bm555 Privacy Policy — How We Handle Your Personal Information

This Privacy Policy ("Policy") is issued by bm555 ("bm555," "we," "us," or "our") and applies to all personal data collected, processed, stored, and used in connection with your registration and use of the bm555 online gaming platform ("Platform"), accessible at bm555.org.

This Policy applies to all individuals who interact with the bm555 Platform in any capacity — including registered Members, prospective registrants who have partially completed the registration process, and visitors who browse the Platform without registering. It covers all personal data processed across all bm555 digital touchpoints, including the website, mobile browser interface, and progressive web application.

This Policy does not apply to third-party websites, payment processors, or service providers linked to or from the bm555 Platform. Those entities operate their own independent privacy policies, and bm555 is not responsible for their data practices. Where bm555 shares your data with third parties as described in this Policy, we do so under data processing agreements that impose equivalent protections on the receiving party.

By registering a bm555 account or continuing to use the Platform after this Policy has been made available to you, you acknowledge that you have read and understood its contents and consent to the processing of your personal data as described herein.

For the purposes of the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, the data controller responsible for the personal data of bm555 Members is:

bm555 has appointed a Data Protection Officer ("DPO") in accordance with the requirements of the National Privacy Commission. The DPO is responsible for overseeing bm555's compliance with applicable data protection law, managing data subject requests, and serving as the primary point of contact for the National Privacy Commission.

bm555 collects the following categories of personal data from Members and Platform users:

bm555 does not seek to collect special categories of personal data (as defined under Philippine data protection law, including data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except where strictly required by applicable AML regulations or responsible gaming obligations — for example, where a Member voluntarily discloses health information in the context of a self-exclusion or responsible gaming request. Such data is processed solely for the stated purpose and is not used for any other commercial or analytical purpose.

bm555 collects personal data through the following channels and mechanisms:

• Direct registration: Information you voluntarily provide during account registration, including your name, date of birth, mobile number, and chosen credentials;
• KYC submission: Identity documents and selfie verification images submitted through the Platform's KYC workflow;
• Payment processing: Financial details provided during deposit and withdrawal transactions, shared with bm555 by payment service providers in accordance with their own privacy policies;
• Platform usage: Automatically generated data arising from your activity on the Platform, including game session data, click behaviour, and navigation patterns, collected via server logs and first-party analytics tools;
• Cookies and similar technologies: Data collected through session cookies, persistent cookies, and local storage mechanisms as described in Section 11 of this Policy;
• Support interactions: Information you provide when contacting bm555 via live chat, email, or telephone, including account details and the content of your inquiry;
• Third-party identity verification services: Supplementary identity verification data obtained from licensed third-party KYC and AML screening providers in accordance with Philippine regulatory requirements.

bm555 processes your personal data only where there is a lawful basis for doing so under the Data Privacy Act of 2012. The primary legal bases applicable to bm555's processing activities are: (a) performance of a contract (processing necessary to provide the Platform and gaming services you have registered for); (b) compliance with a legal obligation (processing required by Philippine law, including PAGCOR regulatory requirements and AMLC obligations); and (c) legitimate interests (processing necessary for bm555's legitimate business interests, where those interests are not overridden by your privacy rights); and (d) your consent (for marketing communications and non-essential cookie processing).

bm555 may share your personal data with the following categories of third parties in the circumstances described:

• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors receive transaction data necessary to execute your deposit and withdrawal instructions. These providers operate under independent privacy policies and are bound by Philippine BSP regulations;
• KYC and AML screening providers: Licensed third-party identity verification and watchlist screening services receive identity data to support bm555's compliance with Philippine KYC and AML obligations;
• Game software providers: Third-party game providers (including Pragmatic Play, JILI, CQ9, and others) may receive pseudonymised session data necessary to operate their games on the Platform. These providers do not receive your name, contact details, or financial data;
• IT infrastructure and cloud service providers: Technical service providers hosting bm555's servers and providing database, security, and monitoring services may process your data as data processors acting under bm555's instructions and bound by data processing agreements;
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, courts of competent jurisdiction, and other government agencies where disclosure is required by law or court order;
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by bm555, subject to confidentiality obligations.

