by888 Privacy Policy

1. Who We Are — Data Controller

For the purposes of the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations, by888 is the personal information controller in respect of the personal data collected from Players and visitors through the by888 Platform at by888.one.

by888 operates as a Philippines-focused online gaming platform offering live sabong, slots, bingo, live dealer casino games, and sports betting services to Filipino players aged 21 and above.

If you have questions about this Privacy Policy or wish to exercise your data subject rights, please contact the by888 Data Privacy Officer (DPO) as set out in Section 14 of this Policy.

2. Personal Data We Collect

by888 collects the following categories of personal data from Players and visitors:

2.1 Identity and Contact Data

• Full legal name as it appears on a valid Philippine government-issued ID;
• Date of birth (for age verification — by888 is strictly 21+ only);
• Gender;
• Residential address (barangay, city/municipality, province, ZIP code);
• Philippine mobile number;
• Email address;
• Government-issued ID type and number (submitted for KYC verification).

2.2 Account and Financial Data

• by888 username and hashed password;
• Wallet balance and transaction history (deposits, withdrawals, and bet history in PHP);
• GCash number or PayMaya number used for deposits and withdrawals;
• Bank account details where bank transfer is used as a payment method (BDO, BPI, Metrobank, etc.);
• Bonus and promotional activity records.

2.3 Technical and Usage Data

• IP address and approximate geolocation at the time of login;
• Device type, operating system, browser type and version;
• Session duration, pages visited, game sessions played, and interaction logs;
• Cookies and similar tracking data (see Section 7).

2.4 Communications Data

• Records of support interactions via live chat, email, or any other channel;
• Player-submitted feedback, complaints, and dispute records.

3. How We Collect Your Data

by888 collects personal data through the following means:

• Direct submission: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically when you access and use the by888 Platform, via cookies, server logs, and analytics tools;
• Third-party verification services: Identity and age verification data obtained through Philippine government ID verification providers engaged by by888 for KYC compliance;
• Payment providers: Transaction confirmation data received from GCash, PayMaya, banks, and other payment processors when you fund or withdraw from your by888 Wallet.

4. How We Use Your Personal Data

by888 uses the personal data it collects for the following purposes:

• Account management: To create, maintain, and administer your by888 account, including processing logins, managing your Wallet, and applying bonuses;
• Identity and age verification (KYC): To verify that you are who you say you are and that you are 21 years of age or older, as required by by888 policy and applicable Philippine gaming regulations;
• Transaction processing: To process deposits, withdrawals, and bet settlements in Philippine Peso via GCash, PayMaya, and other supported payment channels;
• Regulatory compliance: To comply with obligations under Philippine gaming law, anti-money laundering (AMLA) regulations, and PAGCOR requirements, including transaction monitoring and reporting;
• Customer support: To respond to your queries, resolve disputes, and process complaints;
• Platform security and fraud prevention: To detect, investigate, and prevent fraudulent activity, unauthorized access, bonus abuse, and other prohibited conduct;
• Responsible gaming: To monitor for indicators of problem gambling behaviour and to administer deposit limits, loss limits, and self-exclusion requests;
• Platform improvement: To analyse usage patterns and player feedback to improve the by888 Platform, game selection, and user experience;
• Marketing communications: To send you promotions, bonus offers, and platform updates where you have consented to receive such communications. You may withdraw consent at any time via your account settings or by contacting by888 support.

5. Legal Basis for Processing

by888 processes your personal data on the following legal bases as recognised under RA 10173 and its IRR:

• Contractual necessity: Processing required to perform the contract between you and by888 (i.e., your use of the Platform under the Terms and Conditions);
• Legal obligation: Processing required to comply with applicable Philippine law, including AMLA, gaming regulations, and PAGCOR directives;
• Legitimate interests: Processing necessary for by888's legitimate interests in operating a secure, fair, and commercially viable gaming platform, where such interests are not overridden by your data protection rights;
• Consent: Processing for direct marketing communications, where you have provided clear, specific, and freely given consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. Data Sharing and Disclosure

by888 does not sell your personal data to third parties. by888 may share your data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Game providers and technology partners: Game studios and software providers whose games are available on by888 receive limited technical data necessary to deliver gameplay;
• Payment processors: GCash, PayMaya, banks, and other payment providers receive the financial data necessary to process your transactions;
• KYC and identity verification providers: Third-party verification services engaged to validate government-issued IDs under KYC obligations;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities where disclosure is required by law or regulatory directive;
• Professional advisers: Legal, audit, and compliance advisers engaged by by888 under appropriate confidentiality obligations.

