bmy33 Privacy Policy

01 Introduction

bmy33 ("we", "us", "our", or "the Platform") is committed to protecting the privacy and personal data of every player and visitor who interacts with our online casino and sports betting services at bmy33.app. This Privacy Policy ("Policy") describes in detail how bmy33 collects, uses, discloses, stores, and safeguards personal information in connection with the provision of its services to players in the Philippines.

This Policy is issued in compliance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines (DPA), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission (NPC). It is also aligned with the data governance requirements imposed on online gaming operators by the Philippine Amusement and Gaming Corporation (PAGCOR).

By registering an account on bmy33, accessing the Platform, or otherwise providing us with your personal data, you acknowledge that you have read, understood, and agreed to the data practices described in this Policy. If you do not agree, please discontinue use of the Platform and contact our support team to close your account.

02 Personal Data We Collect

bmy33 collects personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. The categories of personal data we collect include:

03 How We Collect Personal Data

bmy33 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, participating in promotions, or contacting our support team.
• Automated collection: Technical data collected automatically when you access the Platform, including via cookies, web beacons, log files, and similar tracking technologies. See Section 9 for full details.
• Third-party sources: Identity and fraud-check data from licensed KYC verification service providers; transaction data from payment processors such as GCash, PayMaya, BPI, BDO, and Metrobank; and publicly available sanction or watchlist databases as required for AML compliance.
• Regulatory sources: Information provided to or received from PAGCOR and other Philippine regulatory or law enforcement authorities in connection with our licensing obligations.

bmy33 does not collect personal data from third parties for marketing profiling purposes, nor do we purchase data sets from data brokers.

04 Purposes of Processing

bmy33 processes your personal data for the following specific, legitimate purposes:

1. Account Registration and Management: To create, maintain, and administer your bmy33 player account, including password resets and account security.
2. Identity Verification (KYC): To verify your identity and age (21+) in compliance with PAGCOR licensing requirements and Philippine AML regulations.
3. Transaction Processing: To facilitate deposits and withdrawals in Philippine Peso (₱ PHP) through your chosen payment method and to maintain accurate transaction records.
4. Fraud and Security: To detect, investigate, and prevent fraudulent activity, money laundering, unauthorized account access, and other security incidents.
5. Regulatory Compliance: To meet our obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), the Data Privacy Act, and other applicable Philippine laws.
6. Customer Support: To respond to your inquiries, handle complaints, and resolve disputes in a timely and effective manner.
7. Responsible Gaming: To monitor gaming activity for indicators of problem gambling, administer self-exclusion and limit requests, and fulfill our duty of care obligations.
8. Platform Improvement: To analyze aggregated usage data for the purpose of improving Platform features, performance, and the overall player experience.
9. Marketing Communications: To send you promotional offers, bonus notifications, and Platform updates where you have provided consent. You may opt out at any time.

05 Legal Basis for Processing

Under the Data Privacy Act of 2012, bmy33 relies on the following lawful bases for processing your personal data:

• Contractual Necessity: Processing required to perform the contract between you and bmy33 — primarily account registration, KYC verification, payment processing, and game provision.
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulations, AMLA obligations, and NPC data protection requirements.
• Legitimate Interests: Processing necessary for bmy33's legitimate interests, including fraud prevention, security monitoring, and Platform improvement, where such interests are not overridden by your rights and freedoms.
• Consent: For processing activities not covered by the above bases — in particular, optional marketing communications and non-essential cookies — we rely on your freely given, specific, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

06 Data Sharing and Disclosure

bmy33 does not sell, rent, or commercially transfer your personal data to third parties. We may share your data only in the following limited circumstances:

• Payment Processors: We share financial data with licensed payment service providers — including GCash, PayMaya, BPI, BDO, Metrobank, 7-Eleven, Cebuana Lhuillier, and M Lhuillier — strictly to process your PHP deposits and withdrawals. These providers are contractually bound to handle your data in accordance with applicable data protection standards.
• KYC and Identity Verification Providers: We share identity documents with licensed third-party verification service providers for the purpose of conducting KYC checks required under PAGCOR regulations.
• Regulatory and Law Enforcement Authorities: We are legally obligated to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other competent Philippine authorities upon lawful request or as required by applicable law.
• IT and Infrastructure Service Providers: We engage trusted technology partners for hosting, data storage, security monitoring, and Platform operations. All such providers are subject to binding data processing agreements and are prohibited from using your data for any purpose other than providing services to bmy33.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of bmy33's assets, your personal data may be transferred to the relevant successor entity, subject to the same privacy protections described in this Policy.

