bmy88 Privacy Policy

This Privacy Policy ("Policy") applies to all personal data collected and processed by bmy88 ("bmy88," "we," "us," "our") through the bmy88.co website and all associated services, including the casino platform, sportsbook, bingo, live dealer games, and customer support channels.

bmy88 acts as the Personal Information Controller (PIC) with respect to personal data collected through the platform. As PIC, bmy88 is responsible for ensuring that personal data is handled lawfully, fairly, and transparently in accordance with the Data Privacy Act of 2012 (RA 10173) and its implementing rules and regulations issued by the National Privacy Commission (NPC) of the Philippines.

This Policy applies to all registered and prospective players, visitors to the bmy88 website, and any individual whose personal data bmy88 processes in connection with its gaming and business operations. It does not apply to third-party websites or services linked to or from the bmy88 platform.

bmy88 collects personal data through several channels: directly from you at registration and during account use, automatically through your interactions with the platform, and from third parties where legally permitted. The categories of data we collect include:

bmy88 does not knowingly collect sensitive personal information beyond what is required for identity verification and AML compliance. Where sensitive information is required (e.g., a copy of a government ID), it is processed solely for the verification purpose for which it was submitted and retained only for the legally required period.

bmy88 processes your personal data for the following purposes:

• Account creation and management: To register your bmy88 account, verify your identity, maintain your player profile, and facilitate login and account access.
• Service delivery: To enable gameplay, process deposits and withdrawals, calculate and credit winnings, and provide a functional gaming experience across all bmy88 product lines.
• Regulatory compliance: To fulfill obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), and the Data Privacy Act. This includes player identification, transaction monitoring, and filing of regulatory reports where required.
• Responsible gaming: To monitor player activity for indicators of problem gambling, enforce self-exclusion requests, apply deposit and loss limits set by the player, and comply with PAGCOR responsible gaming requirements.
• Fraud prevention and security: To detect and prevent unauthorized access, bonus abuse, multi-accounting, money laundering, and other prohibited activity on the bmy88 platform.
• Customer support: To respond to support queries, resolve disputes, and maintain records of player communications for quality assurance and dispute resolution purposes.
• Platform improvement: To analyze aggregate usage patterns, diagnose technical issues, and improve the performance and features of the bmy88 platform.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to players who have not opted out of marketing communications. Players may opt out at any time via account settings.

Under the Data Privacy Act of 2012, bmy88 processes personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations to you as a registered bmy88 player — including account management, gameplay, and payment processing.
• Legal obligation: Processing required to comply with applicable Philippine laws, including PAGCOR regulations, the Anti-Money Laundering Act, and reporting obligations to the AMLC and NPC.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your data protection rights.
• Consent: Processing for marketing communications, where you have given explicit consent. You may withdraw this consent at any time by updating your communication preferences in your bmy88 account settings.

bmy88 does not sell personal data to third parties. We share personal data only in the following limited circumstances:

• Payment processors: We share necessary financial data with GCash, Maya, and banking partners to process deposits and withdrawals. These processors are contractually bound to handle your data securely and only for payment purposes.
• Game providers: Where technically necessary, limited technical session data is shared with third-party game providers (e.g., Pragmatic Play, PG Soft) to deliver games within the bmy88 platform. These providers do not receive your identity or financial data.
• Regulatory authorities: We are required to disclose transaction and player data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities upon lawful request or as required by regulation.
• Fraud prevention services: Aggregated or anonymized technical data may be shared with fraud detection service providers to protect the integrity of the bmy88 platform.
• Legal proceedings: We may disclose personal data where required by a valid court order, subpoena, or other legal process under Philippine law.

All third-party processors engaged by bmy88 are required to enter into data processing agreements that impose data protection obligations consistent with the requirements of the Data Privacy Act and its implementing rules.

bmy88 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to minimum retention periods required by Philippine law and PAGCOR regulations.

