bso99 Privacy
Policy

1 Introduction

bso99 ("bso99," "we," "us," or "our") operates the online casino and sports betting platform accessible at bso99.one. We are a PAGCOR-licensed online gaming operator serving Filipino players throughout the Philippines. In providing our services, bso99 processes personal information belonging to our registered players, website visitors, and prospective customers.

This Privacy Policy sets out what personal information bso99 collects, the lawful bases on which we process it, who we share it with, how long we retain it, how we protect it, and what rights you have in relation to your personal data. This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012, and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC) of the Philippines.

By registering a bso99 account or continuing to use the bso99 Platform, you acknowledge that you have read and understood this Privacy Policy. If you disagree with any part of this Policy, please discontinue use of the Platform and contact our Data Protection Officer to request closure of your account and deletion of your personal data, subject to our legal retention obligations.

2 Data Controller Information

bso99 is the personal information controller in respect of all personal data processed in connection with the bso99 Platform, as defined under Section 3(h) of the Data Privacy Act of 2012. bso99 has registered its data processing activities with the National Privacy Commission as required by NPC Circular 16-01 and its amendments.

bso99 has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with the Data Privacy Act, handling data subject requests, managing data breach notifications, and serving as the primary point of contact for the NPC and PAGCOR on data protection matters. Contact details for bso99's DPO are provided in Section 15 of this Policy.

3 Personal Data We Collect

bso99 collects the following categories of personal information from registered players and, in some cases, from visitors to the bso99 Platform:

4 How We Collect Your Data

4.1 Data You Provide Directly

The majority of personal information bso99 holds about you is information you provide to us directly — through the account registration form, KYC document submission, payment method registration, support interactions, and responsible gaming tool configurations.

4.2 Data Collected Automatically

When you access the bso99 Platform, certain technical data is collected automatically through your browser and device — including your IP address, browser type, operating system, referral URL, pages visited, session duration, and click-path data. This information is collected using server logs, session cookies, and analytics tools operated exclusively by bso99 for Platform security, fraud prevention, and performance optimization.

4.3 Data from Third Parties

bso99 may receive supplementary identity verification data from accredited KYC service providers engaged to assist with PAGCOR-mandated age and identity verification. bso99 may also receive transaction confirmation data from Philippine payment processors (GCash, PayMaya, BPI, BDO, Metrobank) necessary to confirm and reconcile deposits and withdrawals. All third-party data providers engaged by bso99 are contractually required to comply with the Data Privacy Act and process data only for the purposes specified by bso99.

5 How We Use Your Personal Data

bso99 processes your personal information for the following specific purposes:

• Registering and maintaining your bso99 account
• Verifying your identity and age in compliance with PAGCOR's KYC requirements (21+ age restriction enforcement)
• Processing deposits and withdrawals via your registered Philippine payment methods
• Detecting, investigating, and preventing fraud, money laundering, and other prohibited activities under Philippine law
• Providing customer support through bso99's Live Chat and email channels
• Administering bonuses, promotions, and loyalty programs you have opted into
• Monitoring your gaming activity for responsible gaming purposes and implementing player-requested or bso99-mandated account restrictions
• Fulfilling bso99's regulatory reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission
• Improving Platform performance, security, and game offerings based on aggregated and anonymized usage analytics
• Sending you transactional communications (deposit confirmations, withdrawal notifications, security alerts) and, where you have opted in, promotional communications about bso99 products and offers

6 Legal Basis for Processing

Under the Data Privacy Act of 2012, bso99 processes your personal information on the following lawful bases:

• Contractual Necessity: Processing required to perform the bso99 Player Agreement, including account registration, game delivery, and payment processing
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160), the Data Privacy Act, and other applicable Philippine laws and regulations
• Legitimate Interests: Processing for fraud prevention, Platform security, responsible gaming monitoring, and analytics — where these interests are not overridden by your rights and freedoms
• Consent: Processing for optional marketing communications and specific sensitive data categories, where we have obtained your freely given, specific, and informed consent

Where bso99 relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7 Disclosure and Data Sharing

bso99 does not sell, rent, or trade your personal data to third parties. We disclose your personal information only to the following categories of recipients, and only to the extent strictly necessary for the specified purpose:

• PAGCOR: Mandatory regulatory reporting including player activity data, responsible gaming incident reports, and AML compliance submissions as required by bso99's operating license
• Anti-Money Laundering Council (AMLC): Covered transaction and suspicious transaction reports as required under RA 9160 and its amendments
• National Privacy Commission (NPC): Data breach notifications and regulatory compliance reports as required under RA 10173
• Payment Processors: GCash, PayMaya, BPI, BDO, and Metrobank — identity and transaction data necessary to process your deposits and withdrawals
• KYC Service Providers: Identity document data submitted for verification, shared with accredited verification providers under data processing agreements compliant with the DPA
• Game Content Providers: Anonymized or pseudonymized session identifiers necessary for game delivery and RNG certification — bso99 does not share your full identity with game providers
• Law Enforcement: Personal data disclosed in response to lawful orders, court orders, or written requests from Philippine law enforcement authorities as required by applicable law

All third-party service providers who process personal data on behalf of bso99 are required to enter into data sharing or data processing agreements that comply with the Data Privacy Act and mandate the same or higher standards of data protection as those maintained by bso99.

