bf77 Privacy Policy

bf77 ("we," "us," "our," or "the Company") operates the online gaming and sports betting platform accessible at bf77.vu (the "Platform"). As a service that collects and processes personal data from our users — including Filipino players — bf77 takes data privacy seriously and is committed to handling your personal information responsibly, transparently, and in accordance with applicable law.

This Privacy Policy applies to all personal data collected through: the bf77 website and mobile-optimized web platform; the account registration and verification process; deposits, withdrawals, and payment transactions; live chat, email, and other support communications; promotional and loyalty program participation; and any other interaction you have with the bf77 platform or team.

By registering a bf77 account or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and processing of your personal data as described herein.

For the purposes of this Privacy Policy, the data controller responsible for your personal information is bf77, operating under the domain bf77.vu. bf77 determines the purposes and means of processing personal data collected through the Platform.

bf77 has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with applicable data protection laws, including the Philippine Data Privacy Act of 2012. You may contact the bf77 DPO directly regarding any data privacy concern at the contact details provided in Section 16 of this Policy.

Where bf77 engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification providers, and game software suppliers — those entities act as data processors under the direction of bf77 and are contractually bound to handle your data only as instructed and in compliance with applicable privacy law.

bf77 collects the following categories of personal data from users of the Platform. The specific data points collected depend on your level of interaction with the Platform and the verification status of your account.

3.1 Identity and Registration Data

• Full legal name as it appears on your government-issued identification
• Date of birth (used primarily to verify compliance with the 21+ age requirement)
• Nationality and country of residence
• Government-issued identification number (e.g., Philippine National ID, passport number, driver's license number, SSS/GSIS number)
• Username and encrypted password credentials
• Profile photograph where submitted for KYC verification purposes

3.2 Contact Data

• Email address (primary communication channel for account notifications)
• Mobile phone number (used for OTP verification and account security)
• Residential address including barangay, city or municipality, province, and postal code

3.3 Financial and Transaction Data

• GCash mobile number and account reference information
• Maya / PayMaya account reference information
• Bank account name, bank name, and account number for bank transfer methods (BPI, BDO, Metrobank)
• Transaction history including deposit amounts, withdrawal requests, bonus credits, wager records, and win/loss data
• Payment verification documents such as screenshots or transaction reference numbers

3.4 Technical and Usage Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser information
• Pages visited, features used, and time spent on the Platform
• Game session logs including games played, stakes placed, and outcomes
• Login timestamps and session duration records
• Referring URLs and search terms that led you to bf77.vu

3.5 Communications Data

• Content of live chat conversations with bf77 support agents
• Email correspondence with the bf77 support team
• Responses to surveys, promotions, or feedback requests where voluntarily provided
• Responsible gaming self-assessment responses where submitted

bf77 collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make deposits or withdrawals, contact support, respond to surveys, or participate in promotions.
• Automatically — through cookies, web beacons, and server log files when you access and navigate the bf77 platform, as described further in Section 10.
• From third-party providers — identity verification agencies, payment processors, fraud detection services, and geolocation data providers may supply information to bf77 in connection with account verification and transaction processing.
• From game providers — game play data and session information may be transmitted to bf77 by licensed third-party game software providers as part of the integrated game delivery service.

bf77 processes your personal data for the following specific purposes:

bf77 processes personal data only where a valid legal basis exists under the Philippine Data Privacy Act of 2012 and other applicable privacy legislation. The legal bases relied upon by bf77 are as follows:

• Consent: Where you have given clear, freely obtained, specific, and informed consent to the processing of your personal data for a defined purpose — such as receiving promotional communications — bf77 processes that data on the basis of consent. You may withdraw consent at any time by contacting bf77 support.
• Contractual Necessity: Processing required to fulfill bf77's obligations under the Terms and Conditions that form the contract between bf77 and registered users — including account management, payment processing, and customer support — is carried out on the basis of contractual necessity.
• Legal Obligation: Processing required to comply with applicable legal requirements, including KYC verification, AML reporting obligations, and responses to regulatory or law enforcement requests, is carried out on the basis of legal obligation.
• Legitimate Interests: Processing carried out to protect the security of the bf77 platform, detect and prevent fraud, and conduct aggregate analytics for service improvement is justified under the legitimate interests of bf77, provided those interests are not overridden by the fundamental rights and freedoms of data subjects.

