Privacy Policy – Protection of Your Personal Data at bolalion

1. Introduction – bolalion's Privacy Commitment

Bolalion operates as an online Sports Betting and casino platform serving Malaysian players. In providing this service, we necessarily collect and process a certain amount of personal data from our users. We recognise that this is a significant responsibility, and this Privacy Policy exists to explain, clearly and honestly, how we honour that responsibility.

This Privacy Policy is prepared in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and international best practices in data protection. We believe every player on the bolalion platform has the right to know exactly what data we collect about them, how it is used, the very limited circumstances under which it may be shared, and how they can control or request the deletion of their data.

The bolalion platform serves a wide range of Malaysian player segments – from EPL and Malaysia Super League football fans who follow every weekend match, to serious IPL cricket analysts, and active MPL Malaysia esports enthusiasts. All users across every segment receive the same level of privacy protection from bolalion, without exception.

2. Personal Data We Collect

Bolalion only collects data that is genuinely necessary to deliver our services. We do not collect excessive data, nor do we retain information that serves no clear operational purpose. Below are the categories of data we collect and the reasons for collecting them:

2.1 Account Registration Data

When you register an account with bolalion, we collect the following information:

• Username – for account identification within the platform
• Malaysian phone number – for OTP verification during registration and login, as well as important account-related communications
• Password – stored in encrypted form using a one-way hashing algorithm; the bolalion team cannot view your original password
• Date of birth – to verify that you meet the minimum age requirement of 18 years

2.2 Identity Verification Data (KYC)

To process withdrawals or as part of security procedures, bolalion may request identity verification documents, including:

• Copy of Malaysian identity card (MyKad) or passport
• Proof of address (utility bill or bank statement not older than 3 months)
• Proof of ownership of the registered bank account or e-wallet (screenshot or statement)

KYC documents are stored in a fully encrypted, secure environment. Access to these documents is restricted to authorised bolalion staff only.

2.3 Financial Transaction Data

Every financial transaction processed through the bolalion platform – whether a deposit via Touch 'n Go eWallet, DuitNow, GrabPay, FPX, Boost, or ShopeePay, or a withdrawal to a Malaysian bank account – is recorded in our system. These records include the transaction amount in MYR, date and time, payment method used, transaction status, and reference number. This data is required for financial accountability, legal compliance, and dispute resolution purposes.

2.4 Betting Activity Data

The bolalion platform records all betting activity on your account, including bets placed, markets selected, odds applied, bet outcomes, Cash Out history, and any bonuses or promotions used. This data is essential for ensuring all bets are settled accurately, allowing you to review your own betting history, and for the purpose of detecting suspicious activity.

2.5 Technical & Usage Data

Like most online platforms, bolalion automatically collects certain technical data when you use our platform:

• Your device's IP address
• Browser type and version you are using
• Device type (smartphone, laptop, tablet)
• Operating system
• Pages you visit within the platform and the duration of each visit
• Access time and date

This technical data is not used to identify you personally. It is used to diagnose technical issues, optimise platform performance, and detect unauthorised access attempts.

3. How We Use Your Data

Every piece of data we collect has a clear and legitimate purpose. bolalion does not use data for purposes beyond those stated below without first obtaining your explicit consent:

3.1 Service-Related Communications

Bolalion will send communications to your registered phone number for service-related matters such as transaction verification, account security notices, and important information about platform changes. These communications do not require separate consent as they form part of the service you signed up for.

3.2 Marketing Communications

If you have opted in to receive marketing communications during or after registration, bolalion may send you information about promotions, bonuses, and the latest offers. You are free to withdraw this consent at any time through your account settings or by contacting customer support.

4. Data Sharing with Third Parties

This is the most important section of our Privacy Policy because it speaks directly to trust. bolalion's position is clear: we does not sell, rent, or commercialise your personal data to any third party for our financial benefit.

However, there are limited situations where sharing certain data is necessary to deliver our services or fulfil legal obligations:

4.1 Technical Service Providers

Bolalion works with trusted technical service providers to operate the platform – including server infrastructure providers, payment system providers, and cybersecurity service providers. All such providers are bound by strict confidentiality agreements and may only access data necessary for their specific tasks. They are not permitted to use that data for any other purpose.

4.2 Payment Method Providers

When you make a deposit or withdrawal using Touch 'n Go eWallet, DuitNow, GrabPay, FPX, Boost, or ShopeePay, the required transaction information is shared with the respective payment service provider solely to process that transaction. This sharing is limited to the minimum necessary and is subject to each provider's own privacy policy.

4.3 Legal Obligations

Bolalion may be required to disclose personal data to competent authorities in Malaysia where there is a valid court order, an investigation by authorities into criminal activity or fraud, or other statutory reporting obligations required under applicable Malaysian law. In all such cases, we will disclose only the minimum information necessary and, where permitted by law, will notify you of any such request.

5. Data Security – How We Protect Your Information

Bolalion invests seriously in data security infrastructure. Protecting data is not simply a matter of putting one security layer in place and leaving it at that – it is an ongoing process that requires consistent monitoring, updating, and improvement.