• Active account data: Retained for the duration of the account relationship and for a period of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements.
• Financial transaction records: Retained for a minimum of five (5) years following the transaction date, as required by the Anti-Money Laundering Act.
• KYC / identity verification documents: Retained for the period of the account relationship plus five (5) years post-closure.
• Marketing data: Retained until you opt out of marketing communications or request deletion, subject to any legal holds that may apply.
• Support communications: Retained for two (2) years from the date of the last communication, or longer where relevant to an ongoing dispute or investigation.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymized in a manner that prevents re-identification.

bmy88 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the bmy88 platform.
• Encryption of sensitive stored data, including password hashing using industry-standard algorithms.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis.
• Regular security audits, penetration testing, and vulnerability assessments of the bmy88 platform infrastructure.
• Two-factor authentication options for player accounts and mandatory 2FA for all internal administrative access.
• Incident response procedures aligned with the NPC's breach notification requirements under the Data Privacy Act.

In the event of a personal data breach affecting your data, bmy88 will notify affected players and the National Privacy Commission within the timeframes prescribed by RA 10173 and NPC regulations.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by bmy88:

• Right to be informed: The right to know what personal data bmy88 holds about you and how it is being processed — which this Policy fulfils.
• Right of access: The right to request a copy of the personal data bmy88 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data held by bmy88.
• Right to erasure or blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
• Right to object: The right to object to processing of your personal data, including for direct marketing purposes. Objections to marketing can be actioned immediately via your account settings.
• Right to data portability: The right to receive your personal data in a structured, commonly used format, where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe bmy88 has violated your data privacy rights.

To exercise any of the above rights, please contact bmy88's Data Protection Officer via the support email address provided on this website. bmy88 will respond to verified requests within thirty (30) days of receipt, in accordance with NPC guidelines.

bmy88 uses cookies and similar tracking technologies on its platform to support functionality, security, and performance. The types of cookies used include:

• Essential cookies: Required for basic platform functionality, including maintaining your logged-in session and remembering your preferences. These cannot be disabled without impairing platform functionality.
• Analytics cookies: Used to collect aggregated, anonymized data about how players use the bmy88 platform, enabling us to identify and resolve technical issues and improve user experience.
• Security cookies: Used to detect and prevent fraudulent activity, including session hijacking and CSRF attacks.

bmy88 does not use third-party advertising cookies or allow external advertisers to set cookies on the bmy88 platform. You may manage cookie preferences through your browser settings, noting that disabling essential cookies will impair your ability to use the bmy88 platform.

The bmy88 platform is strictly for adults aged 21 years and older in compliance with PAGCOR regulations. bmy88 does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the registration and KYC process for all accounts.

If bmy88 becomes aware that personal data has been collected from an individual under the age of 21, the relevant account will be immediately suspended and all collected personal data will be deleted, subject to any legal obligations to retain records of the attempted underage access.

If you are a parent or guardian and believe that a minor has registered a bmy88 account, please contact bmy88 support immediately so that the account can be reviewed and closed without delay.

bmy88 reserves the right to update this Privacy Policy at any time. Material changes — those that significantly affect your rights or how we use your data — will be communicated via platform notification or email to your registered address no less than fourteen (14) days before the change takes effect.

Non-material changes, such as clarifications or typographical corrections that do not alter your rights or our data processing practices, may be made without advance notice. The effective date at the top of this Policy will always reflect the date of the most recent revision.

Your continued use of the bmy88 platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised Policy. The current version of this Policy is always available at bmy88.co/privacy-policy.

bmy88 has designated a Data Protection Officer (DPO) as required under the Data Privacy Act. For any queries, concerns, or requests relating to this Privacy Policy or the processing of your personal data by bmy88, please contact us through the following channel:

Support Email: [email protected]

Please include "Privacy Request" in your subject line, along with your registered username and a description of your request. bmy88 will acknowledge receipt of privacy-related requests within three (3) business days and will aim to resolve all requests within thirty (30) days of receipt.

If you are not satisfied with bmy88's response to a privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines (privacy.gov.ph).