bm29 Privacy Policy

Introduction

bm29 ("bm29," "we," "us," or "our") is committed to protecting the privacy and personal data of every player and visitor on the bm29 platform accessible at bm29.app ("Platform"). This Privacy Policy describes what personal information bm29 collects, why we collect it, how we use and protect it, who we share it with, how long we keep it, and what rights you have under Philippine law.

This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). It is also informed by the regulatory requirements of the Philippine Amusement and Gaming Corporation ("PAGCOR"), which governs online gaming operations in the Philippines.

This policy applies to all personal data collected through the bm29 Platform, including the website, mobile-optimized site, live chat support, and any associated communications channels such as email or SMS. It should be read together with the bm29 Terms & Conditions and Responsible Gaming Policy.

Data Controller

For the purposes of the Data Privacy Act of 2012, bm29 is the personal information controller in respect of all personal data collected from players and visitors on the Platform. bm29 determines the purposes for which and the means by which personal data is processed.

bm29 has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with the DPA and this Privacy Policy, handling data subject requests, and serving as the point of contact for the National Privacy Commission. Contact details for the DPO are provided in Section 14 of this policy.

Where bm29 engages third-party service providers to process personal data on its behalf (for example, payment processors, identity verification providers, or game content suppliers), those providers act as personal information processors and are bound by contractual data processing agreements that require them to handle data solely in accordance with bm29's instructions and applicable Philippine law.

What Personal Data We Collect

bm29 collects the following categories of personal data, depending on how you interact with the Platform:

How We Collect Your Data

bm29 collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact support, respond to a survey, or update your account settings;
• Automatically through platform use: Server logs, cookies, and similar tracking technologies record technical and activity data as you browse and play on the Platform (see Section 7);
• From third-party service providers: Identity verification agencies, payment processors (GCash, Maya, BPI, BDO, Metrobank), and fraud prevention services may provide or validate data about you in the course of processing your transactions;
• From regulatory bodies: PAGCOR or law enforcement agencies may provide information relevant to compliance checks or investigations;
• From publicly available sources: Publicly accessible databases may be consulted for sanctions screening and AML compliance purposes.

Purpose & Legal Basis for Processing

bm29 processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012. The following table summarizes the primary purposes and their corresponding legal bases:

Where processing is based on your consent — for example, for receiving promotional emails or SMS — you may withdraw that consent at any time by updating your communication preferences within the account dashboard or by contacting bm29 support. Withdrawal of consent does not affect the lawfulness of processing conducted before the withdrawal.

Sharing Your Personal Data

bm29 does not sell, rent, or trade your personal data. We share personal data only in the following circumstances and with the following categories of recipients:

• Payment processors: GCash, Maya, BPI, BDO, and Metrobank receive transaction data necessary to process your deposits and withdrawals. These providers are independent data controllers subject to their own privacy policies and Bangko Sentral ng Pilipinas (BSP) regulations;
• Identity verification providers: Third-party KYC and AML compliance services receive identity document data for verification purposes under contractual data processing agreements;
• Game content suppliers: Third-party game providers may receive anonymized session and wager data for game performance reporting. No personally identifiable information is shared beyond what is strictly necessary;
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the NPC, and Philippine law enforcement agencies where bm29 is legally required or permitted to disclose data;
• Professional advisers: Legal counsel, auditors, and compliance consultants acting under duties of confidentiality;
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections and notification to affected players.

All third-party processors engaged by bm29 are required to process personal data solely in accordance with bm29's written instructions, maintain appropriate technical and organizational security measures, and comply with the Data Privacy Act of 2012.

Cookies & Tracking Technologies

bm29 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit the Platform. They allow bm29 to recognize your browser, maintain your session, and collect technical and activity data as described in Section 3.

The following categories of cookies are used on the bm29 Platform:

• Strictly necessary cookies: Essential for the Platform to function. These enable session management, login authentication, and security features. They cannot be disabled without impairing Platform functionality;
• Functional cookies: Remember your preferences such as language settings, display preferences, and responsible gaming tool configurations to provide a personalized experience;
• Analytical cookies: Collect anonymized data about how players use the Platform — pages visited, session duration, error occurrences — to help bm29 improve performance and usability;
• Security cookies: Support fraud detection and bot prevention systems to protect the integrity of the Platform and your account.

bm29 does not use third-party advertising cookies or share cookie data with advertising networks. You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect Platform functionality including the ability to log in.

