xxbb Privacy Policy

1 Overview

This Privacy Policy ("Policy") describes how xxbb, operating the online gaming platform at xxbb.vu (the "Platform"), collects, processes, stores, shares, and protects the personal information of its members and users ("you", "your") in the Republic of the Philippines. This Policy is effective as of January 1, 2026, and applies to all xxbb services, including the casino game library, sports betting, live dealer, bingo, and e-Sabong products.

xxbb takes data privacy seriously. We recognize that when Filipino players provide their personal information to xxbb — whether during registration, KYC verification, or routine account use — they are placing their trust in this platform. That trust carries a responsibility, and this Policy is how xxbb makes that responsibility explicit and transparent.

By registering a xxbb account and using the Platform, you acknowledge that you have read, understood, and consented to the data practices described in this Policy. If you do not consent to these practices, you should not create a xxbb account. This Policy should be read in conjunction with the xxbb Terms & Conditions.

2 Data Controller

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules, xxbb acts as the Personal Information Controller (PIC) in respect of all personal data collected through the Platform. As PIC, xxbb determines the purposes and means of processing your personal information and is responsible for ensuring that all processing activities meet the standards required under Philippine data protection law.

xxbb's designated Data Protection Officer (DPO) is responsible for overseeing compliance with this Policy and the DPA. The DPO may be contacted through the support contact channel identified in Section 16 of this Policy. The DPO's role includes managing data subject rights requests, maintaining xxbb's privacy impact assessments, and serving as the primary point of contact for the National Privacy Commission.

3 Personal Data We Collect

xxbb collects personal data that falls into the following categories. Data collection is limited to what is necessary for the stated purposes — xxbb does not collect personal information that is not operationally required or legally mandated.

4 How We Collect Your Data

xxbb collects personal data through the following channels and mechanisms:

• Direct Submission — Registration: When you create a xxbb account, you provide your name, email address, Philippine mobile number, and date of birth. This is collected through the registration form on the Platform.
• Direct Submission — KYC Verification: When completing identity verification, you upload a photograph of your government-issued Philippine ID and, where required, a selfie photograph for identity matching. This data is processed through xxbb's KYC verification workflow.
• Direct Submission — Payment Transactions: When you initiate a deposit or withdrawal, your payment account reference (GCash number, PayMaya number, or bank account details) is collected and associated with your xxbb account.
• Automated Collection — Platform Use: xxbb's systems automatically collect technical and usage data during your sessions on the Platform. This includes IP address, device identifiers, session timestamps, and interaction logs. This collection occurs through cookies, server-side logging, and analytics instrumentation described in Section 9.
• Direct Submission — Support Interactions: When you contact xxbb support via live chat or email, the content of those communications is collected and retained as part of your support history.
• Third-Party Sources: Where permitted by law and operationally necessary, xxbb may receive supplementary identity verification data from licensed third-party identity verification providers engaged to support the KYC process.

5 How We Use Your Personal Data

xxbb processes your personal data only for specific, legitimate purposes. The following table maps each purpose to the data categories used and the legal basis for processing:

xxbb does not use personal data for automated individual decision-making that produces legal or similarly significant effects on members — except where such automated processing is expressly part of a legally mandated compliance process (such as AMLA threshold monitoring), in which case you retain the right to request human review.

6 Legal Basis for Processing

Under the Data Privacy Act of 2012, xxbb processes personal information on the following legal bases:

1. Contractual Necessity: Processing required to perform the contract with you — i.e., operating your xxbb account, processing deposits and withdrawals, and providing gaming services. This is the primary legal basis for the majority of xxbb's data processing activities.
2. Legal Obligation: Processing necessary to comply with xxbb's legal obligations under Philippine law, including the Anti-Money Laundering Act, PAGCOR regulations, and the Data Privacy Act itself. This includes KYC verification, transaction monitoring, and regulatory reporting.
3. Legitimate Interests: Processing necessary for xxbb's legitimate interests — including fraud prevention, platform security, responsible gaming monitoring, and improving Platform quality — where those interests are not overridden by your rights and interests as a data subject.
4. Consent: Where processing is based on your consent — specifically for marketing communications and optional analytics — you have the right to withdraw that consent at any time by updating your notification preferences in your xxbb account settings. Withdrawal of consent does not affect the lawfulness of processing conducted before the withdrawal.

