bm555 Privacy Policy

This Privacy Policy ("Policy") sets out the data protection principles and practices of bm555 ("bm555", "we", "us", "Company") in relation to personal information collected from individuals who access or use the bm555 online gaming and sports betting platform at bm555.club ("Platform"), including registered account holders and unregistered visitors.

This Policy applies to all personal data collected through the Platform, customer support channels, and any other point of interaction between you and bm555. It should be read alongside the bm555 Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference.

bm555 is committed to handling personal data with the highest standards of transparency, security, and respect for the rights of Filipino data subjects. The collection of personal data at bm555 is limited to what is necessary for the specific purposes described below — we do not collect personal data we do not need, and we do not retain it longer than required.

For the purposes of the Philippine Data Privacy Act of 2012, bm555 is the personal information controller responsible for the personal data collected through the Platform. bm555 is a PAGCOR-authorized gaming operator serving Filipino players across the Philippines.

Contact details for data protection matters, including exercise of data subject rights and privacy complaints, are set out in Section 14 of this Policy. bm555 has designated a Data Protection Officer (DPO) who can be reached via the contact information provided therein.

bm555 collects personal data from you directly (information you provide) and indirectly (information generated by your use of the Platform). The categories of personal data collected are described below:

bm555 uses personal data collected from Filipino players and Platform users for the following specific purposes:

• Account Management: Creating and maintaining your bm555 account, authenticating your identity at login, processing password resets and OTP verification, and managing account settings.
• KYC and Age Verification: Verifying that you meet the PAGCOR-mandated minimum age requirement of 21 years, and confirming your identity before processing withdrawal transactions.
• Transaction Processing: Processing deposits and withdrawals to and from your bm555 PHP wallet via GCash, PayMaya, and bank transfer methods.
• Regulatory Compliance: Complying with PAGCOR licensing requirements, Anti-Money Laundering Act (AMLA) obligations, and reporting requirements to regulatory authorities including PAGCOR and AMLC.
• Responsible Gaming: Monitoring gaming activity for indicators of problem gambling, enforcing deposit limits and self-exclusion requests, and complying with PAGCOR responsible gaming mandates.
• Platform Security and Fraud Prevention: Detecting and investigating suspicious account activity, unauthorized access attempts, duplicate accounts, and AML red flags.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve the bm555 Platform, optimize game lobby presentation, and improve mobile performance.
• Customer Support: Responding to support queries, resolving disputes, processing complaints, and maintaining records of customer communications as required by PAGCOR.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to account holders who have opted in. Marketing communications can be opted out of at any time via account settings or by contacting support.

Under the Philippine Data Privacy Act of 2012, bm555 relies on the following lawful bases for processing personal data:

• Contractual Necessity: Processing is necessary for the performance of the contract between you and bm555 (the Terms & Conditions), including account creation, transaction processing, and game service delivery.
• Legal Obligation: Processing is required to comply with applicable Philippine law, including PAGCOR licensing conditions, AMLA reporting obligations under the Anti-Money Laundering Act, and the Data Privacy Act itself.
• Consent: For marketing communications, optional profile data, and certain cookie categories, processing is based on your explicit consent, which may be withdrawn at any time without prejudice to the lawfulness of prior processing.
• Legitimate Interests: For fraud detection, platform security, and Platform improvement analytics, processing is based on bm555's legitimate interests in maintaining a secure and functional gaming platform for Filipino players, balanced against your privacy rights.

bm555 does not sell, rent, or trade personal data. Personal data is shared only in the following circumstances and with the following categories of recipients:

• PAGCOR and Regulatory Authorities: bm555 is legally required to disclose certain player and transaction data to PAGCOR under its licensing conditions. Disclosures are made only as required by law and within the scope mandated by the relevant regulatory authority.
• Anti-Money Laundering Council (AMLC): Transaction reports and covered transaction reports (CTRs) are submitted to AMLC in accordance with Philippine AMLA obligations applicable to gaming operators.
• Payment Processors: GCash, PayMaya, and banking partners (BDO, BPI, Metrobank) receive the minimum personal and financial data necessary to process your deposit or withdrawal transaction. These partners process data under their own PDPA-compliant privacy policies.
• KYC Verification Providers: Third-party identity verification service providers may process your KYC documents on behalf of bm555 under a data processing agreement that requires PDPA-equivalent data protection standards.
• Game Software Providers: Game providers (e.g., JILI, Pragmatic Play, PG Soft) may receive a session token and anonymized player identifier to facilitate game delivery. No personally identifiable information is shared with game providers beyond what is technically required for game session management.
• Law Enforcement: bm555 may disclose personal data to Philippine law enforcement authorities where required by a valid court order, subpoena, or other lawful legal process.

All third parties with whom bm555 shares personal data are bound by contractual data protection obligations consistent with the requirements of the Philippine Data Privacy Act.