07 Data Retention

bmy33 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

• Active Account Data: Retained for the duration of your registered account and for a minimum of five (5) years following account closure, in compliance with AMLA record-keeping requirements.
• KYC Verification Documents: Retained for a minimum of five (5) years from the date of account closure or the date of the last transaction, whichever is later.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as mandated by AMLA and PAGCOR reporting obligations.
• Support and Communication Records: Retained for three (3) years from the date of the communication, or longer where relevant to an open dispute or regulatory investigation.
• Marketing Consent Records: Retained for the period of consent and for one (1) year following withdrawal of consent, to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in a manner that prevents re-identification. Where data cannot be immediately deleted due to ongoing legal or regulatory proceedings, it will be placed in restricted access storage until deletion is permissible.

08 Security of Personal Data

bmy33 implements appropriate technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include, but are not limited to:

• Encryption: All data transmitted between your device and the bmy33 Platform is encrypted using industry-standard SSL/TLS protocols. Sensitive data at rest is encrypted using AES-256 or equivalent standards.
• Access Controls: Access to personal data is strictly limited to authorized bmy33 personnel and service providers with a legitimate need to access it. Role-based access controls and multi-factor authentication are applied to internal systems.
• Security Monitoring: We conduct regular security assessments, penetration testing, and vulnerability scanning to identify and remediate potential weaknesses in our infrastructure.
• Incident Response: bmy33 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the National Privacy Commission and affected players in accordance with the DPA's breach notification requirements.
• Staff Training: All bmy33 personnel who handle personal data receive regular data privacy and security training.

09 Cookies and Tracking Technologies

bmy33 uses cookies and similar technologies (including web beacons and local storage objects) to enhance your experience on the Platform. The types of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session management cookies that keep you logged in during your visit. These cookies cannot be disabled without significantly impairing Platform functionality.
• Preference Cookies: Used to remember your preferences, such as language settings and display options, to provide a more personalized experience on subsequent visits.
• Analytics Cookies: Used to collect aggregated, anonymized data about how players use the Platform — such as pages visited, session duration, and navigation patterns — to help us improve Platform performance and content.
• Security Cookies: Used to support our fraud detection and security systems by identifying unusual browsing patterns or login behavior that may indicate unauthorized account access attempts.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the bmy33 Platform, including your ability to stay logged in or access certain game features. bmy33 does not use third-party advertising cookies or retargeting pixels that track your activity across unrelated third-party websites.

10 Your Data Protection Rights

As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by bmy33:

• Right to Be Informed: You have the right to be informed about how your personal data is being collected and processed. This Policy fulfills that obligation.
• Right to Access: You may request a copy of the personal data bmy33 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data in your bmy33 account. For certain data types, you can update information directly within your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations under AMLA and PAGCOR regulations.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests where your particular circumstances warrant it.
• Right to Data Portability: You may request that bmy33 provide your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to Lodge a Complaint: If you believe bmy33 has not handled your personal data in accordance with the DPA, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

To exercise any of the above rights, please contact the bmy33 Data Protection Officer using the contact details provided in Section 13. We will respond to all verified requests within thirty (30) calendar days. Some requests may be subject to identity verification before they are processed.

11 Minors and Age Restriction

The bmy33 Platform is strictly intended for use by persons aged 21 years and above, consistent with PAGCOR's minimum age requirement for online gaming in the Philippines. bmy33 does not knowingly collect personal data from persons under 21 years of age.

All new accounts are subject to mandatory age verification as part of the KYC process. Where bmy33 discovers or has reasonable grounds to believe that an account is held by a person under 21 years of age, the account will be immediately suspended, all associated funds will be forfeited in accordance with PAGCOR regulations, and any personal data collected will be deleted as soon as reasonably practicable, subject to any applicable legal retention requirements.

12 Changes to This Privacy Policy

bmy33 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. When material changes are made, we will notify registered players by displaying a prominent notice on the Platform upon login and, where practicable, by sending a notification to the email address registered on your account.

The date of the most recent revision is indicated at the top of this Policy. Your continued use of the bmy33 Platform following the publication of any amendments constitutes your acknowledgment of, and agreement to, the revised Privacy Policy. We encourage you to review this Policy periodically to stay informed of how we are protecting your personal data.

Prior versions of this Privacy Policy are available upon written request to the bmy33 Data Protection Officer. We maintain a version history for audit and compliance purposes.

13 Contact & Data Protection Officer

bmy33 has designated a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us using the following details:

• Data Protection Officer: bmy33 Data Privacy Team
• Email: support@bmy33.app (plain text — not a clickable link)
• Support Hours: 24 hours a day, 7 days a week
• Response Time: Within 30 calendar days for formal data subject requests; within 48 hours for general privacy inquiries
• Language: English and Filipino

For complaints that cannot be resolved through bmy33's internal process, you may escalate your concern to the National Privacy Commission of the Philippines (NPC). Further information about the NPC and its complaint process is publicly available through official Philippine government channels.