bso99 Privacy Policy

01 Data Controller

The data controller responsible for your personal information in connection with the bso99 platform (accessible at bso99.cam) is the operator of bso99, a PAGCOR-licensed online gaming operator. As data controller, we determine the purposes and means by which your personal data is processed, and we are accountable for ensuring that such processing complies with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations.

Our designated Data Protection Officer (DPO) is responsible for overseeing compliance with this Privacy Policy and applicable data protection legislation. You may contact our DPO by writing to [email protected] with the subject line "Data Protection Officer — Privacy Inquiry."

02 Data We Collect

bso99 collects personal data in the categories described below. We collect only what is necessary for the specific purposes identified in Section 5 of this Policy.

We do not collect sensitive personal information as defined under the Data Privacy Act (e.g., racial or ethnic origin, political opinions, religious beliefs, health data) unless specifically required by PAGCOR's responsible gaming obligations, in which case such data is collected only with your express consent.

03 How We Collect Data

bso99 collects your personal data through the following means:

• Directly from you — when you register an account, complete identity verification, make a deposit or withdrawal, contact customer support, or update your account settings;
• Automatically through the platform — technical and gaming data is collected automatically when you access and use bso99.cam, including through cookies and similar tracking technologies as described in Section 7;
• From third-party payment processors — GCash, Maya, BPI, BDO, and our other payment partners may share transaction confirmation data with us necessary to credit your account and satisfy our AML obligations;
• From identity verification providers — where you submit documents for KYC (Know Your Customer) verification, our accredited identity verification partner processes document data and returns a verification result to us;
• From fraud prevention and AML screening services — we may check your identity details against databases maintained by our compliance service providers as required under Philippine AML law.

04 Legal Basis for Processing

Under the Data Privacy Act of 2012, bso99 processes your personal data on the following legal bases:

• Performance of a contract — processing necessary to operate your account, execute transactions, and deliver the gaming services you have signed up for;
• Legal obligation — processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160), and other applicable Philippine legislation;
• Legitimate interests — processing conducted for fraud prevention, platform security, responsible gaming monitoring, and internal analytics — where these interests are not overridden by your fundamental rights;
• Consent — processing for marketing communications, which is conducted only where you have affirmatively opted in. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

05 How We Use Your Data

bso99 uses the personal data we collect for the following purposes:

• To create and manage your bso99 account and verify your identity in compliance with PAGCOR requirements;
• To process deposits and withdrawals through your chosen Philippine payment method (GCash, Maya, BPI, BDO, Metrobank, UnionBank, 7-Eleven Cliqq, USDT TRC20, or Coins.ph);
• To provide customer support and resolve disputes or complaints;
• To monitor gaming activity for responsible gaming purposes, including detecting patterns associated with problem gambling;
• To comply with AML screening, transaction monitoring, and suspicious activity reporting obligations under Philippine law;
• To protect the security and integrity of the platform, including fraud detection and prevention;
• To administer bonuses, promotions, and loyalty programs in accordance with published terms;
• To send you service communications — such as transaction confirmations, account notices, and security alerts — regardless of marketing preferences;
• To send marketing communications about bso99 products and promotions, where you have provided consent;
• To maintain records as required by PAGCOR and applicable Philippine law.

06 Sharing Your Data

bso99 does not sell, rent, or trade your personal data to third parties. We share personal data only in the following limited and necessary circumstances:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, UnionBank, 7-Eleven Cliqq, Coins.ph, and cryptocurrency exchange services — solely to execute your deposit and withdrawal transactions;
• Identity verification providers: Accredited KYC service providers who verify your identity documents on our behalf and return a verification status — they do not store or independently use your data;
• Fraud and AML compliance services: Providers who screen transactions and identity data against watchlists and risk databases as required under RA 9160;
• Gaming platform and game providers: Where game software is delivered by third-party providers (e.g., Pragmatic Play, PG Soft, Jili Games), limited technical session data may be shared with them to deliver the game experience;
• Regulatory authorities: PAGCOR and other competent Philippine authorities may receive your data where required by law, court order, or regulatory obligation;
• Professional advisors: Lawyers, auditors, and compliance consultants engaged by bso99 who are bound by professional confidentiality obligations.

Where we engage third-party data processors, we require them to process your data only for the specific purpose for which it was shared, under contractual obligations consistent with the Data Privacy Act of 2012.

07 Cookies & Tracking Technologies

bso99 uses cookies and similar tracking technologies on bso99.cam for the following purposes:

• Essential cookies: Required for the platform to function — session management, login state, security tokens, and cashier session integrity. These cannot be disabled without breaking core platform functionality.
• Performance cookies: Anonymous analytics that help us understand how players navigate the platform, which games are most popular, and where technical issues occur. No personally identifiable information is included in these analytics.
• Functional cookies: Remember your language preferences, responsible gaming settings, and display preferences across sessions.
• Fraud prevention: Device fingerprinting and behavioral analytics used to detect automated bots, multi-accounting attempts, and other fraudulent activity patterns.