Data Retention

bm29 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law, whichever is longer. The following general retention periods apply:

• Account and identity data: Retained for the duration of the account and for a minimum of five (5) years after account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act;
• KYC documents: Retained for a minimum of five (5) years after the end of the business relationship, in compliance with RA 9160;
• Financial transaction records: Retained for a minimum of five (5) years for AML and tax compliance purposes;
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution, fraud investigation, and regulatory reporting;
• Support communications: Retained for two (2) years for quality assurance and dispute resolution;
• Marketing consent records: Retained until consent is withdrawn, and for a reasonable period thereafter as evidence of lawful processing.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where legal proceedings, regulatory investigations, or unresolved disputes are ongoing, retention may be extended until resolution.

Security Measures

bm29 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption: All data transmitted between your device and the bm29 Platform is encrypted using TLS (Transport Layer Security). Sensitive data at rest, including KYC documents and financial records, is encrypted using industry-standard algorithms;
• Access controls: Access to personal data is restricted to bm29 personnel and authorized processors on a strict need-to-know basis. All access is logged and audited;
• Authentication: Privileged system access requires multi-factor authentication. Player accounts support additional login security options;
• Infrastructure security: Platform infrastructure is hosted in secure, access-controlled data center environments with continuous monitoring, intrusion detection, and vulnerability management;
• Staff training: All bm29 staff with access to personal data receive regular training on data protection obligations, security practices, and the Data Privacy Act;
• Incident response: bm29 maintains a documented data breach response procedure, including obligations to notify the NPC within 72 hours and to inform affected players without undue delay.

While bm29 takes all reasonable steps to protect your data, no system is completely immune to risk. You are responsible for maintaining the security of your account credentials. Never share your bm29 password with anyone, including bm29 support staff.

Your Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by bm29. These rights are summarized below and may be exercised by contacting the bm29 Data Protection Officer as described in Section 14:

bm29 will respond to verified data subject requests within thirty (30) calendar days of receipt. Where a request is complex or where bm29 receives a large volume of requests, we may extend this period by a further thirty (30) days with notice. bm29 does not charge a fee for processing data subject requests unless they are manifestly unfounded or excessive.

Minors & Age Restriction

The bm29 Platform is strictly for individuals aged 21 years and above, in compliance with PAGCOR regulations governing online gambling in the Philippines. bm29 does not knowingly collect personal data from individuals under the age of 21.

If bm29 becomes aware that personal data has been collected from an individual under 21 without verifiable parental or guardian consent, that data will be deleted promptly and the associated account closed. If you are a parent or guardian and believe your child has registered on bm29, please contact our Data Protection Officer immediately using the contact details in Section 14.

As part of our KYC process, bm29 verifies the age of all registering players. Providing false date-of-birth information during registration constitutes a material breach of the bm29 Terms & Conditions and may result in permanent account closure and forfeiture of funds.

International Data Transfers

bm29's primary operations and data storage are based in the Philippines. In some cases, personal data may be transferred to or accessed by third-party service providers located outside the Philippines — for example, game content suppliers or cloud infrastructure providers operating internationally.

Where such international transfers occur, bm29 ensures that adequate safeguards are in place as required by the Data Privacy Act of 2012 and NPC regulations. These safeguards include contractual clauses requiring recipient organizations to maintain data protection standards equivalent to those required under Philippine law, and assessment of the data protection regime of the recipient country.

bm29 does not transfer personal data to jurisdictions that do not provide an adequate level of protection without implementing appropriate additional safeguards. If you have questions about international transfers of your data, please contact the DPO.

Changes to This Privacy Policy

bm29 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. When material changes are made, bm29 will provide notice by posting the updated policy on the Platform and, where practicable, by notifying registered players via their registered email address.

The effective date at the top of this page indicates when the policy was last updated. Your continued use of the bm29 Platform following the effective date of any amended policy constitutes acceptance of the revised terms. We encourage you to review this Privacy Policy periodically.

If changes reduce your privacy rights in a material way, bm29 will seek your renewed consent where required by the Data Privacy Act of 2012.

Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by bm29, please contact our Data Protection Officer through the following channels:

Data Protection Officer — bm29

Email: [email protected]

Support is available 24 hours a day, 7 days a week, in English and Tagalog. Please mark your inquiry clearly as a Data Privacy Request to ensure it is directed to the DPO without delay.

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data protection rights have been violated. The NPC can be contacted through the contact details published on its official government website.