Privacy Policy
Your Data, Your Rights

1. Introduction and Scope

This Privacy Policy describes how bmy88 (hereinafter "bmy88," "we," "us," or "our"), a Philippine Amusement and Gaming Corporation (PAGCOR) licensed online gaming operator, collects, uses, discloses, stores, and protects personal information provided by users (hereinafter "you," "User," or "Player") of the bmy88 platform accessible at https://bmy88.cam and associated mobile applications.

This Privacy Policy is incorporated into and subject to the bmy88 Terms and Conditions. By registering an account, accessing the platform, or using any bmy88 services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy and consent to the collection and processing of your personal data as described herein.

bmy88 complies with Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, National Privacy Commission (NPC) circulars, and all applicable Philippine data protection laws. We are committed to protecting your privacy and handling your personal information with transparency, fairness, and accountability.

2. Data Controller and Contact Information

For purposes of the Data Privacy Act of 2012, bmy88 is the data controller responsible for the collection and processing of your personal information. Our Data Protection Officer (DPO) oversees compliance with data protection laws and serves as the primary point of contact for privacy-related inquiries.

Data Protection Officer Contact:

• Email: [email protected]
• Address: bmy88 Data Protection Office, Manila, Philippines
• Response Time: We aim to respond to all data protection inquiries within 10 business days

For general privacy questions or to exercise your data subject rights, you may also contact our Customer Support team at [email protected] or through the live chat function available 24/7 on the bmy88 platform.

3. Categories of Personal Data Collected

bmy88 collects and processes the following categories of personal data:

3.1 Identity and Contact Information

• Full legal name as it appears on government-issued identification
• Date of birth and age verification information
• Gender and nationality
• Email address and mobile phone number
• Residential address including barangay, city/municipality, province, and postal code
• Government-issued identification numbers (e.g., passport number, driver's license number, UMID, SSS, TIN) as required for Know Your Customer (KYC) verification
• Photographs and scanned copies of identification documents
• Selfie photographs for enhanced identity verification

3.2 Financial Information

• Payment method details including GCash account number, PayMaya account number, bank account numbers, cryptocurrency wallet addresses
• Deposit and withdrawal transaction history including amounts, dates, times, and payment method used
• Source of funds documentation for large or unusual transactions
• Credit/debit card information (if applicable) - note that full card numbers are tokenized and not stored by bmy88

3.3 Gaming Activity Data

• Account username and login credentials (passwords are stored in encrypted, hashed format)
• Gaming preferences and favorite games
• Betting history including wagers placed, games played, outcomes, winnings, and losses
• Bonus claims, wagering progress, and promotional participation
• Session duration and frequency of platform access
• Responsible gaming settings including deposit limits, loss limits, session time limits, and self-exclusion requests

3.4 Technical and Device Information

• IP address and geolocation data to verify you are accessing the platform from within the Philippines
• Device type, operating system, browser type and version
• Device identifiers and mobile advertising IDs
• Cookies and similar tracking technologies (see Section 9 for detailed information)
• Platform navigation patterns, pages viewed, time spent on pages
• Referral sources and marketing campaign identifiers

3.5 Communications and Customer Service Data

• Contents of communications with bmy88 customer support, including live chat transcripts, email correspondence, and phone call recordings (with notice and consent)
• Feedback, complaints, dispute details, and resolution outcomes
• Marketing preferences and communication opt-in/opt-out status

3.6 Sensitive Personal Information

Under the Data Privacy Act, certain categories of personal data are classified as sensitive personal information (SPI) requiring heightened protection. bmy88 may process the following SPI:

• Government-issued ID numbers (as these may be classified as SPI under NPC opinions)
• Biometric data (facial recognition data derived from selfie verification)
• Data relating to problem gambling or self-exclusion requests

We process SPI only with your explicit consent, when required by law (such as anti-money laundering regulations), or when necessary to fulfill our contract with you. Additional security measures are applied to protect SPI.