Some of bm555's third-party service providers — particularly game software providers, cloud infrastructure providers, and certain KYC technology vendors — may be located outside the Philippines. Where personal data is transferred to a recipient in a country that does not provide an equivalent level of data protection to the Philippines, bm555 takes appropriate safeguards to protect that data, including:

• Executing data transfer agreements with receiving parties that incorporate standard contractual clauses consistent with the requirements of the National Privacy Commission;
• Conducting due diligence assessments of third-party recipients' data security practices prior to initiating any transfer;
• Limiting transferred data to the minimum necessary for the specific operational purpose.

You may request information about the specific safeguards applicable to any international transfer of your data by contacting bm555's Data Protection Officer at the contact details provided in Section 16.

bm555 implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include, without limitation:

• Encryption in transit: All data transmitted between your device and bm555 servers is protected by TLS 1.3 encryption, preventing interception by third parties on the network path;
• Encryption at rest: Sensitive personal data stored in bm555 databases is encrypted at rest using industry-standard AES-256 encryption;
• Password security: Member account passwords are stored using bcrypt hashing with per-record salting. Plain-text passwords are never stored or transmitted;
• Access controls: Access to personal data within bm555's internal systems is restricted on a need-to-know basis, with role-based access controls and multi-factor authentication required for all staff with data access;
• Security monitoring: bm555 operates continuous security monitoring of its Platform infrastructure, with automated detection of anomalous access patterns and incident response procedures;
• Penetration testing: Regular third-party security assessments and penetration tests are conducted to identify and remediate vulnerabilities;
• Staff training: All bm555 staff with access to personal data receive mandatory data privacy and security training at onboarding and annually thereafter.

Despite these measures, no data transmission over the internet or electronic storage system is completely impenetrable. In the event of a data security incident affecting your personal data, bm555 will notify affected Members and the National Privacy Commission in accordance with the obligations imposed by the Data Privacy Act and the NPC's breach notification guidelines.

bm555 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with the NPC's data disposal guidelines. Anonymised data — from which all identifying information has been irreversibly removed — may be retained indefinitely for aggregate statistical analysis.

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in respect of your personal data held by bm555:

• Right to be Informed: The right to know whether bm555 processes your personal data, what data is processed, and the purposes for which it is processed — as provided in this Policy;
• Right to Access: The right to obtain a copy of the personal data bm555 holds about you, together with information about how it is processed. Subject to identity verification and reasonable fees for repetitive or manifestly unfounded requests;
• Right to Rectification: The right to request correction of inaccurate, incomplete, or outdated personal data held by bm555. You may also update certain data directly through your account settings;
• Right to Erasure / Blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful. Note that this right is subject to bm555's legal retention obligations under AMLC and PAGCOR regulations;
• Right to Object: The right to object to bm555's processing of your personal data on grounds of legitimate interests, including processing for direct marketing purposes. Objection to marketing can be exercised at any time at no cost;
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request transfer of that data to another controller where technically feasible;
• Right to Damages: The right to claim compensation for damages sustained as a result of bm555's violation of the Data Privacy Act in relation to your personal data;
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission if you believe bm555 has violated your data privacy rights. The NPC's complaint procedures are available through official Philippine government channels.

bm555 uses cookies and similar tracking technologies on its Platform. Cookies are small text files stored on your device that help the Platform recognise your session, maintain your login state, and deliver a personalised experience.

• Strictly Necessary Cookies: Required for core Platform functionality, including session management, login authentication, and security features. These cookies cannot be disabled without materially impairing Platform functionality. They do not require your consent;
• Functional Cookies: Enable the Platform to remember your preferences (such as language settings, display preferences, and responsible gaming tool configurations). Disable these and the Platform will function but may not remember your settings between sessions;
• Analytics Cookies: First-party analytics cookies that collect aggregate, anonymised data about how Members use the Platform — which pages are most visited, where navigation errors occur, and how features are used. This data is used solely to improve the Platform and is not linked to individual identity. Subject to your consent;
• Marketing Cookies: bm555 does not currently deploy third-party advertising or retargeting cookies. If this changes, this Policy will be updated and your consent obtained prior to deployment.

