bay88 Privacy Policy

1. Introduction

1.1 bay88 is committed to protecting the privacy and personal data of all its registered players and website visitors. This Policy is designed to comply with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA") of the Philippines, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC").

1.2 bay88 is a PAGCOR-licensed online gaming operator. In addition to DPA obligations, bay88 is also subject to PAGCOR's data governance requirements, which inform several of the processing activities described in this Policy — particularly those related to Know Your Customer ("KYC") verification, anti-money laundering ("AML") compliance, and player protection.

1.3 This Policy applies to all personal data processed by bay88 in connection with the Platform, whether collected online or through other channels (such as customer support communications). It covers players located anywhere in the Philippines — including Metro Manila, Cebu, Davao, and all other regions.

2. Data Controller

2.1 bay88 acts as the Personal Information Controller (as defined under the DPA) with respect to the personal data collected through the Platform. This means bay88 determines the purposes for which and the means by which personal data is processed.

2.2 bay88 has designated a Data Protection Officer ("DPO") in accordance with the DPA. Enquiries relating to this Policy or to your personal data rights may be directed to the bay88 DPO at the contact details provided in Section 14 of this Policy.

3. Personal Data We Collect

3.1 bay88 collects the following categories of personal data, depending on the nature of your interaction with the Platform:

3.1 Identity & Contact Data

• Full legal name as it appears on your government-issued ID;
• Date of birth (for age verification — must confirm 21+);
• Philippine mobile number;
• Email address;
• Residential address.

3.2 Identity Verification Documents

• Copies of Philippine government-issued identification (e.g., PhilSys ID, passport, driver's licence, UMID, SSS/GSIS card, voter's ID);
• Proof of address documents where required by PAGCOR KYC procedures.

3.3 Financial Data

• GCash account number or Maya account number associated with deposits and withdrawals;
• Bank account details (BPI, BDO, Metrobank, or other Philippine banks) where bank transfer is used;
• Transaction history: deposit amounts, withdrawal amounts, dates, and payment method used;
• Account balance history.

3.4 Gaming & Behavioural Data

• Game history: games played, wager amounts, wins, losses, session durations;
• Bonus participation history;
• Responsible gaming tool usage (deposit limits set, self-exclusion requests, session time limits);
• Customer support interaction records.

3.5 Technical & Device Data

• IP address;
• Browser type and version;
• Operating system;
• Device identifiers;
• Pages visited on the Platform, timestamps, and referring URLs;
• Cookie data (see Section 11).

3.2 Sensitive Personal Information. Where bay88 collects information that constitutes sensitive personal information under the DPA (such as government ID numbers), it will handle such data with the heightened protections required by the DPA and will process it only to the extent necessary for KYC, AML compliance, and PAGCOR regulatory obligations.

4. How We Collect Your Data

4.1 bay88 collects personal data through the following means:

• Direct registration: Data you provide when creating a bay88 account;
• KYC verification: Documents uploaded during the identity verification process;
• Platform use: Data generated automatically as you use the bay88 Platform (game activity, transactions);
• Customer support: Information you provide when contacting bay88 support via live chat or email;
• Payment processors: Transaction confirmations received from GCash, Maya, banks, and other payment partners;
• Cookies and tracking technologies: As described in Section 11.

5. Purposes of Processing

5.1 bay88 processes your personal data for the following purposes:

6. Legal Bases for Processing

6.1 Under the Data Privacy Act of 2012, bay88 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you (your bay88 account agreement and the Terms & Conditions);
• Legal obligation: Processing required by PAGCOR licensing conditions, AML law (RA 9160 as amended), and the DPA itself;
• Legitimate interests: Processing for fraud prevention, platform security, and platform improvement where these interests are not overridden by your data rights;
• Consent: Marketing communications and non-essential cookie processing — you may withdraw consent at any time.

7. Data Sharing & Disclosure

7.1 bay88 does not sell your personal data to third parties. We share personal data only in the following circumstances and only to the extent necessary:

• PAGCOR: As required by our operating licence and applicable gaming regulations;
• Anti-Money Laundering Council (AMLC): Mandatory reporting of covered and suspicious transactions under RA 9160;
• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and other payment partners — solely for transaction processing;
• KYC/identity verification providers: Third-party services engaged to assist with identity document verification;
• IT service providers: Cloud hosting, data storage, and security providers operating under strict data processing agreements;
• Law enforcement: Where legally compelled by valid Philippine legal process or court order.