4. Lawful Basis and Purpose of Data Processing

bmy88 processes your personal data only when we have a lawful basis under the Data Privacy Act. The lawful bases and corresponding purposes include:

4.1 Performance of Contract

Processing is necessary to fulfill our contractual obligations to you under the Terms and Conditions, including:

• Account registration, maintenance, and authentication
• Processing deposits, withdrawals, and financial transactions
• Providing access to gaming products including slots, live casino, sports betting, and bingo
• Calculating and crediting winnings, bonuses, and promotional rewards
• Providing customer support and resolving disputes
• Maintaining game history and account balance records

4.2 Compliance with Legal Obligations

Processing is necessary to comply with legal and regulatory requirements, including:

• Conducting Know Your Customer (KYC) verification and Customer Due Diligence (CDD) as required by PAGCOR regulations
• Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) compliance under Philippine Anti-Money Laundering Act (AMLA)
• Age verification to prevent underage gambling (21+ age requirement)
• Reporting suspicious transactions to the Anti-Money Laundering Council (AMLC)
• Tax reporting and withholding obligations
• Responding to lawful requests from regulatory authorities, law enforcement, or courts
• Maintaining records as required by PAGCOR licensing conditions (typically 5 years)

4.3 Legitimate Interests

Processing is necessary for bmy88's legitimate business interests, provided such interests do not override your fundamental rights and freedoms:

• Fraud prevention, detection, and investigation
• Detection of multiple accounts, bonus abuse, collusion, and other prohibited activities
• Platform security, including protection against hacking, DDoS attacks, and unauthorized access
• Network and information security monitoring
• Business analytics and performance optimization
• Internal auditing and quality assurance
• Merger, acquisition, or business restructuring due diligence

4.4 Consent

With your explicit, freely given, specific, informed, and unambiguous consent, we process personal data for:

• Marketing communications including promotional emails, SMS, push notifications, and personalized offers
• Participation in tournaments, leaderboards, and public-facing competitions
• Sharing anonymized or aggregated data with third-party analytics providers
• Processing of sensitive personal information beyond that required by law or contract

You have the right to withdraw consent at any time by updating your account preferences or contacting our Data Protection Officer. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. Sources of Personal Data

bmy88 obtains personal data from the following sources:

5.1 Directly from You

• Information you provide during account registration
• Documents and information submitted for KYC verification
• Payment information entered when making deposits or withdrawals
• Information provided in customer support communications
• Preferences and settings you configure in your account

5.2 Automatically Collected Data

• Technical and device information collected through cookies, pixels, and similar technologies when you access the bmy88 platform
• Geolocation data derived from IP address
• Gaming activity and transaction data generated through your use of our services

5.3 Third-Party Sources

• Payment processors (GCash, PayMaya, banks, cryptocurrency exchanges) providing transaction confirmation and fraud prevention data
• Identity verification service providers conducting enhanced due diligence
• Credit reference agencies and fraud prevention databases (where permitted by law)
• Public records and databases for verification purposes
• Marketing partners and affiliates (with your consent and subject to their privacy policies)

6. Data Sharing and Disclosure

bmy88 does not sell, rent, or trade your personal information to third parties for their marketing purposes. We share personal data only in the following limited circumstances:

6.1 Service Providers and Processors

We engage third-party service providers to perform functions on our behalf. These processors are contractually obligated to process personal data only as instructed by bmy88 and to maintain appropriate security measures. Categories of processors include:

• Payment Processors: GCash, PayMaya, bank partners, cryptocurrency payment gateways for processing deposits and withdrawals
• Game Providers: Third-party software providers delivering slot games, live casino, virtual sports, and other gaming content
• Identity Verification Services: KYC and AML screening providers for customer due diligence
• Cloud Hosting Providers: For secure data storage and platform infrastructure
• Customer Support Platforms: Live chat, email, and CRM systems
• Analytics and Marketing Tools: Website analytics, email marketing platforms, and advertising networks (with consent)
• Security Providers: Fraud detection, DDoS protection, and cybersecurity services

6.2 Regulatory and Legal Authorities

bmy88 may disclose personal data to regulatory authorities, government agencies, and law enforcement when required by law or when we believe in good faith that disclosure is necessary to:

• Comply with PAGCOR regulatory requirements and licensing conditions
• Report suspicious transactions to the Anti-Money Laundering Council (AMLC)
• Respond to court orders, subpoenas, or lawful governmental requests
• Enforce our Terms and Conditions and protect the rights, property, or safety of bmy88, our users, or the public
• Cooperate with tax authorities regarding tax obligations

6.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, sale of assets, or bankruptcy, personal data may be transferred to the acquiring or successor entity. We will notify affected users via email and prominent platform notice before personal data is transferred and becomes subject to a different privacy policy.