8 International Data Transfers

Some of bso99's technology service providers and game content partners operate infrastructure outside the Philippines. Where personal data is transferred to recipients in jurisdictions outside the Philippines, bso99 ensures that appropriate safeguards are in place to protect that data, including:

• Standard contractual clauses approved by the NPC or equivalent data protection authority
• Binding corporate rules where transfers occur within a corporate group subject to group-wide data protection policies
• Transfer to jurisdictions that the NPC has determined provide an adequate level of data protection

Players who wish to receive further information about the safeguards applicable to any specific international data transfer may contact bso99's Data Protection Officer using the contact details in Section 15.

9 Data Security Measures

bso99 implements technical and organizational security measures appropriate to the sensitivity of the personal data it holds and the risks associated with online gaming operations. These measures include:

• SSL/TLS encryption for all data transmitted between player devices and bso99's servers
• Encryption at rest for sensitive personal data including identity documents, financial records, and authentication credentials
• Role-based access controls limiting employee access to personal data to only those staff members whose job functions require it
• Continuous security monitoring, intrusion detection, and vulnerability scanning of bso99's infrastructure
• Regular security awareness training for all bso99 staff with access to personal data
• Documented data breach response procedures with NPC notification timelines compliant with RA 10173

10 Data Retention and Deletion

bso99 retains personal data for the periods set out below, or for longer periods where required by applicable Philippine law or regulatory obligation:

• Account and Identity Data: For the duration of the active player relationship and for a period of five (5) years following account closure, as required by PAGCOR's record-keeping obligations and the Anti-Money Laundering Act
• Financial Transaction Records: For a period of five (5) years from the date of each transaction, consistent with AMLC requirements under RA 9160
• Gaming and Responsible Gaming Records: For the duration of the active player relationship and for two (2) years following account closure, to support regulatory audits and responsible gaming compliance reviews
• Communications Data (Support Records): For two (2) years from the date of the last interaction, for service quality and dispute resolution purposes
• Technical and Log Data: For twelve (12) months from the date of collection, for security and fraud investigation purposes
• Marketing Consent Records: Until consent is withdrawn plus two (2) years, to demonstrate compliance with the consent requirement

At the expiry of the applicable retention period, bso99 will securely delete or irreversibly anonymize the relevant personal data. Anonymized data that cannot be re-identified may be retained for statistical and analytical purposes beyond the retention periods specified above.

11 Cookies and Tracking Technologies

bso99 uses cookies and similar tracking technologies on the bso99 Platform. Cookies are small text files placed on your device by your browser when you visit bso99.one. bso99 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication, security tokens, and account state maintenance. These cannot be disabled without preventing core Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, notification preferences, and responsible gaming configurations to improve your experience across sessions.
• Analytics Cookies: Used by bso99 to understand aggregate usage patterns, page performance, and game popularity on the Platform. All analytics data is processed internally and is not shared with third-party advertising networks.

bso99 does not use third-party advertising or tracking cookies. You may control non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the bso99 Platform.

12 Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules, you have the following rights in respect of your personal data held by bso99:

• Right to be Informed: The right to know how bso99 collects, uses, and protects your personal data — provided through this Privacy Policy and at the point of data collection
• Right of Access: The right to request a copy of the personal data bso99 holds about you and information about how it is processed
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data held by bso99
• Right to Erasure (Right to be Forgotten): The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to bso99's legal retention obligations
• Right to Data Portability: The right to receive your personal data in a commonly used, machine-readable format for transfer to another service provider, where technically feasible
• Right to Object: The right to object to processing of your personal data for direct marketing or purposes based on legitimate interests, unless bso99 can demonstrate compelling legitimate grounds that override your rights
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe bso99 has processed your personal data in violation of the Data Privacy Act

To exercise any of the above rights, please submit a written request to bso99's Data Protection Officer using the contact details in Section 15. bso99 will respond to all verifiable data subject requests within thirty (30) calendar days of receipt. We may require proof of identity before processing any data subject request to protect against unauthorized access to account data.

13 Personal Data of Minors

The bso99 Platform is strictly restricted to individuals who are 21 years of age or older, as required by PAGCOR's online gaming licensing conditions for the Philippines. bso99 does not knowingly collect personal information from individuals under 21 years of age. Age verification is conducted on all new account registrations before any real-money gaming access is granted.

If bso99 becomes aware that personal information has been collected from an individual under 21 years of age, the Account will be immediately suspended and all associated personal data will be deleted without undue delay, subject to any mandatory retention requirements under PAGCOR and AMLC regulations. If you believe a minor has registered a bso99 account, please notify bso99's Data Protection Officer immediately using the contact details in Section 15.

14 Amendments to This Privacy Policy

bso99 reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable Philippine law or NPC guidance, changes to the bso99 Platform's features or services, or changes in PAGCOR's licensing requirements. Material amendments will be notified to registered players via their registered email address at least 14 days before the amended Policy takes effect. Non-material amendments (such as typographical corrections or minor clarifications) may be made without separate notification.

The effective date of the current version of this Privacy Policy is stated at the top of this document. Continued use of the bso99 Platform after the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy. If you do not accept the amended Policy, you must discontinue use of the Platform and request account closure through bso99's support channels.

15 Contact Us and Data Protection Officer

For all privacy-related inquiries, data subject rights requests, or to report a potential data breach involving your bso99 account, please contact:

• Data Protection Officer, bso99
• Email: [email protected] (subject line: "Privacy — Data Subject Request" or "Privacy — DPO Enquiry")
• Live Chat: Available 24/7 within your bso99 account — for urgent privacy matters including suspected unauthorized account access

Players who are not satisfied with bso99's response to a privacy complaint or data subject rights request may submit a complaint to the National Privacy Commission of the Philippines (NPC) at privacy.gov.ph. The NPC is the primary regulatory body responsible for administering and enforcing the Data Privacy Act of 2012 in the Philippines.