — to authenticate documents and check sanctions databases.
• IT infrastructure and cloud hosting providers — to store and process Platform data securely.
• Customer support technology providers — live chat and ticketing platforms.
• Analytics and performance monitoring tools — to measure Platform usage and technical health.

5.2. Legal and Regulatory Disclosure

We may disclose your personal data to law enforcement authorities, regulatory bodies, or courts when required to do so by applicable law, court order, or enforceable governmental request. Where legally permissible, we will notify you of such disclosure.

5.3. Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business assets, your personal data may be transferred to the acquiring entity. We will notify you in advance of any such transfer and explain the privacy implications.

5.4. Affiliate and Marketing Partners

Where you have provided marketing consent, we may share limited contact data with trusted affiliate partners to deliver relevant promotions. Affiliates are contractually required to use your data only as permitted and in accordance with applicable privacy requirements.

6. Cookies & Tracking Technologies

Casinobossy uses cookies and similar tracking technologies — including web beacons, pixel tags, and local storage objects — to operate the Platform effectively and to understand how users interact with our services.

6.1. Types of Cookies We Use

• Strictly Necessary Cookies: Essential to core Platform functionality, such as maintaining your login session, remembering your language preference, and enabling secure transactions. These cookies cannot be disabled without severely impairing your use of the Platform.
• Performance and Analytics Cookies: Collect anonymous or pseudonymous data about how visitors use the Platform, which pages are visited most frequently, and where errors occur. This information helps us improve service quality.
• Functional Cookies: Remember your preferences, such as game layout settings, currency display (INR), and notification choices, to provide a personalised experience.
• Marketing and Targeting Cookies: Used (subject to your consent) to deliver relevant advertisements and to track the effectiveness of promotional campaigns across partner websites.

6.2. Managing Your Cookie Preferences

When you first visit the Platform, a cookie consent banner allows you to accept, reject, or customise non-essential cookies. You may update your preferences at any time via the cookie settings link in the footer. Additionally, most browsers offer built-in controls to block or delete cookies; however, disabling strictly necessary cookies may prevent certain Platform features from functioning correctly.

7. Data Security

We implement a layered, risk-based approach to data security, applying technical and organisational measures commensurate with the sensitivity of the data we process and the risks associated with unauthorised access, disclosure, alteration, or destruction.

7.1. Technical Safeguards

• Encryption: All data transmitted between your device and our servers is protected using Transport Layer Security (TLS) with strong cipher suites. Sensitive data at rest, including payment details and identity documents, is encrypted using industry-standard algorithms.
• Access Controls: Access to personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access control and multi-factor authentication.
• Intrusion Detection: Our infrastructure is monitored continuously for anomalous activity, and automated alerting systems are in place to detect and respond to potential breaches.
• Vulnerability Management: We conduct regular security assessments, penetration testing, and patch management cycles to identify and remediate weaknesses.

7.2. Organisational Safeguards

All staff and contractors with access to personal data are subject to confidentiality obligations and receive periodic privacy and security training. We maintain an incident-response procedure that includes containment, investigation, and notification steps in the event of a confirmed data breach. Where applicable law requires notification to affected individuals or authorities within a prescribed timeframe, we will comply with those obligations.

No security system is entirely impenetrable. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect unauthorised access to your account.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, or to resolve disputes and enforce our agreements. The principal retention criteria we apply are as follows:

• Active Account Data: Maintained for the entire duration of your account's active status and for a minimum period thereafter as required by applicable regulatory obligations, which typically mandate retention of transaction and KYC records for a defined period from the date of the last transaction or account closure.
• Financial and Transaction Records: Retained for the period mandated by applicable financial regulations and anti-money laundering requirements. These records may be required by authorities investigating financial crime.
• Customer Support Records: Kept for a reasonable period following the closure of a support interaction to enable follow-up and dispute resolution.
• Marketing Data: Retained until you withdraw consent or request erasure, subject to suppression-list requirements to honour your opt-out.
• Cookie and Analytics Data: Stored in accordance with the lifespan specified in our cookie settings; aggregated analytics data may be retained indefinitely in anonymised form.

When retention periods expire, we securely delete or anonymise the data concerned. Where anonymisation is applied, the resulting dataset is no longer considered personal data and falls outside the scope of this Policy.

9. Your Rights

Subject to applicable law and certain limited exceptions, you hold meaningful rights over your personal data. We are committed to honouring these rights promptly and transparently. The rights available to you, and the conditions that apply, are described below.

9.1. Right of Access

You may request a copy of the personal data we hold about you, together with information about how we use it, the categories of recipients with whom we share it, and the retention period applicable to it. We will provide this information in a clear and structured format without undue delay.