The bm555 Platform uses cookies and similar technologies to support functionality, security, and performance. The following cookie categories are used:

• Strictly Necessary Cookies: Required for the Platform to function, including session authentication, login persistence, and security token management. These cannot be disabled without breaking Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, lobby view preferences, and responsible gaming tool configurations.
• Analytical Cookies: Collect anonymized usage data to help bm555 understand how Filipino players use the Platform and identify areas for improvement. These are processed under legitimate interests and can be declined via cookie preferences.
• Security Cookies: Used for fraud detection, bot mitigation, and session integrity monitoring. These are necessary for Platform security and cannot be disabled.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to play games or make transactions on bm555.

bm555 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

• Active Account Data: Retained for the duration of the account relationship plus a minimum of five (5) years post-account closure, in compliance with PAGCOR record-keeping requirements and AML record retention obligations under the AMLA.
• KYC Documents: Retained for a minimum of five (5) years from the date of the most recent transaction associated with the account, as required by AMLC regulations.
• Transaction Records: Retained for five (5) years from the transaction date per AMLA requirements.
• Customer Support Records: Retained for three (3) years from the date of the support interaction, or longer where the interaction relates to a dispute or legal matter.
• Marketing Consent Records: Retained for three (3) years from the date of consent or withdrawal of consent, as evidence of lawful marketing communications.
• Technical Logs: Retained for twelve (12) months for security and fraud investigation purposes, then deleted or anonymized.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with bm555's data disposal procedures.

bm555 implements technical and organizational security measures appropriate to the sensitivity of the personal data processed. These measures include:

• Encryption in Transit: All data transmitted between your device and the bm555 Platform is encrypted using TLS 1.2 or higher. HTTPS is enforced across the entire Platform.
• Encryption at Rest: Sensitive personal data, including KYC documents and financial data, is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Personal data access within bm555 is restricted on a need-to-know basis. Staff access to player personal data is logged and audited.
• OTP Authentication: Account login and sensitive account changes require one-time PIN verification to the registered Philippine mobile number, providing an additional layer of identity verification.
• Penetration Testing: The bm555 Platform undergoes periodic security assessments and penetration testing to identify and remediate vulnerabilities.
• Data Breach Procedures: bm555 maintains documented data breach response procedures. In the event of a personal data breach affecting Filipino account holders, bm555 will notify the National Privacy Commission (NPC) and affected data subjects within the timeframes prescribed by the Data Privacy Act.

Despite these measures, no internet-based platform is completely immune to security risks. You are responsible for maintaining the confidentiality of your bm555 login credentials and for logging out of shared devices after each session.

Under the Philippine Data Privacy Act of 2012, Filipino data subjects have the following rights with respect to their personal data held by bm555. Requests to exercise these rights should be submitted in writing to the contact details in Section 14:

bm555 will respond to data subject rights requests within fifteen (15) working days of receipt. Where the request is complex or numerous, bm555 may extend the response period by a further thirty (30) days, notifying you of the extension and the reason.

The bm555 Platform is strictly intended for persons aged 21 years and older, as mandated by PAGCOR for real-money gaming activities. bm555 does not knowingly collect or process personal data from individuals under 21 years of age.

Age verification is performed as part of the KYC process. Where bm555 becomes aware that personal data from a person under 21 has been collected — whether through fraudulent registration or other means — such data will be immediately deleted, the account will be suspended, and the matter will be reported to PAGCOR in accordance with regulatory requirements.

Certain personal data processed by bm555 may be transferred to and processed by third-party service providers located outside the Philippines — for example, cloud infrastructure providers or game software providers whose servers are located in other jurisdictions.

Where personal data is transferred outside the Philippines, bm555 ensures that appropriate safeguards are in place as required by the Data Privacy Act, including contractual clauses that require the recipient to maintain data protection standards equivalent to those mandated by Philippine law.

bm555 will not transfer personal data to a jurisdiction that does not provide adequate data protection unless the transfer is necessary for the performance of your bm555 account contract, is required by PAGCOR or other applicable Philippine law, or is carried out with your explicit consent.

bm555 may update this Privacy Policy from time to time to reflect changes in data processing practices, applicable law, or regulatory requirements. Material changes to this Policy will be communicated to registered account holders via notification to the registered Philippine mobile number and/or a notice posted on the Platform no less than seven (7) calendar days prior to the effective date of the revised Policy.

The effective date of the current version of this Privacy Policy is displayed at the top of this page. Your continued use of the bm555 Platform after the effective date of any revision constitutes your acknowledgment of the updated Policy.

The current version of this Privacy Policy is always accessible at bm555.club/privacy-policy. Previous versions of this Policy are available upon request from the Data Protection Officer.

For all privacy-related matters — including exercise of data subject rights, privacy complaints, data breach notifications, or queries about how bm555 handles your personal data — please contact the bm555 Data Protection Officer through the following channels:

• Email: [email protected] — please include "Data Privacy Request" in your subject line. Responses within 15 working days.
• Live Chat: Available 24/7 on the bm555 Platform. Inform the support agent that your query is a data privacy matter — it will be escalated to the DPO.

If your privacy complaint is not resolved satisfactorily by bm555, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the supervisory authority for data protection matters in the Philippines.