bs888 Privacy Policy

1 Scope & Application

This Privacy Policy ("Policy") applies to all personal data collected, used, stored, disclosed, and otherwise processed by bs888 in connection with the operation of the online casino and sports betting platform accessible at https://bs888.cam (the "Platform").

This Policy applies to all registered players, prospective players who visit or interact with the Platform without completing registration, and any other individual whose personal data is processed in connection with Platform operations. By registering an account, depositing funds, or otherwise using the bs888 Platform, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

This Policy should be read alongside the bs888 Terms & Conditions, which govern the overall terms of use of the Platform. In the event of a conflict between this Policy and the Terms & Conditions on any matter relating specifically to personal data, this Policy shall prevail.

2 Data Controller Information

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, the personal data controller responsible for your personal information is bs888, operating the Platform at https://bs888.cam under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR).

bs888 has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act. The DPO is responsible for overseeing bs888's compliance with its data protection obligations, handling data subject rights requests, and serving as the primary point of contact with the National Privacy Commission.

Contact details for the bs888 Data Protection Officer are provided in Section 14 of this Policy. All data subject rights requests, privacy-related inquiries, and data breach notifications should be directed to the DPO.

3 Personal Data We Collect

bs888 collects the following categories of personal data from players and Platform users:

bs888 does not collect sensitive personal information beyond what is strictly necessary for identity verification and regulatory compliance purposes. Specifically, bs888 does not collect information about racial or ethnic origin, political opinions, religious beliefs, health data beyond what is required for responsible gaming compliance, or biometric data beyond KYC photograph requirements.

4 How We Collect Your Data

bs888 collects personal data through the following channels:

• Direct Provision: Information you provide when you register an account, complete the KYC verification process, make deposits or withdrawals, contact customer support, or participate in promotions.
• Automated Technical Collection: Information collected automatically when you access the Platform, including IP address, device identifiers, browser type, session activity data, and cookie data. This collection occurs through standard web server logs and analytics tools operated by bs888.
• Payment Processors: Transaction confirmation data and payment method verification data received from GCash, PayMaya, and Philippine banking partners in connection with deposit and withdrawal processing.
• Identity Verification Services: Verification outcomes and identity confidence scores returned by KYC processing systems used to authenticate government-issued identification documents submitted during the KYC process.
• Fraud Prevention Systems: Behavioral analytics data generated by automated fraud detection systems that monitor Platform activity for indicators of fraudulent, abusive, or prohibited conduct.

5 Purposes & Legal Bases for Processing

bs888 processes personal data only for specified, explicit, and legitimate purposes. The following table outlines the primary purposes for which your personal data is processed and the corresponding legal basis under the Data Privacy Act of 2012:

Where bs888 relies on legitimate interests as a legal basis for processing, we have balanced those interests against your rights and interests as a data subject and are satisfied that the processing is proportionate and does not override your fundamental privacy rights.

6 Disclosure to Third Parties

6.1 General Principle. bs888 does not sell, rent, or commercially transfer your personal data to third parties for their independent marketing or commercial purposes. Data sharing with third parties occurs only to the extent necessary to operate the Platform, comply with legal obligations, and protect the interests of our players.

6.2 Categories of Recipients. Your personal data may be shared with the following categories of third parties:

• PAGCOR and Philippine Regulatory Authorities: bs888 is required by its PAGCOR license to submit player data, transaction records, and AML reports to PAGCOR and, where directed, to other Philippine government bodies including the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), and law enforcement agencies acting under lawful authority.
• Payment Service Providers: GCash (Mynt – Globe Fintech Innovations, Inc.), PayMaya Philippines, Inc., and Philippine banking partners (BPI, BDO, Metrobank) receive transaction data necessary to process deposits and withdrawals.
• KYC and Identity Verification Providers: Third-party identity verification service providers receive submitted ID documents and selfie photographs for the purpose of document authenticity verification and identity confirmation.
• Game Providers: Game providers such as JILI, Evolution Gaming, and Pragmatic Play may receive session data and game activity logs to the extent required for game operation, dispute resolution, and regulatory auditing purposes.
• IT Service Providers: Cloud hosting, cybersecurity, and technical infrastructure providers who process personal data as data processors on behalf of bs888 under binding data processing agreements that require compliance with the Data Privacy Act.
• Fraud Prevention Services: Specialized fraud detection service providers who assist bs888 in identifying and preventing fraudulent account activity, collusion, and money laundering.

6.3 Data Processing Agreements. All third-party service providers who process personal data on behalf of bs888 are required to enter into formal data processing agreements that bind them to appropriate security and confidentiality obligations consistent with the Data Privacy Act.

7 Data Retention

bs888 retains personal data only for as long as necessary for the purposes set out in this Policy and as required by applicable Philippine law and PAGCOR regulations.

• Account Data: Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, in compliance with PAGCOR's record-keeping requirements and the Anti-Money Laundering Act.
• KYC Documentation: Retained for a minimum of five (5) years following the player's most recent transaction, in compliance with AMLC reporting requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, in compliance with BIR, PAGCOR, and AMLC requirements.
• Customer Support Records: Retained for a minimum of three (3) years from the date of the last interaction, for dispute resolution and quality assurance purposes.
• Technical and Log Data: Typically retained for twelve (12) months, unless extended retention is required for ongoing security investigations or legal proceedings.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where deletion is not technically feasible (e.g., backup archives), the data is isolated and protected from further processing until deletion becomes possible.

