bay896 Privacy Policy —
How We Handle Your Personal Data

1. Introduction & Scope

This Privacy Policy ("Policy") describes how bay896 ("bay896," "we," "us," "our") collects, processes, stores, and protects personal data in connection with the bay896 online gaming platform accessible at bay896.cam ("Platform"). This Policy applies to all registered users, prospective users, and visitors of the bay896 Platform, regardless of how they access it — whether via desktop browser, mobile browser, or any other interface.

Bay896 operates within the PAGCOR regulatory framework governing online gaming in the Philippines and is fully subject to Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and all relevant issuances of the National Privacy Commission ("NPC").

This Policy should be read together with the bay896 Terms & Conditions, which form part of the complete agreement between you and bay896. Defined terms not separately defined in this Policy carry the meanings given to them in the Terms & Conditions.

2. Data Controller

Bay896 is the personal information controller responsible for the personal data collected through the Platform. For all data privacy matters, enquiries, and the exercise of data subject rights, the bay896 Data Protection Officer (DPO) may be contacted using the details set out in Section 16 of this Policy.

Bay896 has registered its data processing systems with the National Privacy Commission in accordance with NPC Registration Circular 16-01 and subsequent NPC issuances. Our data processing activities are conducted in compliance with the principles of transparency, legitimate purpose, and proportionality as required under Section 11 of the DPA.

3. Categories of Personal Data We Collect

Bay896 collects the following categories of personal data from users of the Platform:

3.1 Identity and Contact Data

• Full legal name as appearing on government-issued identification;
• Date of birth and age verification documents;
• Residential address (barangay, city/municipality, province);
• Valid Philippine mobile number (Globe, Smart, DITO, or other carriers);
• Email address;
• Government-issued ID type and reference number (e.g., Philippine passport, UMID, SSS ID, PhilHealth ID, Voter's ID, or driver's licence).

3.2 Financial and Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references;
• GCash account number or registered mobile number linked to GCash;
• PayMaya account details;
• Bank account details for BPI, BDO, Metrobank, or other Philippine bank transfers (account name, account number, bank branch);
• Payment card details (card type, last four digits, expiry — full card numbers are never stored);
• Account balance history, bonus credit records, and wagering history.

3.3 Technical and Usage Data

• IP address and approximate geographic location derived from IP;
• Device identifiers, browser type and version, operating system;
• Session timestamps, login history, and access logs;
• Game session data including wagers placed, game types, session duration, and outcomes;
• Platform feature usage and navigation patterns (collected via cookies and analytics — see Section 8).

3.4 Communications Data

• Records of customer support interactions via live chat, email, and any other support channels;
• Content of feedback, complaints, or requests submitted to bay896;
• Marketing preferences and communication opt-in or opt-out records.

4. How We Collect Your Data

Bay896 collects personal data through the following means:

• Directly from you: When you register a bay896 account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account settings;
• Automatically through Platform use: Device data, IP address, session activity, and cookie-based data are collected automatically when you access and use the bay896 Platform;
• From payment providers: GCash, PayMaya, BPI, BDO, Metrobank, and card networks may transmit transaction confirmation and account reference data to bay896 in connection with deposits and withdrawals;
• From identity verification services: Third-party KYC service providers may return identity verification status and risk signals to bay896 following document and biometric checks;
• From fraud and AML screening tools: Automated screening tools may generate risk flags or match results that are associated with your account record.

5. Legal Basis for Processing

Bay896 processes personal data only where a lawful basis exists under the DPA and its IRR. The lawful bases applicable to bay896's processing activities are set out below:

Processing Activity	Legal Basis
Account registration and management	Performance of contract (Section 12(b), DPA)
KYC identity verification	Legal obligation — PAGCOR compliance (Section 12(c), DPA)
Processing deposits and withdrawals	Performance of contract (Section 12(b), DPA)
Anti-money laundering monitoring	Legal obligation — RA 9160 as amended (Section 12(c), DPA)
Fraud detection and security	Legitimate interests of bay896 and protection of players (Section 12(f), DPA)
Customer support communications	Performance of contract; legitimate interests (Section 12(b)/(f), DPA)
Responsible gaming monitoring	Legal obligation — PAGCOR responsible gaming requirements (Section 12(c), DPA)
Direct marketing communications	Consent (Section 12(a), DPA) — subject to opt-out at any time
Analytics and platform improvement	Legitimate interests — anonymised or aggregated data (Section 12(f), DPA)