6.4 With Your Consent

We may share personal data with third parties when you have provided explicit consent, such as:

• Sharing your username and winnings on public leaderboards or tournament results (if you opt in)
• Allowing marketing partners to contact you regarding promotions (if you opt in)
• Integrating with third-party social media platforms (if you choose to connect accounts)

7. International Data Transfers

bmy88 operates primarily within the Philippines and stores personal data on servers located within Philippine territory or in jurisdictions with adequate data protection standards as recognized by the National Privacy Commission.

In certain circumstances, personal data may be transferred to third-party service providers located outside the Philippines. When such transfers occur, bmy88 ensures that:

• The recipient country has been deemed by the NPC to have adequate data protection standards, or
• Appropriate safeguards are in place, such as standard contractual clauses approved by the NPC, or
• The transfer is necessary for the performance of the contract between you and bmy88, or
• You have provided explicit, informed consent to the transfer after being informed of the possible risks

For more information about international data transfers and the safeguards in place, please contact our Data Protection Officer at [email protected].

8. Data Security Measures

bmy88 employs industry-leading technical, physical, and organizational security measures to protect personal data from unauthorized access, disclosure, alteration, or destruction. Our security measures include:

8.1 Technical Security Controls

• Encryption: All data transmission between your device and bmy88 servers is protected using Transport Layer Security (TLS) 1.2 or higher with 256-bit encryption
• Data at Rest Encryption: Personal data stored in databases is encrypted using AES-256 encryption
• Password Security: User passwords are hashed using bcrypt or similar one-way cryptographic algorithms and are never stored in plain text
• Two-Factor Authentication (2FA): Optional 2FA is available to all users for enhanced account security
• Firewall Protection: Network-level firewalls and intrusion detection systems monitor and block unauthorized access attempts
• DDoS Protection: Distributed Denial of Service (DDoS) mitigation systems protect platform availability
• Regular Security Audits: Penetration testing and vulnerability assessments conducted by independent security firms

8.2 Access Controls

• Personal data is accessible only to authorized bmy88 employees and contractors who require access to perform their job functions
• Role-based access control (RBAC) ensures users can access only the data necessary for their role
• All access to sensitive personal information is logged and audited
• Multi-factor authentication is required for administrative access to production systems

8.3 Organizational Measures

• All employees and contractors undergo data protection training and sign confidentiality agreements
• Data breach response procedures are in place to detect, investigate, and respond to security incidents
• Regular backups are performed and stored securely to prevent data loss
• Vendor security assessments are conducted before engaging third-party service providers

8.4 Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, bmy88 will:

• Notify the National Privacy Commission within 72 hours of becoming aware of the breach
• Notify affected individuals without undue delay if the breach poses a high risk to their rights and freedoms
• Provide information about the nature of the breach, likely consequences, and measures taken to address the breach

9. Cookies and Tracking Technologies

bmy88 uses cookies, web beacons, pixels, and similar tracking technologies to enhance user experience, analyze platform usage, and deliver personalized content. This section explains what cookies are, how we use them, and how you can manage your cookie preferences.

9.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently, improve user experience, and provide information to website owners.

9.2 Types of Cookies We Use

• Essential Cookies: These cookies are necessary for the platform to function. They enable core functionalities such as user authentication, account access, and secure transactions. Essential cookies cannot be disabled.
• Performance Cookies: These cookies collect aggregated, anonymized information about how users interact with the platform, including pages visited, time spent, and error messages. This helps us improve platform performance.
• Functional Cookies: These cookies remember your preferences (such as language, currency, and game favorites) to provide a personalized experience.
• Advertising and Marketing Cookies: With your consent, these cookies track your browsing behavior to deliver targeted advertisements and measure marketing campaign effectiveness. They may be set by bmy88 or third-party advertising partners.

9.3 Managing Cookie Preferences

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. However, disabling cookies may affect your ability to use certain features of the bmy88 platform.

To learn more about cookies and how to manage them, visit www.allaboutcookies.org.

10. Data Retention

bmy88 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements.

