bay88 Privacy Policy

01 Who We Are

bay88 ("bay88," "we," "us," or "our") operates the online gaming platform accessible at bay88.one, offering casino games, slots, bingo, esports wagering, and related entertainment services to eligible players in the Philippines. bay88 is the data controller responsible for the personal data of registered players and website visitors processed through the Platform.

We are committed to handling your personal data in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. We are also guided by applicable PAGCOR regulations concerning player data and anti-money laundering compliance.

02 Personal Data We Collect

Depending on how you interact with the bay88 Platform, we may collect the following categories of personal data:

We do not collect sensitive personal information (as defined under the DPA) unless strictly required for regulatory compliance, in which case we will seek your explicit consent.

03 How We Collect Your Data

bay88 collects personal data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Technical data collected automatically when you access the Platform, including through cookies, web beacons, server logs, and similar tracking technologies.
• Third-party sources: Identity verification data from KYC service providers; fraud and AML screening data from compliance partners; payment data from GCash, Maya, and banking partners in connection with your transactions.
• Regulatory sources: Information received from PAGCOR or other regulatory authorities in connection with licensing, compliance, or investigation requirements.

04 How We Use Your Personal Data

bay88 uses your personal data for the following purposes:

• Account management: To create, maintain, and administer your bay88 account, including verifying your identity and age (21+) as required by PAGCOR regulations.
• Service delivery: To provide access to games, process deposits and withdrawals, and deliver the features and functionality of the Platform.
• Regulatory compliance: To fulfill our obligations under the DPA, PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA), and other applicable Philippine laws, including filing Suspicious Transaction Reports (STRs) where required.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover, and other security threats.
• Responsible gaming: To monitor gaming behavior, enforce deposit limits and self-exclusion orders, and identify players who may be at risk of problem gambling.
• Customer support: To respond to your inquiries, resolve disputes, and improve the quality of our support services.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have provided your consent or where we have a legitimate interest, and always with an easy opt-out mechanism.
• Platform improvement: To analyze usage patterns, conduct A/B testing, and improve the overall player experience on the bay88 Platform.

05 Legal Basis for Processing

Under the Data Privacy Act of 2012, bay88 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — i.e., to operate your account and deliver gaming services.
• Legal obligation: Processing required to comply with PAGCOR regulations, AMLA obligations, NPC requirements, and other applicable Philippine laws.
• Legitimate interests: Processing for fraud prevention, platform security, and service improvement, where our interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications and non-essential cookies, where we have obtained your prior consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

06 Data Sharing & Disclosure

bay88 does not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• KYC and identity verification providers: To verify your identity and age as required by PAGCOR and AMLA regulations.
• Payment processors: GCash, Maya, and banking partners, to process your deposits and withdrawals.
• Fraud and AML compliance partners: To screen transactions and player activity against sanctions lists and fraud databases.
• Game software providers: To deliver game content and maintain game integrity; these providers receive only the minimum data necessary for game operation.
• Customer support platforms: To manage live chat and support ticket systems.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and law enforcement agencies, where disclosure is required by law or court order.
• Professional advisers: Lawyers, auditors, and accountants, subject to professional confidentiality obligations.

All third-party service providers engaged by bay88 are contractually required to process your data only for the specified purpose and to maintain appropriate security standards consistent with the DPA.

07 Cookies & Tracking Technologies

bay88 uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies we use include:

• Strictly necessary cookies: Essential for the Platform to function — e.g., session authentication, security tokens, and load balancing. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and display options to personalize your experience.
• Analytics cookies: Collect aggregated, anonymized data about how players use the Platform to help us identify areas for improvement.
• Marketing cookies: Used to deliver relevant promotional content within the Platform. These are only set with your consent.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. For strictly necessary cookies, no consent is required as they are essential to service delivery.

08 Data Retention

bay88 retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with AMLA record-keeping requirements.
• Transaction and gaming data: Retained for a minimum of five (5) years from the date of each transaction, as required by PAGCOR and AMLA regulations.
• Customer support communications: Retained for three (3) years from the date of the last interaction.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent.
• Technical and log data: Retained for up to twelve (12) months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymized in accordance with our data disposal procedures.

09 Data Security

bay88 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the bay88 Platform — the same standard used by major Philippine banks such as BPI, BDO, and Metrobank.
• Encryption of sensitive data at rest, including financial data and government ID information.
• Role-based access controls ensuring that only authorized personnel can access personal data, strictly on a need-to-know basis.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Multi-factor authentication for all internal systems that process personal data.
• Comprehensive incident response procedures, including mandatory breach notification to the NPC within 72 hours of discovery of a personal data breach that poses a real risk of serious harm.

While bay88 takes all reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying bay88 immediately if you suspect unauthorized access to your account.

10 Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by bay88:

• Right to be Informed: To know what personal data we hold about you, why we hold it, and how it is used — as set out in this Privacy Policy.
• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to Object: To object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to Data Portability: To receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.
• Right to Lodge a Complaint: To file a complaint with the National Privacy Commission (NPC) if you believe your data protection rights have been violated. The NPC can be reached at privacy.gov.ph.

To exercise any of the above rights, please contact our Data Protection Officer using the details in Section 14. We will respond to all verified requests within fifteen (15) business days, as required by the DPA. We may need to verify your identity before processing your request.

11 Children's Privacy

The bay88 Platform is strictly intended for adults aged 21 years and above, in accordance with Philippine gaming regulations. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor has registered on the bay88 Platform, please contact our support team immediately so we can investigate and take appropriate action.

12 Third-Party Links

The bay88 Platform may contain links to third-party websites or services, such as game provider portals or payment gateway interfaces. This Privacy Policy applies solely to data processed by bay88 and does not cover the privacy practices of any third-party websites. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform.

bay88 is not responsible for the content, privacy practices, or data handling of any third-party websites or services.

13 Changes to This Privacy Policy

bay88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is indicated at the top of this document.

Where changes are material, we will notify registered players via email or an in-platform notification prior to the changes taking effect. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgment of the revised Privacy Policy. We encourage you to review this page periodically.

14 Contact & Data Protection Officer

bay88 has appointed a Data Protection Officer (DPO) as required under the Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our DPO at:

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you are not satisfied with our response to your data protection concern.