bf099 Privacy Policy

bf099 operates as an online casino and sports betting platform serving Filipino players across the Philippines, from Metro Manila and Cebu to Davao, Cagayan de Oro, and the wider archipelago. As a PAGCOR-licensed operator, bf099 is subject to the Philippine Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and the data protection guidelines issued by the National Privacy Commission (NPC) and PAGCOR.

This Privacy Policy applies to all personal data processed by bf099 in connection with:

• Account registration and ongoing account management.
• Identity verification (KYC) and anti-money laundering (AMLA) compliance.
• Financial transactions, including GCash and PayMaya deposits and withdrawals.
• Gameplay activity, betting history, and gaming session data.
• Customer support communications via live chat, email, or other channels.
• Marketing communications and promotional offers (where consent applies).
• Platform usage analytics and technical performance monitoring.

This Policy does not apply to third-party websites or services linked from the bf099 platform, where they exist. bf099 is not responsible for the privacy practices of third-party payment processors, game providers, or other external services, and encourages players to review those parties' individual privacy policies where applicable.

For the purposes of RA 10173 and applicable data protection regulations, the data controller responsible for personal data processed through the bf099 platform is the company that holds the PAGCOR operating licence for bf099. As data controller, bf099 determines the purposes for which your personal data is processed and the means by which it is processed, and is accountable for ensuring that processing is carried out in compliance with applicable Philippine privacy law.

bf099 has appointed a designated Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and with RA 10173. The DPO can be contacted through the support channels listed in Section 15 of this Policy. Where you have privacy-specific enquiries — including requests to exercise your data subject rights — the DPO is the appropriate point of contact.

bf099 collects the following categories of personal data in connection with the operation of the platform:

bf099 collects personal data through the following means:

• Directly from you: Information you provide when registering a bf099 account, completing KYC verification, making deposits or withdrawal requests, contacting customer support, or updating your account settings.
• Automatically: Technical and usage data collected automatically when you access the bf099 platform, including IP address, device information, browser type, session timestamps, and page interactions, through standard web server logging and analytics tools.
• From third-party payment processors: Transaction confirmation data from GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other payment intermediaries, received when you initiate a deposit or withdrawal.
• From identity verification services: Confirmation data from third-party KYC verification partners used to validate the authenticity of government-issued ID documents submitted during the verification process.
• From cookies and similar technologies: Session and preference data collected through cookies placed on your device when you browse the bf099 platform, as described further in Section 8.
• From public and regulatory sources: Where required for AMLA compliance or fraud prevention, bf099 may cross-reference information against publicly available records or government databases as permitted under Philippine law.

bf099 processes personal data for the following purposes:

1. Account Management: Creating, maintaining, and administering your bf099 account, including authentication of your identity on each login, account balance management, and account security monitoring.
2. KYC and AMLA Compliance: Verifying your identity in accordance with PAGCOR licensing requirements and Philippine AMLA obligations before processing withdrawals or where transaction volumes require enhanced due diligence.
3. Financial Transactions: Processing PHP deposits and withdrawals through GCash, PayMaya, and Philippine bank channels; maintaining accurate transaction records; issuing transaction receipts.
4. Gameplay and Platform Operation: Enabling your participation in casino games, sports betting, bingo, and other platform features; maintaining fair play integrity; resolving game round disputes.
5. Fraud Prevention and Security: Detecting and investigating suspicious activity, unauthorised account access, multiple account registration, and bonus abuse.
6. Regulatory Reporting: Providing transaction data, player records, and compliance reports to PAGCOR and other Philippine government authorities as required under the bf099 operating licence.
7. Customer Support: Responding to your enquiries, resolving complaints, and providing assistance with account or platform issues.
8. Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates where you have provided consent or where legitimate interest applies in accordance with RA 10173.
9. Responsible Gaming: Monitoring gaming patterns to support responsible gaming obligations, enforcing player-set limits, and administering self-exclusion requests.
10. Platform Improvement: Analysing aggregated usage patterns to improve platform performance, user experience, and game offerings for Filipino players.

