kbs99 Privacy Policy

This Privacy Policy ("Policy") describes how kbs99 ("we", "us", "our", or "the Platform") collects, uses, stores, discloses, and protects the personal information of individuals ("you", "your", "Player") who access or use the kbs99 online gaming platform at kbs99.cam.

kbs99 is committed to protecting the privacy and personal data of all Filipino players on the platform. We operate in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines (the "DPA"), and its Implementing Rules and Regulations issued by the National Privacy Commission ("NPC"). Where applicable, we also observe the data protection principles recognised by the relevant gaming regulations administered by PAGCOR.

By registering for a kbs99 account and using the platform, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree with this Policy, you should not use the kbs99 platform.

For the purposes of the Data Privacy Act of 2012 and this Policy, kbs99 acts as the personal information controller ("PIC") in respect of the personal data it collects from Players. As PIC, kbs99 determines the purposes for which and the means by which personal data is processed on the kbs99 platform.

kbs99 has designated a Data Protection Officer ("DPO") responsible for overseeing data protection matters and ensuring the platform's compliance with the DPA and applicable NPC issuances. The DPO is the primary point of contact for all data privacy-related enquiries, requests, and complaints from Players.

If you have any questions, concerns, or requests relating to the processing of your personal data by kbs99, you may contact the Data Protection Officer at the address set out in Section 15 of this Policy.

kbs99 collects only the personal data necessary to operate the platform, comply with regulatory obligations, and provide a safe and personalised gaming experience to Filipino players. The categories of personal data we collect are set out in the table below:

kbs99 collects personal data through the following channels and mechanisms:

Direct Collection

• Account Registration: When you create a kbs99 account, you provide your mobile number, email address, date of birth, and city of residence.
• KYC Verification: When you submit identity documents for KYC verification prior to your first withdrawal, we collect government ID images and selfie photographs.
• Payment Transactions: When you make a deposit or withdrawal, your payment account reference (GCash number, bank account details) is collected and linked to your kbs99 account.
• Support Interactions: When you contact kbs99 via live chat or email, the content of your communications is collected and retained as part of your account record.
• Surveys and Feedback: When you participate in optional player surveys or submit feedback through the kbs99 platform.

Automated Collection

When you access the kbs99 platform, we automatically collect technical data including your IP address, device type, browser, and session information through server logs and cookies. This data is collected to ensure platform security, detect fraud, and improve the user experience. See Section 10 for detailed information on kbs99's use of cookies.

Third-Party Sources

In certain circumstances, kbs99 may receive personal data about you from third-party sources, including payment service providers (GCash, PayMaya, BPI, BDO, Metrobank, UnionBank) who confirm transaction status and payment account ownership, and fraud prevention and identity verification service providers used in the KYC process. kbs99 uses such third-party data only for the purposes described in this Policy and in compliance with the DPA.

kbs99 processes your personal data for the following specific purposes:

• Account Administration: To create, maintain, and manage your kbs99 player account, verify your identity, and authenticate your access to the platform.
• Service Delivery: To provide you with access to kbs99's games, sportsbook, live dealer tables, bingo rooms, WM Live, Monster Plinko, and all other platform features.
• Payment Processing: To process deposits, credit your wallet, and process withdrawal requests to your registered GCash, PayMaya, or bank account.
• Regulatory Compliance: To fulfil kbs99's obligations under applicable Philippine gaming regulations administered by PAGCOR, including age verification, Know Your Customer (KYC), Anti-Money Laundering (AML), and responsible gaming compliance requirements.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-account abuse, bonus fraud, and unauthorised account access.
• Responsible Gaming: To implement and monitor player-requested responsible gaming tools including deposit limits, session controls, loss limits, and self-exclusion, and to identify patterns of play that may indicate problem gambling requiring intervention.
• Customer Support: To respond to your enquiries, resolve disputes, process complaints, and provide assistance through our 24/7 support channels.
• Platform Improvement: To analyse aggregate and anonymised usage data to improve platform performance, game selection, user experience, and payment processing.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates where you have provided consent to receive such communications. You may withdraw this consent at any time through your account settings or by contacting [email protected].