8 Data Security

bs888 implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, loss, alteration, disclosure, and destruction. Our security program includes:

• 256-bit SSL/TLS encryption for all data transmitted between players and the Platform
• Encryption at rest for all stored personal and financial data using industry-standard encryption protocols
• Role-based access controls ensuring that only authorized personnel with a legitimate operational need can access personal data
• Multi-factor authentication for all administrative access to systems holding personal data
• Regular penetration testing and vulnerability assessments conducted by independent security specialists
• Intrusion detection and prevention systems monitoring Platform infrastructure around the clock
• Formal Data Breach Management Policy with defined response procedures and NPC notification protocols
• Annual security awareness training for all bs888 staff with access to personal data

While bs888 takes all reasonable measures to protect your personal data, no data transmission over the internet or electronic storage system is completely impenetrable. Players are also encouraged to take their own precautions, including using strong, unique passwords for their bs888 accounts and enabling two-factor authentication (2FA) where available.

9 Cookies & Tracking Technologies

9.1 What Are Cookies. Cookies are small text files placed on your device by websites you visit. bs888 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your session state, and gather analytics data about how the Platform is used.

9.2 Types of Cookies Used by bs888:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that maintain your logged-in state, security cookies that prevent cross-site request forgery, and cookies that support the proper functioning of payment processes. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and responsible gaming limit settings. Disabling these may affect your Platform experience.
• Analytics Cookies: Collect aggregated, anonymized data about how players navigate and use the Platform. This data helps bs888 identify areas for improvement. Analytics data is not used to identify individual players.
• Security and Fraud Detection Cookies: Used by bs888's fraud prevention systems to detect unusual patterns of behavior that may indicate account compromise or fraudulent activity.

9.3 Cookie Management. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to the bs888 Platform. bs888 does not use third-party advertising or retargeting cookies.

10 Cross-Border Data Transfers

Some of bs888's third-party service providers – including game providers such as Evolution Gaming and Pragmatic Play, and certain cloud infrastructure providers – may process personal data outside of the Philippines. Where such cross-border data transfers occur, bs888 ensures that appropriate safeguards are in place to protect your personal data to a standard that is at least equivalent to the protections afforded under the Philippine Data Privacy Act.

Safeguards implemented for cross-border transfers include contractual clauses in data processing agreements that impose data protection obligations on recipient entities, and transfer only to jurisdictions or entities where bs888 has assessed that adequate data protection standards are maintained.

By using the bs888 Platform, you acknowledge and consent to the transfer of your personal data to third-party service providers operating outside the Philippines, subject to the safeguards described in this Section.

11 Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you are entitled to exercise the following rights with respect to your personal data held by bs888:

To exercise any of the above rights, please contact the bs888 Data Protection Officer using the contact details provided in Section 14. bs888 will respond to all data subject rights requests within fifteen (15) calendar days of receipt, or within the timeframe specified by the NPC for the relevant type of request.

Please note that certain rights are subject to limitations under the Data Privacy Act – in particular, the right to erasure may be restricted where bs888 is required to retain data under PAGCOR regulations, AML laws, or other applicable Philippine legal obligations.

12 Children's Privacy & Age Restriction

The bs888 Platform is strictly for individuals who are twenty-one (21) years of age or older, in compliance with PAGCOR's minimum age requirements for online gambling in the Philippines. bs888 does not knowingly collect personal data from individuals under 21 years of age.

If bs888 discovers or is notified that personal data has been collected from a person under the age of 21, the relevant account will be immediately suspended, any associated balance will be held pending regulatory review, and the data collected will be processed only to the extent required for regulatory reporting and then securely deleted.

If you are a parent or guardian and believe that a person under 21 in your care has registered on the bs888 Platform, please contact our Data Protection Officer immediately using the contact details in Section 14 so that appropriate action can be taken without delay.

13 Amendments to This Policy

bs888 reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or NPC guidance. The effective date at the top of this Policy will always reflect the date of the most recent revision.

Where amendments are material – meaning they significantly affect how your personal data is processed or your rights as a data subject – bs888 will notify registered players via the mobile number associated with their account or through an in-platform notification displayed upon next login. Non-material amendments (such as clarifications of existing language) may be made without direct notification.

Your continued use of the bs888 Platform following notification of any amendment constitutes your acknowledgment of and agreement to the revised Policy. If you do not agree with any changes to this Policy, you may close your account and withdraw your remaining balance by contacting customer support.

14 Contact & Data Protection Officer

For all privacy-related inquiries, data subject rights requests, concerns about the processing of your personal data, or to report a suspected data breach, please contact the bs888 Data Protection Officer using the details below.

Data Protection Officer – bs888

Email: [email protected]

Response Hours: 24 hours a day, 7 days a week

Response Timeframe: Within 15 calendar days for formal data subject rights requests; within 24 hours for urgent account privacy matters.

bs888 players also have the right to escalate unresolved privacy concerns to the National Privacy Commission of the Philippines (NPC). Information on filing a complaint with the NPC is available through official Philippine government channels.

This Privacy Policy was last reviewed and approved on January 1, 2026. The English-language version of this Policy is the authoritative version and shall prevail in the event of any inconsistency with any translated version.