7.2 All third parties with whom bay88 shares personal data are contractually bound to process such data only for the specific purpose for which it was shared and to maintain appropriate security standards consistent with the DPA.

7.3 bay88 does not transfer personal data outside the Philippines unless adequate data protection safeguards are in place and the transfer complies with the NPC's cross-border data transfer requirements.

8. Data Retention

8.1 bay88 retains personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

• Account data and KYC documents: Retained for a minimum of 5 years following account closure, as required by PAGCOR and AML regulations;
• Transaction records: Retained for a minimum of 5 years from the date of the transaction, in compliance with AML law;
• Customer support records: Retained for 3 years from the date of the interaction;
• Marketing consent records: Retained until consent is withdrawn, plus a reasonable period thereafter.

8.2 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in a manner that prevents reconstruction of the original data subject's identity.

9. Security Measures

9.1 bay88 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction:

• 256-bit SSL/TLS encryption for all data transmitted between your browser and the bay88 Platform;
• Encryption at rest for sensitive data stored in bay88 systems;
• Two-factor authentication (2FA) available to all players and mandatory for bay88 administrative accounts;
• Access controls limiting internal access to personal data on a need-to-know basis;
• Regular security audits and penetration testing conducted by independent security professionals;
• Incident response procedures for detecting and responding to personal data breaches, including mandatory NPC notification within 72 hours of discovery of a breach affecting sensitive personal information.

9.2 Notwithstanding the foregoing, no security measure is completely impenetrable. You are responsible for maintaining the confidentiality of your bay88 login credentials. If you suspect unauthorised access to your account, please contact bay88 support immediately.

10. Your Data Rights

10.1 Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by bay88:

• Right to be informed: The right to know what personal data bay88 holds about you and how it is processed (as set out in this Policy);
• Right of access: The right to request a copy of the personal data bay88 holds about you;
• Right to correction: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data, subject to bay88's legal retention obligations under PAGCOR and AML law;
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to object: The right to object to processing based on legitimate interests, particularly direct marketing;
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines.

10.2 To exercise any of the above rights, please submit a written request to the bay88 Data Protection Officer at the contact details in Section 14. bay88 will respond within 15 business days of receiving a verifiable request, as required by the NPC.

11. Cookies & Tracking Technologies

11.1 bay88 uses cookies and similar tracking technologies on the Platform to enhance your browsing experience, maintain your session, and analyse Platform usage. The following types of cookies are used:

• Strictly necessary cookies: Required for the Platform to function (e.g., session cookies that keep you logged into bay88). These cannot be disabled.
• Functional cookies: Remember your preferences (e.g., language settings, preferred game lobby view).
• Analytics cookies: Collect anonymised or aggregated data about how players use the Platform to help bay88 improve performance and content.

11.2 Non-essential cookies (functional and analytics cookies) are used only with your consent, which you provide by continuing to use the Platform after being presented with a cookie notice. You may withdraw consent and manage your cookie preferences at any time through your browser settings. Disabling strictly necessary cookies may impair your ability to use the bay88 Platform.

11.3 bay88 does not use third-party advertising cookies or share cookie data with advertising networks.

12. Minors

12.1 The bay88 Platform is strictly for individuals aged 21 years and older as required by PAGCOR. bay88 does not knowingly collect personal data from individuals under the age of 21.

12.2 If bay88 becomes aware that it has inadvertently collected personal data from a person under the age of 21, it will take immediate steps to delete such data and close the associated account. If you believe that a minor has registered on the bay88 Platform, please notify bay88 immediately using the contact details in Section 14.

13. Amendments to This Policy

13.1 bay88 reserves the right to amend this Privacy Policy at any time. All amendments will be published on this page with an updated "Last Updated" date. Material changes will be communicated to registered players via the email address on file or via an in-platform notification prior to taking effect.

13.2 Your continued use of the bay88 Platform following notification of a material amendment constitutes your acceptance of the revised Policy. If you do not accept the revised Policy, you may request account closure in accordance with the bay88 Terms & Conditions.

14. Contact & Data Protection Officer

14.1 For privacy-related enquiries, data subject rights requests, or to report a data protection concern, please contact the bay88 Data Protection Officer:

• Email: [email protected] (plain text — not a link)
• Subject line: "Privacy / DPO Request – [Your Name]"
• Response time: Within 15 business days of receipt of a verifiable request

14.2 If you are not satisfied with bay88's response to your privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines. Information on filing complaints with the NPC is available on the NPC's official website.