Under the Data Privacy Act of 2012, kbs99 processes your personal data on the following legal bases:

• Contractual Necessity: Processing that is necessary for the performance of the contract between kbs99 and the Player — including account creation, gameplay, payment processing, and KYC verification — is based on contractual necessity.
• Legal Obligation: Processing required by applicable Philippine law and PAGCOR regulations — including AML reporting, age verification, and responsible gaming monitoring — is based on kbs99's legal obligations.
• Legitimate Interests: Processing for fraud prevention, platform security, and aggregate analytics is based on kbs99's legitimate interests in operating a secure and compliant gaming platform, where such interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications and optional profiling is based on your freely given, specific, and informed consent. You may withdraw this consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

kbs99 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share personal data only in the following limited circumstances:

• Payment Service Providers: kbs99 shares transaction data with GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank solely to the extent necessary to process your deposit and withdrawal transactions.
• KYC and Fraud Prevention Providers: kbs99 uses third-party identity verification and fraud detection services to fulfil our KYC obligations. These providers act as personal information processors under the DPA and are contractually bound to process data solely on kbs99's instructions.
• Game Software Providers: kbs99's game library is supplied by third-party studios (including Pragmatic Play, PG Soft, WM Gaming, and others). These providers may receive technical session data necessary to deliver games but do not receive personally identifiable information about individual Players.
• Regulatory Authorities: kbs99 is required by law to disclose certain information to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other relevant Philippine regulatory bodies in response to lawful requests, orders, or mandatory reporting obligations.
• Law Enforcement: Where required by a court order, subpoena, or lawful request from Philippine law enforcement authorities, kbs99 will disclose personal data to the extent legally mandated.
• Business Transfers: In the event of a merger, acquisition, or sale of the kbs99 business or platform assets, your personal data may be transferred to the acquiring entity, provided that the acquiring entity assumes the same privacy obligations set out in this Policy.

kbs99 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or for as long as required by applicable Philippine law and PAGCOR regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, kbs99 will securely delete or anonymise your personal data in accordance with industry-standard data destruction procedures. Anonymised and aggregated data from which individual identity cannot be reconstructed may be retained indefinitely for statistical and platform improvement purposes.

kbs99 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All data transmitted between your device and kbs99's servers is encrypted using Transport Layer Security (TLS) 1.3. Stored personal data is encrypted at rest using AES-256 encryption. Passwords are stored using industry-standard one-way cryptographic hashing and are never stored in plain text.
• Access Controls: Access to systems containing personal data is restricted to kbs99 personnel who require access for their authorised job functions. All internal access is controlled through role-based access permissions, and access logs are maintained and audited regularly.
• Two-Factor Authentication: kbs99 player accounts are protected by OTP-based two-factor authentication for high-risk actions including withdrawals, password changes, and new device login, reducing the risk of unauthorised account access.
• Fraud Monitoring: kbs99 operates continuous automated monitoring systems that detect and flag unusual account activity, suspicious login patterns, and anomalous transaction behaviour for investigation.
• Data Minimisation: kbs99 collects only the minimum personal data required for each processing purpose and ensures that data access within the organisation is limited to the specific data sets required for each team's function.
• Incident Response: kbs99 maintains a documented data breach response procedure. In the event of a personal data breach that is likely to result in risks to your rights and freedoms, kbs99 will notify the National Privacy Commission and affected Players in accordance with the timeframes required under the DPA.

While kbs99 implements robust security measures, no online platform can guarantee absolute security. Players are encouraged to use strong, unique passwords for their kbs99 accounts, enable two-factor authentication, and report any suspected unauthorised access to their account to kbs99 support immediately.

kbs99 uses cookies and similar tracking technologies on the kbs99 platform to support platform functionality, improve user experience, and maintain account security. The types of cookies used by kbs99 are described below:

• Strictly Necessary Cookies: These cookies are essential for the kbs99 platform to function and cannot be disabled. They include session authentication cookies that maintain your logged-in state during an active kbs99 session, and security cookies that support fraud prevention measures. No personal data is shared with third parties through strictly necessary cookies.
• Functional Cookies: These cookies remember your platform preferences — such as your preferred language, game lobby display settings, and responsible gaming reminder frequency — and enable personalised features. Functional cookies are set by kbs99 and are not shared with third parties.
• Analytical Cookies: kbs99 uses anonymised analytical data to understand how Players interact with the platform, which game categories are most popular, and where users experience friction in payment flows. Analytical data is processed in aggregated, non-identifiable form and is used solely for internal platform improvement purposes.
• Security Cookies: Device fingerprinting and session token cookies are used to detect and prevent unauthorised access, multi-account creation, and automated bot activity on the kbs99 platform.

You may configure your browser to block or delete cookies. Please note that disabling strictly necessary cookies will prevent the kbs99 platform from functioning correctly and you will not be able to maintain an active login session. Instructions for managing cookies vary by browser — consult your browser's help documentation for guidance.

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by kbs99. These rights may be exercised by submitting a written request to the kbs99 Data Protection Officer at the contact details set out in Section 15.

kbs99 will respond to data privacy rights requests within fifteen (15) business days of receipt. Where the complexity of the request requires additional time, kbs99 will notify you within the initial 15-day period and provide an updated response timeline not exceeding an additional thirty (30) business days.

kbs99 may request proof of identity before processing a data privacy rights request to ensure that personal data is not disclosed to or modified by an unauthorised third party.

The kbs99 platform is strictly for individuals aged 21 years and above in compliance with Philippine gaming law and PAGCOR regulations. kbs99 does not knowingly collect, use, or retain personal data from individuals under the age of 21.

If kbs99 discovers or is informed that personal data has been collected from a person under 21, it will immediately suspend the relevant account, delete the associated personal data to the extent not required to be retained by applicable regulatory obligations, and report the matter to the relevant regulatory authority where required.

Some of the third-party service providers used by kbs99 — including game software providers and fraud prevention services — may process personal data on servers located outside the Philippines. Where personal data is transferred to a third party located outside the Philippines, kbs99 ensures that:

• The recipient country provides an adequate level of data protection as determined by the National Privacy Commission; or
• Appropriate safeguards are in place, such as contractual data processing agreements with the recipient that impose data protection obligations equivalent to those applicable under Philippine law; or
• The transfer is necessary for the performance of a contract between kbs99 and the Player (e.g., processing a payment through an international payment provider).

kbs99 does not transfer personal data internationally for its own commercial benefit or share Philippine player data with unrelated overseas entities. All cross-border data flows are limited to what is strictly necessary for the technical delivery of the kbs99 platform and its payment infrastructure.

kbs99 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine law, NPC issuances, PAGCOR regulations, or kbs99's data processing practices.

For material changes — including changes to the categories of data collected, the purposes for which data is used, or the third parties with whom data is shared — kbs99 will provide advance notice to Players via their registered email address or through a prominent in-platform notification at least seven (7) days before the change takes effect.

For non-material changes — such as corrections of typographical errors, clarifications of existing language, or updates to contact information — the updated Policy will be published on this page with an updated effective date, and Players will not receive individual notification.

The current version of this Privacy Policy is always accessible at kbs99.cam/privacy-policy. The effective date displayed at the top of this page indicates when the current version entered into force.

If you have any questions about this Privacy Policy, wish to exercise your data privacy rights, or have a concern about kbs99's data processing practices, please contact the kbs99 Data Protection Officer through the following channels:

• Email (Data Privacy Matters): [email protected] — please include "Privacy Request" or "Data Privacy Complaint" in the subject line to ensure your enquiry is directed to the DPO promptly.
• Live Chat: Available 24/7 through your logged-in kbs99 account. For data privacy requests, ask to be connected to the Data Protection team.

kbs99 will acknowledge your enquiry within two (2) business days and provide a substantive response within fifteen (15) business days. Complex requests may require additional time, in which case kbs99 will notify you of the extended timeline within the initial 15-day period.

If you are not satisfied with kbs99's response to a data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). Information about the NPC's complaints process is available through the NPC's official channels.