10.1 Retention Periods

• Active Accounts: Personal data is retained for the duration of your account relationship with bmy88 plus any applicable retention period after account closure.
• Closed Accounts: After you close your account, personal data is retained for a period of 5 years to comply with PAGCOR record-keeping requirements, anti-money laundering obligations, and potential legal claims.
• Transaction Records: Financial transaction data is retained for 5 years from the date of the transaction to comply with tax and AML regulations.
• Marketing Data: If you opt out of marketing communications, your contact information is retained only to honor your opt-out request and prevent future marketing.
• Self-Exclusion Data: Information related to responsible gaming measures and self-exclusion is retained for the duration of the exclusion period plus 5 years to prevent re-registration.

10.2 Secure Deletion

After the applicable retention period expires, personal data is securely deleted or anonymized in accordance with industry best practices. Anonymized data that can no longer identify individuals may be retained indefinitely for statistical and analytical purposes.

11. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights regarding your personal data:

11.1 Right to Be Informed

You have the right to be informed about the collection and processing of your personal data. This Privacy Policy serves as our primary means of providing such information.

11.2 Right to Access

You have the right to obtain confirmation from bmy88 whether personal data concerning you is being processed, and if so, to access that data. You may request a copy of your personal data in a commonly used electronic format.

11.3 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data. You can update most information directly through your account settings or by contacting customer support.

11.4 Right to Erasure (Right to Be Forgotten)

You have the right to request deletion of your personal data in certain circumstances, including:

• The personal data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The personal data has been unlawfully processed

Please note that the right to erasure is not absolute. bmy88 may be required to retain certain data to comply with legal obligations, such as PAGCOR record-keeping requirements and AML regulations.

11.5 Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. If you object to marketing communications, we will cease such processing immediately.

11.6 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.

11.7 Right to Lodge a Complaint

You have the right to lodge a complaint with the National Privacy Commission if you believe bmy88 has violated your data protection rights. NPC contact information:

• Email: [email protected]
• Hotline: (+63 2) 8234-2228
• Website: https://www.privacy.gov.ph

11.8 How to Exercise Your Rights

To exercise any of these rights, please contact our Data Protection Officer at [email protected] with the subject line "Data Subject Rights Request." Include your full name, registered email address, and a description of the request.

We will respond to your request within 15 business days. In some cases, we may require additional information to verify your identity before fulfilling the request.

12. Children's Privacy

bmy88 services are strictly intended for individuals aged 21 years or older. We do not knowingly collect personal information from minors under the age of 21. If we become aware that a minor has provided personal data, we will take immediate steps to delete that information and close the associated account.

If you believe a minor has registered an account or provided personal data to bmy88, please contact us immediately at [email protected] so we can take appropriate action.

13. Marketing Communications

With your consent, bmy88 may send you marketing communications including promotional offers, newsletters, tournament announcements, and personalized recommendations via email, SMS, push notifications, or in-platform messaging.

13.1 Opt-Out Procedures

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in promotional emails
• Replying "STOP" to SMS messages
• Adjusting notification preferences in your account settings
• Contacting customer support at [email protected]

Please note that opting out of marketing communications does not affect transactional emails such as account verification, deposit confirmations, withdrawal notifications, or important service updates.

14. Third-Party Links and Services

The bmy88 platform may contain links to third-party websites, applications, or services, including payment processors, game providers, and social media platforms. This Privacy Policy applies only to bmy88. We are not responsible for the privacy practices or content of third-party sites.

We encourage you to review the privacy policies of any third-party services before providing personal information. bmy88 does not control and is not liable for third-party data practices.

15. Changes to This Privacy Policy

bmy88 reserves the right to update, modify, or replace this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated via:

• Email notification to your registered email address
• Prominent notice on the bmy88 platform homepage
• In-platform notification upon next login

The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised. Continued use of the bmy88 platform after changes are posted constitutes acceptance of the revised Privacy Policy. If you do not agree with the updated Privacy Policy, you must cease using our services and may close your account.

16. Contact Information and Questions

If you have questions, concerns, or requests regarding this Privacy Policy or bmy88's data practices, please contact us:

• Data Protection Officer: [email protected]
• Customer Support: [email protected] (24/7 via email or live chat)
• General Inquiries: [email protected]

We are committed to addressing your privacy concerns promptly and transparently. Your trust and confidence in bmy88 are important to us.