You may control cookies through your browser settings. Most modern browsers allow you to block, delete, or receive notifications about cookies. Note that disabling strictly necessary cookies may prevent you from logging in to your bm555 account or using certain Platform features. bm555 does not currently operate a cookie preference centre, but non-essential cookies may be declined at the point of consent collection when you first visit the Platform.

Age verification is conducted as part of the mandatory KYC process for all bm555 accounts. Government-issued identity documents confirming date of birth are required before any account may access withdrawal functionality. If you are a parent or guardian and believe your child has registered a bm555 account, please contact the Data Protection Officer immediately at the contact details provided in Section 16, providing the registered mobile number or email address associated with the account.

As an operator subject to Philippine anti-money laundering regulations, bm555 is legally required to collect, retain, and in certain circumstances report Member data to the Anti-Money Laundering Council (AMLC) in accordance with Republic Act No. 9160, as amended by RA 10167, RA 10365, and the Anti-Terrorism Act of 2020.

AML-related processing activities include: collection of KYC documentation; transaction monitoring for suspicious patterns; screening of Members against domestic and international watchlists; retention of transaction records for the legally mandated minimum period; and filing of covered transaction reports and suspicious transaction reports with the AMLC where threshold amounts or suspicious indicators are identified.

bm555 is legally prohibited from notifying Members who are the subject of a filed suspicious transaction report that such a report has been made. This restriction is imposed by Philippine AML law and overrides any data rights requests that would require such disclosure. bm555 cannot confirm or deny the existence of any report filed with the AMLC in relation to a specific account.

With your consent, bm555 may send you promotional communications relating to bm555 offers, new game launches, sports betting events, loyalty programme updates, and other Platform news. Marketing communications are sent via SMS to your registered Philippine mobile number and/or to your registered email address, based on your stated channel preferences.

You may withdraw your consent to receive marketing communications at any time, at no cost and without effect on your account status or access to the Platform, by:

• Updating your communication preferences in your bm555 account settings;
• Replying "STOP" to any marketing SMS received from bm555;
• Clicking the unsubscribe link included in any marketing email from bm555;
• Submitting a written opt-out request to the Data Protection Officer.

Please note that transactional communications — including account security alerts, OTP messages, deposit and withdrawal confirmations, KYC status updates, and support responses — are sent regardless of your marketing communication preferences, as they are necessary for the operation of your account and cannot be disabled.

bm555 reserves the right to amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or bm555's data processing practices. Material changes to this Policy — specifically changes that affect your rights or the purposes for which your data is processed — will be communicated to registered Members via notification within the Platform or to the registered email or mobile number on file, with a minimum of 7 days' notice prior to the effective date of the changes.

The current version of this Policy, with its effective date, will always be accessible at bm555.org/privacy-policy. Where changes require the collection of fresh consent (for example, the addition of a new processing purpose not covered by your existing consent), bm555 will seek that consent separately and will not proceed with the new processing until it has been obtained.

Your continued use of the bm555 Platform following the effective date of a revised Privacy Policy constitutes your acknowledgement of the revised terms. If you do not agree with any revision, you may request account closure and withdrawal of your available balance prior to the effective date.

For any inquiry, request, or complaint relating to the processing of your personal data by bm555, please contact the bm555 Data Protection Officer:

If you are not satisfied with bm555's response to your data privacy inquiry or complaint, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012. Information on the NPC's complaint procedure is publicly available through official Philippine government channels.

bm555 takes all data privacy complaints seriously and is committed to resolving them fairly and promptly. Before escalating to the NPC, we encourage you to first allow bm555's internal complaint procedure — described in Section 10 and above — to reach a conclusion, as this is the most direct and efficient route to resolution in the majority of cases.