7 Sharing Your Personal Data

xxbb does not sell, rent, or trade your personal information to third-party marketers. xxbb shares personal data with external parties only in the following limited and controlled circumstances:

• Payment Processors: GCash (G-Xchange, Inc.), PayMaya (PayMaya Philippines, Inc.), BPI, BDO, Metrobank, Visa, and Mastercard receive transaction reference data necessary to process your deposits and withdrawals. Each payment processor operates under its own privacy policy and data protection obligations.
• KYC & Identity Verification Providers: Licensed third-party KYC technology providers process identity document images and biometric matching data strictly for the purpose of verifying your identity and age as required by Philippine regulations. These providers are contractually bound to use your data solely for this purpose.
• Game Technology Providers: Third-party game studios and live dealer operators that supply games to the xxbb platform may receive session-level game data (session ID, stake amounts, outcomes) necessary for game operation and dispute resolution. These providers do not receive your personal identity data unless required by a specific regulatory dispute process.
• Regulatory Authorities: xxbb is required by law to share relevant transaction and identity data with the Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies upon lawful request or pursuant to a court order.
• Professional Advisors: xxbb's legal counsel, external auditors, and accountants may access personal data to the minimum extent necessary for the provision of professional services, subject to professional confidentiality obligations.

8 Third-Party Service Providers

xxbb engages third-party service providers that may process personal data on xxbb's behalf as Personal Information Processors (PIPs) under the DPA. All PIPs engaged by xxbb are required to:

1. Process personal data only in accordance with documented instructions from xxbb;
2. Implement appropriate technical and organizational security measures meeting at minimum the standards set out in NPC Circular 16-03;
3. Not engage sub-processors without xxbb's prior written authorization;
4. Provide reasonable assistance to xxbb in fulfilling data subject rights requests;
5. Return or securely destroy personal data upon termination of the service relationship, as instructed by xxbb.

Third-party providers engaged by xxbb include categories such as: cloud hosting and infrastructure services, analytics and platform monitoring tools, customer support software platforms, email and SMS communication services, and security and fraud monitoring systems. xxbb maintains an internal register of all active PIPs.

9 Cookies & Tracking Technologies

xxbb uses cookies and similar tracking technologies to operate the Platform effectively and improve the member experience. The following categories of cookies are used:

xxbb does not use third-party advertising or retargeting cookies. You will not be tracked by xxbb's Platform for the purpose of displaying external advertisements on other websites. You may configure cookie preferences for optional categories through your browser settings or xxbb's cookie consent interface.

10 Data Retention

xxbb retains personal data only for as long as is necessary to fulfill the purposes for which it was collected and to comply with applicable Philippine legal and regulatory requirements. The following retention schedule applies:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with NPC-approved data disposal procedures. Data that has been fully anonymized (such that the individual cannot be re-identified) may be retained for statistical and research purposes beyond these periods.

11 Security Measures

xxbb implements comprehensive technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and xxbb servers is protected using TLS 1.3 with AES-256 encryption. The xxbb Platform is accessible exclusively over HTTPS.
• Encryption at Rest: Personal data stored in xxbb databases — including KYC documents and financial records — is encrypted at rest using AES-256 encryption with key management procedures consistent with ISO 27001 standards.
• Access Controls: Access to personal data within xxbb's systems is governed by a role-based access control (RBAC) policy. Team members are granted access only to the data categories necessary for their specific function. Access logs are maintained and reviewed regularly.
• Network Security: xxbb's infrastructure is protected by firewalls, intrusion detection systems, and regular penetration testing conducted by qualified external security professionals.
• Incident Response: xxbb maintains a documented data breach response plan. In the event of a personal data breach that poses a real risk to your rights and freedoms, xxbb will notify the National Privacy Commission within 72 hours of discovery and will notify affected members without undue delay, in accordance with NPC Circular 16-03 and NPC Advisory 2021-01.
• Employee Training: All xxbb team members with access to personal data receive mandatory data privacy training upon onboarding and annually thereafter.

12 Your Data Subject Rights

Under the Data Privacy Act of 2012, xxbb members have the following rights with respect to their personal data. These rights are not theoretical — they are exercisable by submitting a data subject rights request through the contact channel in Section 16.