bf77 does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Personal data is shared only with the following categories of recipients, strictly as necessary for the purposes described in this Policy:

• Payment Processors: GCash (GXI / Globe Fintech), Maya Philippines, GrabPay, and banking partners (BPI, BDO, Metrobank) receive financial and identity data necessary to process deposit and withdrawal transactions.
• Identity Verification Providers: Third-party KYC and age verification service providers process identity documents and biometric data solely to verify the eligibility of bf77 account applicants.
• Game Software Providers: Licensed game providers — including but not limited to Evolution Gaming, Pragmatic Play, PG Soft, and Microgaming — receive player session data as required to deliver their games and maintain game integrity.
• Fraud Prevention and Security Services: Risk management and cybersecurity service providers may receive technical and transaction data for the purpose of detecting and preventing fraudulent activity.
• Regulatory and Law Enforcement Authorities: bf77 may disclose personal data to government agencies, regulatory bodies, or law enforcement as required by applicable Philippine law, valid legal process, or court order. This includes PAGCOR, the Anti-Money Laundering Council (AMLC), and the National Privacy Commission (NPC).
• Professional Advisers: Lawyers, auditors, accountants, and insurers engaged by bf77 may have access to personal data on a need-to-know basis subject to confidentiality obligations.
• Business Successors: In the event of a merger, acquisition, reorganization, or sale of the bf77 business, user personal data may be transferred to the acquiring entity subject to the same privacy protections described in this Policy.

bf77 retains personal data only for as long as is necessary for the purposes for which it was collected and as required by applicable law. The following retention guidelines apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to an identifiable individual. Where anonymisation is not technically feasible, data is pseudonymised and access is restricted to the minimum number of personnel required for legitimate operational purposes.

bf77 implements technical, organizational, and physical security measures designed to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, and destruction. Key security measures in place include:

• Transport Layer Security (TLS 1.3) encryption for all data transmitted between your device and the bf77 platform
• AES-256 encryption for sensitive data stored in bf77 databases, including financial account information and government ID data
• Bcrypt hashing with salting for all stored user passwords — bf77 does not store plaintext passwords at any point
• Multi-factor authentication (MFA) available to all users and mandatory for high-value account operations
• Access controls limiting personal data access to authorized personnel on a strict need-to-know basis
• Regular penetration testing and security audits conducted by independent third-party cybersecurity firms
• 24/7 intrusion detection and monitoring systems for the bf77 platform infrastructure
• Segregated data environments ensuring that production data is isolated from development and testing systems

In the event of a personal data breach that poses a risk to your rights and freedoms, bf77 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular 16-03. Affected users will be notified promptly where required by law or where notification is necessary to protect their interests.

bf77 uses cookies and similar tracking technologies to operate the Platform, improve user experience, and analyse usage patterns. A "cookie" is a small text file placed on your device by a website you visit. The following types of cookies are used on bf77.vu:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session management cookies that keep you logged in during your visit, security tokens that protect against cross-site request forgery, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and display options to personalise your experience. These are set on the basis of your implicit consent through Platform use.
• Analytics Cookies: Used to collect aggregated and anonymised data about how users navigate the Platform — which pages are visited most frequently, where users exit, and how features are used — to support bf77's platform improvement efforts.
• Security and Fraud Prevention Cookies: Help bf77 identify suspicious access patterns, bot traffic, and potentially fraudulent session behavior to protect user accounts and platform integrity.

You may manage cookie preferences through your browser settings. Note that disabling certain categories of cookies may affect the functionality of the bf77 platform, including your ability to remain logged in or access certain features. bf77 does not use third-party advertising cookies or cross-site tracking cookies for ad targeting purposes.

Under the Philippine Data Privacy Act of 2012 and applicable privacy law, you have the following rights in relation to your personal data held by bf77. To exercise any of these rights, please contact the bf77 Data Protection Officer using the details in Section 16. bf77 will respond to verifiable requests within thirty (30) days.