7. Cookies and Tracking Technologies

The by888 Platform uses cookies and similar technologies to operate correctly and to improve the user experience. The following types of cookies are used:

• Essential cookies: Required for the Platform to function — including session management, login state, and Wallet operations. These cannot be disabled without breaking core Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised information about how Players use the by888 Platform — including pages visited, game sessions, and session duration. This data helps by888 identify areas for improvement.
• Preference cookies: Store your language and display preferences to improve your experience on return visits.
• Security cookies: Used to detect and prevent fraudulent access attempts, including CSRF protection tokens and bot detection signals.

You can manage your cookie preferences through your browser settings. Note that disabling essential cookies will impair your ability to use the by888 Platform.

8. Data Retention

by888 retains personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following minimum retention periods:

• Account registration and KYC data: retained for a minimum of five (5) years from account closure, as required by Philippine AMLA regulations;
• Transaction records (deposits, withdrawals, bet history): retained for a minimum of five (5) years from the date of the transaction;
• Support and dispute communications: retained for three (3) years from the date of resolution;
• Marketing consent records: retained for the duration of consent plus three (3) years;
• Technical and usage logs: retained for a rolling period of twelve (12) months.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with by888's data disposal procedures.

9. Data Security

by888 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and by888 servers;
• Industry-standard one-way hashing with salt for stored passwords — by888 does not store or have access to your plaintext password;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular security audits and vulnerability assessments of the by888 Platform;
• KYC data storage in an isolated, access-controlled environment separate from general platform databases.

Notwithstanding these measures, no internet-based platform can guarantee absolute security. In the event of a personal data breach affecting your rights and freedoms, by888 will notify affected Players and the National Privacy Commission as required by RA 10173 and NPC Circular No. 16-03.

10. Your Data Subject Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in respect of your personal data held by by888:

To exercise any of the above rights, contact the by888 Data Privacy Officer as described in Section 14. by888 will respond to data subject requests within fifteen (15) business days of receipt.

11. Minors — Strict 21+ Policy

Age verification is enforced through KYC identity checks prior to withdrawal processing. If you believe a minor has registered an account on by888, please contact by888 support immediately.

12. Cross-Border Data Transfers

Some of by888's technology partners and service providers may process personal data outside the Republic of the Philippines. Where such transfers occur, by888 ensures that appropriate safeguards are in place — including contractual data protection clauses that meet or exceed the standards required by RA 10173 — to ensure that your data receives a comparable level of protection regardless of where it is processed.

by888 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without implementing appropriate supplementary measures.

13. Updates to This Privacy Policy

by888 may update this Privacy Policy from time to time to reflect changes in applicable law, by888's data processing practices, or the Platform's features and services. The "Last Updated" date at the top of this page will be revised when material changes are made.

Where changes are material, by888 will notify registered Players via the email address on their Account. Your continued use of the by888 Platform after the updated Policy's effective date constitutes acceptance of the revised terms. If you do not agree to the revised Policy, you should discontinue use of the Platform and may close your Account in accordance with the Terms and Conditions.

14. Contact and Data Privacy Officer

• Email: [email protected] — Subject line: "Data Privacy Request"
• Live Chat: Available 24/7 on the by888 Platform — indicate "Data Privacy" at the start of your chat
• Response Time: Within 15 business days for formal data subject requests; within 4 hours for general privacy inquiries via email

You also have the right to escalate unresolved privacy concerns to the National Privacy Commission of the Philippines at privacy.gov.ph.