9.2. Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you may request that we correct or complete it. For certain data elements — such as your registered name or date of birth — we may require you to provide supporting documentary evidence before making changes.

9.3. Right to Erasure ("Right to be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent on which the processing is based (and no other legal basis applies), or where the data has been processed unlawfully. We will assess each request and notify you if an applicable legal obligation prevents full erasure, in which case we will explain the reason and the data that must be retained.

9.4. Right to Restriction of Processing

You may request that we restrict processing of your personal data in circumstances where you contest its accuracy, where processing is unlawful but you do not wish the data erased, or where you have objected to processing and a determination of legitimate grounds is pending. While restriction is in place, we will store but not actively process the data, except with your consent or for the establishment, exercise, or defence of legal claims.

9.5. Right to Data Portability

Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format, or that we transmit it directly to another controller where technically feasible.

9.6. Right to Object

You have the right to object to processing based on our legitimate interests, including profiling for direct marketing purposes. Upon receipt of a valid objection to direct marketing, we will cease that processing immediately. For other legitimate-interest processing, we will assess whether our compelling grounds override your interests, rights, and freedoms and inform you of the outcome.

9.7. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time by contacting us or adjusting your account settings. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.

9.8. How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to [email protected]. We will acknowledge your request within a reasonable period and aim to respond substantively without undue delay. We may need to verify your identity before processing certain requests to prevent unauthorised disclosure or modification of your data. Where a request is manifestly unfounded, excessive, or repetitive, we reserve the right to charge a reasonable administrative fee or decline to act on the request, providing reasons for that decision.

9.9. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the relevant supervisory or data protection authority in your jurisdiction. We encourage you to contact us first so that we have the opportunity to address your concern directly before you approach a regulatory body.

10. International Data Transfers

Casinobossy operates globally, and the personal data we collect may be transferred to, stored in, or processed in countries other than your country of residence, including countries that may not provide the same level of data protection as the laws of India or your home jurisdiction.

When we transfer personal data internationally, we implement appropriate safeguards to ensure that your data continues to receive a level of protection consistent with applicable data protection standards. These safeguards may include:

• Contractual clauses that impose binding privacy and security obligations on recipients, equivalent in effect to standard contractual clauses recognised by relevant regulatory bodies;
• Transfers to processors certified under recognised international data protection frameworks or that maintain equivalent internal policies;
• Transfers to countries that have been determined to offer an adequate level of protection by the relevant authority.

By using the Platform, you acknowledge that your personal data may be transferred in the manner described above. If you would like further information about the specific safeguards we apply to any particular transfer, please contact us at [email protected].

11. Minors

Casinobossy is strictly an adult service. The minimum age to register, play, or transact on the Platform is 18 years. We do not knowingly collect personal data from individuals under the age of 18. During registration, users are required to confirm that they meet this age requirement, and we conduct verification checks to support this confirmation.

If we become aware, through any means, that a registered user is under the age of 18, we will promptly suspend or close that account, cancel any pending transactions, and securely delete the personal data associated with the minor, except where retention is required by applicable law. If you believe that a minor has registered on our Platform, please notify us immediately at [email protected] so that we can take appropriate action without delay.

Parents and guardians are encouraged to implement parental control tools and to monitor the online activities of minors in their care. For additional guidance, please consult our Responsible Gaming page.

12. Changes to This Policy

We reserve the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, our business operations, or the data processing activities conducted in connection with the Platform. When we make material changes, we will update the version number and the "Last Updated" date shown at the top of this document.

Where a change materially affects your rights or the way we use your data, we will provide prominent notice via the Platform (for example, through a banner notification upon login) or by sending a direct communication to the email address registered to your account. Your continued use of the Platform following the effective date of any amended Policy constitutes your acceptance of the revised terms. If you do not agree with any change, you should cease using the Platform and may request account closure by contacting our support team.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. The current version of this Policy supersedes all prior versions and governs the processing of your personal data as of its "Last Updated" date.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way in which we handle your personal data, please do not hesitate to contact us using the details below. We are committed to addressing all enquiries in a timely, respectful, and transparent manner.

For privacy-related requests — including access, rectification, erasure, portability, and objection requests as described in Section 9 — please contact our Privacy & Data Protection Officer directly at [email protected] and include "Data Subject Request" in the subject line of your email to ensure your message is routed promptly to the appropriate team.

We aim to acknowledge all privacy-related enquiries within five business days and to provide a substantive response within thirty calendar days, except where the complexity or volume of requests necessitates an extension, in which case we will notify you of the revised timeline in advance.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming policy, which together form the complete legal framework governing your use of the Casinobossy Platform.