6. How We Use Your Personal Data

Bay896 uses the personal data it collects for the following specific purposes:

6.1 Account and Service Management

To create, maintain, and administer your bay896 account; to verify your identity; to process deposits and withdrawals; to credit and manage bonus balances; to maintain your VIP tier status and associated benefits; and to communicate account-related notifications including security alerts, transaction confirmations, and support responses.

6.2 Legal and Regulatory Compliance

To fulfil bay896's obligations under PAGCOR licensing requirements, including player registration records, activity reporting, responsible gaming programme implementation, and AML transaction monitoring. Bay896 may be required to retain certain records for defined periods and to produce them to regulatory authorities upon lawful request.

6.3 Security and Fraud Prevention

To detect, investigate, and prevent fraudulent activity, money laundering, duplicate account creation, bonus abuse, cheating, and any other conduct that violates the bay896 Terms & Conditions or applicable Philippine law. Session and access logs are retained specifically to support security incident investigation.

6.4 Responsible Gaming

To monitor player activity for indicators of problem gambling; to administer deposit limits, loss limits, session time limits, cooling-off periods, and self-exclusion requests; and to fulfil PAGCOR's responsible gaming compliance requirements.

6.5 Marketing and Promotions

Where you have provided consent, bay896 may use your contact details to send promotional communications including bonus offers, game launches, VIP event invitations, and platform news. You may withdraw your marketing consent at any time by updating your communication preferences in your account settings or by contacting support. Withdrawal of marketing consent does not affect the lawfulness of prior processing.

6.6 Platform Improvement

To analyse aggregated and anonymised usage data for the purpose of improving the bay896 Platform's performance, design, game offering, and user experience. Individual players are not identified in analytics reporting used for this purpose.

7. Data Sharing & Disclosure

Bay896 does not sell, rent, or trade your personal data. We share personal data only in the following strictly limited circumstances:

7.1 Service Providers and Data Processors

Bay896 engages trusted third-party service providers who process data on our behalf and under our instruction, including: payment processing platforms (GCash/PayMaya infrastructure, banking partners); KYC and identity verification service providers; IT infrastructure and cloud hosting providers; fraud detection and AML screening tools; and customer support platform providers. All processors are bound by data processing agreements that require them to maintain standards consistent with the DPA.

7.2 Regulatory and Law Enforcement Authorities

Bay896 may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, law enforcement agencies, or other government bodies where required to do so by applicable Philippine law, court order, or official regulatory request.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of bay896's assets, personal data held by bay896 may be transferred to the acquirer, subject to that party assuming the same data protection obligations contained in this Policy. Affected players will be notified via their registered contact details prior to any such transfer.

8. Cookies & Tracking Technologies

Bay896 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files placed on your device when you visit bay896.cam. The following categories of cookies are used:

8.1 Strictly Necessary Cookies

These cookies are essential for the bay896 Platform to function and cannot be disabled. They include session management cookies that maintain your logged-in state, security tokens for CSRF protection, and load-balancing cookies. No personal data beyond session identifiers is stored in strictly necessary cookies.

8.2 Functional Cookies

These cookies remember your preferences — such as your chosen language, last-visited game category, and display settings — to provide a more personalised experience on the bay896 Platform. You may disable functional cookies in your browser settings; doing so may reduce the convenience of your experience but will not prevent access to core Platform features.

8.3 Analytics Cookies

Bay896 uses first-party analytics to understand how players navigate the Platform. Data collected is aggregated and anonymised wherever possible. Analytics cookies help us identify which features are most useful, where players encounter friction, and where improvements should be prioritised. You may opt out of analytics cookies via your account privacy settings.