Under the Philippine Data Privacy Act of 2012, bf099 relies on the following legal bases for processing your personal data:

bf099 does not sell, rent, or trade your personal data to any third party for their independent marketing purposes. Personal data is shared only in the following circumstances and only to the extent necessary for the stated purpose:

• PAGCOR and Philippine Government Authorities: bf099 is required to share player data, transaction records, and compliance reports with PAGCOR as part of its licence obligations. Additional disclosure may be required by the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, or Philippine courts under applicable legal process.
• Payment Processors: Your financial data is shared with GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other payment intermediaries strictly for the purpose of processing your deposit and withdrawal transactions. These processors operate under their own terms and privacy policies and are bound by applicable Philippine financial regulations.
• Identity Verification (KYC) Partners: Your identity documents and biometric selfie may be shared with third-party KYC technology providers for the sole purpose of document authentication. These providers are contractually bound to process data only for this purpose and to maintain confidentiality.
• Game Software Providers: Certain gameplay data (session identifiers, bet values, game outcomes) may be shared with third-party game software providers for the purpose of resolving game round disputes, verifying RNG outcomes, or conducting technical audits.
• IT and Security Service Providers: bf099 uses third-party hosting, cloud infrastructure, and cybersecurity providers to operate the platform. These providers process technical and operational data under data processing agreements that bind them to maintain confidentiality and security standards.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of the bf099 business, personal data may be transferred to the successor entity as part of the transaction. Players will be notified of any such change in accordance with RA 10173 requirements.

The bf099 platform uses cookies and similar tracking technologies to operate correctly, maintain your login session, remember your preferences, and analyse platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function at all — including maintaining your authenticated login session, remembering your preferred language settings, and enabling core gameplay functionality. These cookies cannot be disabled without preventing normal platform use.
• Performance and Analytics Cookies: Used to collect aggregated, anonymised information about how players navigate and use the bf099 platform — including which pages are visited most frequently and whether any error messages are encountered. This data helps bf099 improve the platform experience for Filipino users.
• Functional Cookies: Used to remember your preferences, such as display settings, responsible gaming tool configurations, and recently visited game categories, so the platform feels personalised across sessions.
• Security Cookies: Used as part of bf099's fraud detection and account security systems — for example, to identify new or unrecognised device logins that may trigger a 2FA challenge.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair or prevent your ability to use core platform features, including the bf099 login function. bf099 does not use third-party advertising tracking cookies for cross-site behavioural profiling.

bf099 retains personal data only for as long as is necessary for the purpose for which it was collected, or for as long as required by applicable Philippine law and PAGCOR licence conditions. The following retention principles apply:

• Active Account Data: Retained for the full duration of your active bf099 account relationship and for a minimum of five (5) years following account closure, in accordance with AMLA record-keeping requirements.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification, as required under RA 9160 (Anti-Money Laundering Act) and PAGCOR compliance regulations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the transaction date, as required by Philippine AMLA and tax record-keeping obligations.
• Gaming and Bet History: Retained for a minimum of three (3) years from the date of each game session or betting transaction for dispute resolution purposes.
• Customer Support Records: Retained for two (2) years from the date of the relevant interaction.
• Marketing Consent Records: Retained for the duration of the consent and for one (1) year following withdrawal of consent, for compliance verification purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