• Right to Be Informed: You have the right to be informed of the specific personal data being processed by bf77, the purposes of processing, and the identity of third parties to whom data is disclosed. This Privacy Policy fulfils that obligation.
• Right to Access: You have the right to request a copy of the personal data bf77 holds about you, including a description of how it is being used and a list of third parties to whom it has been disclosed.
• Right to Correction: You have the right to request correction of any personal data that is inaccurate, incomplete, outdated, or misleading. You may update basic account information directly through your bf77 account settings or by contacting support.
• Right to Erasure: You have the right to request deletion of your personal data where processing is no longer necessary, consent has been withdrawn, or data has been unlawfully processed — subject to bf77's legal retention obligations that may require retention of certain records.
• Right to Object: You have the right to object to processing based on legitimate interests or carried out for direct marketing purposes. Objection to direct marketing will be honored immediately and without condition.
• Right to Data Portability: You have the right to receive a copy of personal data you provided to bf77 in a structured, commonly used, machine-readable format, and to transmit that data to another service provider where technically feasible.
• Right to Lodge a Complaint: If you believe bf77 has not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

The bf77 platform is strictly restricted to individuals aged 21 years and above, in accordance with Philippine law governing casino-style gaming and sports betting activities. bf77 does not knowingly collect, use, or retain personal data from individuals under the age of 21.

If bf77 becomes aware that personal data has been collected from a user who is under 21 years of age, the relevant account will be closed immediately, all personal data associated with that account will be deleted or anonymised as soon as legally permissible, and any deposited funds will be returned to the original payment source following identity verification of the actual depositor.

Parents or legal guardians who believe that a minor in their care has created a bf77 account or provided personal data to bf77 are encouraged to contact the bf77 support team immediately at [email protected] so that the matter can be investigated and resolved without delay.

Some of bf77's technology partners, game providers, and service providers are located outside the Philippines. As a result, personal data processed in connection with the bf77 platform may be transferred to, stored in, or processed in countries other than the Philippines. Such countries may have data protection laws that differ from those in force in the Philippines.

Where personal data is transferred outside the Philippines, bf77 ensures that adequate safeguards are in place to protect your information, which may include:

• Transfers to countries that the National Privacy Commission has determined provide an adequate level of data protection
• Standard contractual clauses approved by the NPC or equivalent regulatory body
• Binding corporate rules where transfers occur within a group of companies subject to common privacy governance
• Contractual obligations that require the receiving party to implement security and privacy standards equivalent to those required under Philippine law

By using the bf77 platform, you acknowledge and consent to the transfer of your personal data to other jurisdictions as necessary for the operation of the platform and the delivery of services described in this Privacy Policy.

The bf77 platform may reference or be accessed through links, integrations, or payment methods that are operated by third parties — including GCash, Maya, GrabPay, and banking institutions. This Privacy Policy applies exclusively to data processed by bf77 through the bf77.vu platform and does not govern the privacy practices of any third-party service, application, or website.

When you interact with a third-party service in connection with your bf77 account — such as initiating a GCash deposit — your interaction with that service is governed by the privacy policy of the third-party provider, not by this Policy. bf77 has no control over and accepts no responsibility for the privacy practices or content of third-party platforms.

Users are encouraged to review the privacy policies of any third-party services they use in connection with the bf77 platform, including payment providers and telecommunications services, to understand how their data is handled by those parties independently of bf77.

bf77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory guidance. Material changes to this Policy will be communicated to registered users via the email address held on their account and/or by posting a prominent notice on the bf77 platform prior to the change taking effect.

The effective date at the top of this document will be updated each time the Policy is revised. We encourage you to review this Privacy Policy periodically to stay informed about how bf77 protects your personal data. Your continued use of the bf77 platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

Where changes to the Policy require your fresh consent under applicable law — for example, where a new processing purpose is introduced that cannot be justified under an existing legal basis — bf77 will seek that consent from you before proceeding with the new processing activity.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bf77 processes your personal data, please contact us through the following channels:

• Data Protection Officer: Grace Lim, Head of Player Safety & DPO
• Privacy Inquiries Email: [email protected] — please include "Privacy Request" in your subject line
• Live Chat: Available 24/7 via the chat widget inside your bf77 account dashboard
• Response Timeframe: bf77 aims to acknowledge all privacy requests within 5 business days and to provide a substantive response within 30 days, as required by the Philippine Data Privacy Act