5.1 Data Encryption

All communications between your browser or app and bolalion's servers are protected by 256-bit SSL/TLS encryption — the same standard used by Malaysia's leading banking institutions such as Maybank and CIMB. This means that even if someone were to intercept the communication between your device and our servers, the intercepted data would be completely unreadable.

Your account password is stored in encrypted form using a strong hashing algorithm. This means even bolalion's own technical team cannot view your original password — only you know it. If you forget your password, we are unable to tell you what it was; instead, you will need to set a new password through the phone verification process.

5.2 Access Controls

Access to user data within bolalion's internal systems is strictly limited to staff who require it to carry out their specific job responsibilities. All access to sensitive data is logged and auditable. bolalion staff undergo background checks and data privacy training before being granted access to any user information.

5.3 Continuous Monitoring

Bolalion's security systems operate 24/7 to detect and respond to any suspicious activity. This includes unauthorised login attempts, unusual transaction patterns, and attempts to exploit system vulnerabilities. When the system detects suspicious activity on your account, we will send an immediate notification to your registered phone number and may temporarily suspend certain activities pending successful identity verification.

5.4 What You Need to Do

While bolalion does its utmost to protect your data, account security also depends on your own actions. We recommend using a strong, unique password for your bolalion account, enabling two-factor authentication (2FA) in your account settings, not sharing your login credentials with anyone including family members, and always logging out when using a shared or public device.

6. Cookies & Tracking Technologies

The bolalion platform uses cookies and similar tracking technologies to ensure a smooth and secure user experience. Cookies are small text files stored in your browser when you visit our platform.

6.1 Types of Cookies We Use

• Session Cookies: Required to maintain your logged-in status while you use the platform. These cookies are automatically deleted when you close your browser.
• Preference Cookies: Saves your preferences such as display language and odds display settings so you do not have to reconfigure them each time you log in.
• Security Cookies: Helps detect fraudulent activity and protect your account from unauthorised access.
• Analytics Cookies: Collects information on how users interact with the platform to help us improve the user experience. This data is in aggregate form and does not personally identify you.

6.2 Cookie Controls

You can manage and delete cookies through your browser settings. Please note, however, that disabling certain cookies – especially session cookies and security cookies – may affect the functionality of the bolalion platform and make it harder to use. Cookies required for the platform's core operations cannot be disabled without impacting basic functionality.

7. Data Retention & Deletion

7.1 Retention Period

Bolalion retains your personal data for as long as necessary for the purposes stated in this Privacy Policy, subject to minimum legal requirements. In general, the principles we follow are as follows:

• Active account data: Retained for as long as your bolalion account remains active
• Financial transaction records: Retained for a minimum of 7 years in accordance with Malaysian accounting law requirements
• KYC Documents: Retained for a minimum of 5 years after account closure, in line with AMLA (Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act) requirements
• Technical logs: Typically retained for 90 days before being automatically deleted or canonicalised

7.2 Data Deletion Upon Request

After account closure, you may request the deletion of personal data that bolalion no longer needs for legal or operational purposes. However, financial transaction records and KYC documents cannot be deleted before the minimum retention period required under Malaysian law has elapsed, even upon request. This is a legal obligation we are unable to waive.

8. Your Privacy Rights as a bolalion User

Under Malaysia's Personal Data Protection Act 2010 (PDPA) and bolalion's own commitment to user privacy, you have the following rights with respect to your personal data:

To exercise any of the above rights, contact the bolalion privacy team by email at support@bolalion.best with the subject line "Data Privacy Request", or via the in-platform 24/7 live chat. We will process your request within 14 business days and may require identity verification before fulfilling it, to protect the security of your account.

9. Children's Data & Protection of Minors

The bolalion platform is strictly restricted to individuals aged 18 and above. We do not knowingly collect any personal data from individuals under the age of 18. If we discover that personal data has been collected from a minor, we will take immediate steps to delete that data and close the account in question.

Parents and guardians who are concerned that a minor may have registered or used the bolalion platform are urged to contact us immediately at support@bolalion.best. We take this matter very seriously and will respond within 24 hours.

10. Amendments to This Privacy Policy

Bolalion reserves the right to amend this Privacy Policy from time to time in response to changes in our operational practices, updates to applicable data protection laws in Malaysia, or changes in the technology we use. Where a significant amendment is made to this Privacy Policy, registered users will be notified via an in-platform bolalion notification or through their registered phone number, at least 14 days before the amendment takes effect.

For minor amendments that do not materially affect your rights, we may simply update the "Updated" date at the top of this page without a separate notice. We encourage you to check this page periodically to stay informed about how we protect your data.

11. Contact Us – Privacy-Related Enquiries

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way bolalion handles your personal data, our team is ready to assist:

• 24/7 Live Chat: Available directly within the bolalion platform – the fastest way to get an answer
• Email: support@bolalion.best – include "Privacy Inquiry" in the subject line of your email

We are committed to responding to all privacy-related enquiries within 3 business days. For more complex requests such as data access or deletion, we aim to resolve these within 14 business days from the date a complete request is received.