bf099 implements technical and organisational security measures proportionate to the sensitivity of the personal data held and the risks of unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and bf099 servers — including login credentials, financial data, and personal information — is encrypted using industry-standard SSL/TLS protocols. This is the same encryption standard used by Philippine banking institutions.
• Password Security: Account passwords are never stored in plain text. All passwords are processed through industry-standard cryptographic hashing algorithms before storage, meaning that even bf099 staff cannot retrieve your actual password.
• Access Controls: Internal access to personal data is restricted on a strictly need-to-know basis. Staff members who do not require access to specific data categories are denied access by system-level permission controls.
• Two-Factor Authentication: Players are strongly encouraged to enable 2FA on their bf099 accounts. 2FA provides a second layer of protection beyond the password, requiring a one-time code sent to your registered Philippine mobile number for each login from an unrecognised device.
• Intrusion Detection and Monitoring: bf099's server infrastructure is monitored continuously for anomalous access patterns, potential security breaches, and denial-of-service events. Security incidents are assessed and responded to in accordance with the bf099 incident response procedure.
• Data Breach Notification: In the event of a personal data breach that is reasonably likely to adversely affect your rights and freedoms, bf099 will notify the NPC and affected data subjects in accordance with the notification requirements of RA 10173 and NPC Circular 16-03.

Under the Philippine Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by bf099. These rights may be exercised at any time by contacting bf099's Data Protection Officer through the channels described in Section 15.

bf099 will respond to all valid data subject rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with prior notification to you. Identity verification may be required before bf099 processes rights requests to ensure data is not disclosed to or acted upon by an unauthorised person.

The bf099 platform is strictly intended for use by individuals who are at least 21 years of age, in accordance with PAGCOR regulations governing online gaming in the Philippines. bf099 does not knowingly collect personal data from individuals under the age of 21.

All registration requests are subject to age verification during the KYC process. Where bf099 has reason to believe that a registered account holder is under 21 years of age, that account will be immediately closed, all associated data will be flagged, and the matter will be reported to PAGCOR as required under the operator licence.

If you believe that a minor has registered on the bf099 platform using false age information, please notify the support team immediately via live chat or email so that the account can be identified and closed promptly.

As an online platform, bf099 may use third-party service providers — including cloud infrastructure providers, game software companies, and KYC technology partners — whose servers may be located outside the Philippines. Where personal data is transferred outside the Philippines in connection with these services, bf099 ensures that appropriate safeguards are in place in accordance with Section 21 of RA 10173 and NPC guidelines on cross-border data transfers.

Appropriate safeguards include: (a) contractual data processing agreements that impose RA 10173-equivalent protections on the receiving party; (b) transfers only to jurisdictions or organisations that have been assessed as providing adequate levels of data protection; and (c) standard contractual clauses approved by the NPC where available.

All financial transaction data involving GCash, PayMaya, and Philippine bank channels is processed by payment processors that are regulated by the Bangko Sentral ng Pilipinas (BSP) and are subject to Philippine data protection and financial regulation requirements.

bf099 may update or revise this Privacy Policy from time to time to reflect changes in the platform's data processing activities, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. When material changes are made, bf099 will notify registered players via email to the address on file and/or via a notice displayed prominently on the bf099 platform before the changes take effect.

The "Last Updated" date at the top of this page will always reflect the date of the most recent revision. The current version of the Privacy Policy supersedes all previous versions. Continued use of the bf099 platform after the effective date of a revised Privacy Policy constitutes your acknowledgement of the updated policy.

If any revision to this Privacy Policy requires your fresh consent — for example, a new processing purpose not covered by your original consent at registration — bf099 will seek that consent through a specific opt-in mechanism before the new processing commences.

For any questions, concerns, or requests related to this Privacy Policy — including requests to exercise your data subject rights under RA 10173 — please contact the bf099 Data Protection Officer through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly within the bf099 platform after logging in. For privacy-specific queries, please specify that your enquiry is directed to the Data Protection Officer.
• Email: [email protected] — please include "Privacy Policy Enquiry" or "Data Subject Rights Request" in the subject line.

bf099 will acknowledge receipt of your privacy enquiry or rights request within five (5) business days and will provide a substantive response within thirty (30) calendar days. In cases where additional information or identity verification is required, bf099 will notify you promptly.

If you are not satisfied with bf099's response to a privacy complaint, you have the right to escalate the matter to the Philippine National Privacy Commission (NPC), which is the competent supervisory authority for data protection matters under RA 10173. The NPC can be reached through its official channels.