You can manage non-essential cookie preferences through your browser settings. Disabling essential cookies will impair your ability to use the bso99 platform. We do not use cookies to build advertising profiles or share behavioral data with advertising networks.

08 Data Retention

bso99 retains your personal data for as long as your account is active and for a period thereafter as required by law and our regulatory obligations. Specific retention periods are as follows:

• Account and identity data: Retained for the duration of your account plus 5 years following account closure, as required by PAGCOR licensing conditions and AML record-keeping obligations under RA 9160;
• Transaction records: Retained for 10 years from the date of the transaction, consistent with Philippine AML requirements;
• Gaming activity data: Retained for 5 years from account closure for regulatory audit and responsible gaming monitoring purposes;
• Customer support communications: Retained for 3 years from the date of the interaction;
• Marketing preferences: Retained until you withdraw consent, and for 1 year thereafter as evidence of your consent status.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be attributed to you.

09 Data Security

bso99 implements technical and organizational security measures appropriate to the risk posed by the processing of your personal data. These measures include:

• AES-256 encryption for all personal data stored on our servers;
• TLS 1.3 encryption for all data transmitted between your device and our platform;
• Tokenization of all payment data — raw account and card details are never stored on bso99 systems;
• Two-factor authentication available for all player accounts and mandatory for staff accounts with data access;
• Role-based access controls limiting staff access to personal data to those with a specific operational need;
• Regular third-party penetration testing and security audits;
• Automated anomaly detection systems monitoring for unusual access patterns or data exfiltration attempts.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, bso99 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will inform affected players without undue delay where required under the Data Privacy Act.

10 Your Data Rights

To exercise any of the above rights, contact our Data Protection Officer at [email protected] with the subject line "Data Rights Request." We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. Where a request is complex or involves a high volume of data, we may extend this period by a further 30 days with notice to you.

11 Marketing Communications

bso99 sends marketing communications — including promotional offers, bonus notifications, and new game announcements — only to players who have expressly opted in to receive them. Marketing communications may be delivered via SMS to your registered Philippine mobile number, email, or push notification through the bso99.cam progressive web app.

You can withdraw your consent to receive marketing communications at any time by:

• Updating your notification preferences in your bso99 account settings dashboard;
• Clicking the unsubscribe link included in any marketing email;
• Contacting our customer support team via live chat or at [email protected].

Withdrawal of marketing consent does not affect your receipt of service communications — such as transaction confirmations, security alerts, and account verification messages — which are necessary for the operation of your account and are sent regardless of marketing preferences.

12 Children's Privacy

The bso99 platform is strictly restricted to individuals aged 21 years and above in compliance with PAGCOR regulations. We do not knowingly collect personal data from individuals under the age of 21. If you believe that a person under 21 has registered an account on bso99, please contact us immediately at [email protected]. Upon verification, we will close the account and delete all associated personal data without undue delay.

13 Cross-Border Data Transfers

Some of bso99's service providers — including cloud infrastructure providers, identity verification platforms, and fraud detection services — may process personal data in jurisdictions outside the Philippines. Where such transfers occur, bso99 ensures that appropriate safeguards are in place, including:

• Contractual clauses that obligate the recipient to maintain data protection standards equivalent to those required under the Data Privacy Act of 2012;
• Transfers only to jurisdictions or organizations recognized by the National Privacy Commission as providing adequate data protection levels;
• Binding corporate rules where transfers occur within the corporate group of a service provider.

You may request details of the safeguards in place for any specific cross-border transfer by contacting our Data Protection Officer.

14 Policy Updates

bso99 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. When we make material changes, we will:

• Post the updated Privacy Policy at bso99.cam/privacy-policy with a revised "Last updated" date;
• Provide notice of material changes via a prominent platform notification or email to your registered address at least 7 days before the changes take effect, where reasonably practicable.

Your continued use of the bso99 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with a material change, you should close your account before it takes effect.

15 Contact & Complaints

For any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact bso99's Data Protection Officer:

• Email: [email protected] — Subject: "Privacy Policy Inquiry" or "Data Rights Request"
• Live Chat: Available 24/7 at bso99.cam — our Filipino-speaking support agents handle all privacy-related queries and will escalate to the DPO where required

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data protection matters under the Data Privacy Act of 2012. Information on how to file a complaint with the NPC is available through official Philippine government channels.

bso99 takes all privacy complaints seriously and will acknowledge receipt of any formal complaint within 5 business days, with a substantive response to follow within 30 calendar days.