1. Right to Be Informed: The right to be notified of how your personal data is being collected and processed. This Policy fulfills that obligation.
2. Right to Access: The right to obtain a copy of your personal data held by xxbb, along with information about how it is used. xxbb will respond to access requests within fifteen (15) business days of receipt.
3. Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update certain personal information directly from your xxbb account settings. Corrections to identity documents require a formal request with supporting documentation.
4. Right to Erasure (Right to be Forgotten): The right to request deletion of your personal data. This right is subject to xxbb's legal retention obligations — data that must be retained for AMLA or PAGCOR compliance purposes cannot be deleted until the mandatory retention period expires, but data not subject to legal retention obligations will be deleted promptly upon a valid erasure request.
5. Right to Object: The right to object to specific processing activities, including processing for direct marketing purposes. Where processing is based on consent, you may withdraw that consent at any time.
6. Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another platform where technically feasible.
7. Right to Damages: The right to be compensated for damages suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data by xxbb.
8. Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

13 Minors & Age Policy

xxbb strictly prohibits the registration and use of Platform services by individuals under twenty-one (21) years of age, consistent with PAGCOR regulations governing online gaming in the Philippines. xxbb does not knowingly collect personal data from individuals under 21.

In the event that xxbb discovers, through KYC verification or other means, that a registered account belongs to an individual under 21 years of age, xxbb will immediately:

1. Permanently close the account;
2. Void all pending bets and cancel all active bonuses;
3. Handle any remaining account balance in accordance with PAGCOR requirements;
4. Delete or securely quarantine all personal data collected in connection with the underage account, subject to any mandatory retention obligations arising from regulatory reporting requirements; and
5. Where legally required, report the incident to relevant Philippine authorities.

If you are a parent or guardian and believe that a person under 21 has registered a xxbb account using their identity or your payment methods, please contact xxbb support immediately through the channel in Section 16. xxbb will investigate and act promptly.

14 Cross-Border Data Transfers

xxbb's primary data processing infrastructure is located within the Philippines. Where xxbb engages third-party service providers — such as cloud infrastructure providers, game technology platforms, or KYC technology vendors — whose systems are located outside the Philippines, personal data may be transferred to those offshore systems.

Any transfer of personal data outside the Philippines is subject to the following safeguards, consistent with Section 21 of the Data Privacy Act and NPC guidelines on cross-border data flows:

• The receiving jurisdiction provides an adequate level of data protection, as assessed by the NPC; or
• xxbb has entered into a binding data transfer agreement with the receiving entity that incorporates the standard contractual clauses approved by the NPC; or
• The transfer is necessary for the performance of the contract between xxbb and the data subject (e.g., processing a payment through a global card network).

xxbb does not transfer personal data to jurisdictions that are known to lack adequate data protection frameworks unless one of the above safeguards is in place. A list of countries to which xxbb may transfer data, and the applicable safeguards, is available on request from the xxbb Data Protection Officer.

15 Amendments to This Policy

xxbb may update this Privacy Policy from time to time to reflect changes in its data processing practices, legal obligations, or the structure of the Platform. The updated Policy will be published at xxbb.vu/privacy-policy with a revised effective date.

Where amendments are material — meaning they significantly change how xxbb uses your personal data or affect your rights as a data subject — xxbb will notify you in advance by email to your registered xxbb account address, providing at least fourteen (14) days' notice before the new Policy takes effect for existing members.

For non-material clarifications and administrative updates, the revised Policy will be published with an updated date and no separate notification will be issued. We encourage you to review this page periodically so you remain informed about xxbb's current privacy practices.

16 Contact & Complaints

For data privacy inquiries, data subject rights requests, or to contact the xxbb Data Protection Officer, please use the following channel:

If you are not satisfied with xxbb's response to your privacy concern, you have the right to escalate your complaint directly to the National Privacy Commission of the Philippines. The NPC's contact details and online complaint filing process are available on the NPC's official website. xxbb cooperates fully with NPC investigations.

For account-related questions not specifically related to data privacy, xxbb's general support team is available 24/7 via live chat on the Platform. Filipino-language support agents are available for members who prefer to communicate in Filipino or regional Philippine languages.