8.4 Managing Cookies

You can manage, restrict, or delete cookies through your browser settings. Most modern browsers on both Android and iOS allow you to block third-party cookies, clear existing cookies, and set preferences for new sites. Note that disabling strictly necessary cookies will prevent you from accessing your bay896 account.

9. Data Retention

Bay896 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention periods apply:

Data Category	Retention Period	Basis
Account registration & identity data	Duration of account + 5 years post-closure	PAGCOR regulatory requirement
KYC verification documents	Duration of account + 5 years post-closure	AML Act (RA 9160) compliance
Financial transaction records	10 years from transaction date	AMLC record-keeping requirements
Game session and betting records	5 years from session date	PAGCOR compliance; dispute resolution
Customer support records	3 years from last interaction	Legitimate interests; legal claims
Marketing consent records	Until consent withdrawn + 2 years	Accountability under DPA
Security and access logs	12 months rolling	Security incident investigation

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with bay896's data disposal procedures. You may request early deletion subject to the limitations described in Section 11.

10. Data Security Measures

Bay896 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security programme includes:

• Encryption in transit: All data transmitted between your device and bay896 servers is encrypted using TLS 1.3 with 256-bit AES cipher. This applies to all Platform pages, the Cashier, login, and API endpoints;
• Encryption at rest: Sensitive data fields including payment details, government ID numbers, and authentication credentials are encrypted at rest using AES-256 within bay896's secure database infrastructure;
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Bay896 staff are granted the minimum access level required for their role. Access is logged and regularly audited;
• Zero-knowledge password storage: Passwords are never stored in plaintext. Bay896 uses cryptographic salted hashing (bcrypt) so that passwords cannot be recovered even in the event of a database breach;
• Two-factor authentication: Available and encouraged for all bay896 accounts. Required for withdrawals and account security changes;
• Penetration testing: Bay896's Platform is subject to regular third-party security assessments and penetration testing to identify and remediate vulnerabilities;
• Incident response: Bay896 maintains a documented data breach response procedure, including NPC notification within 72 hours and player notification as required under NPC Circular 16-03.

11. Your Data Subject Rights

Under the Philippine Data Privacy Act, you have the following rights with respect to your personal data held by bay896. To exercise any of these rights, submit a written request to the bay896 DPO using the contact details in Section 16. Bay896 will respond within fifteen (15) business days of receiving a verifiable request.

11.1 Right to Be Informed

You have the right to be informed about the collection and processing of your personal data, including the purposes, legal bases, retention periods, and third parties involved. This Policy is bay896's primary mechanism for fulfilling this right.

11.2 Right to Access

You have the right to request a copy of the personal data bay896 holds about you, along with information about how it is being processed. Requests for data access will be fulfilled in a structured, commonly used, and machine-readable format where technically feasible.

11.3 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data held by bay896. Minor corrections — such as typos in your email address or mobile number — can be made directly through your account settings. Corrections to legal name, date of birth, or ID documents require submission of supporting documentation to the bay896 DPO.

11.4 Right to Erasure

You have the right to request deletion of your personal data where: the data is no longer necessary for the purpose for which it was collected; you withdraw consent and no other legal basis applies; or the data has been unlawfully processed. This right is subject to bay896's legal and regulatory retention obligations — data required to be retained under PAGCOR rules or AML legislation cannot be deleted prior to the end of the mandatory retention period.

11.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format for the purpose of transmitting it to another service provider, where technically feasible and where processing is carried out by automated means.

11.6 Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing carried out on the basis of legitimate interests where you have grounds relating to your particular situation. Bay896 will cease marketing communications immediately upon receipt of a valid objection.

11.7 Right to Lodge a Complaint

If you believe that bay896 has not handled your personal data in accordance with the DPA or this Policy, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Information on the NPC complaints process is available on the NPC's official website.

12. Children, Minors, and the 21+ Requirement

The bay896 Platform is strictly prohibited for use by persons under 21 years of age, consistent with PAGCOR regulations and the minimum age for casino-style gambling in the Philippines. Bay896 does not knowingly collect personal data from individuals under 21 years of age.

If you are a parent or guardian and have reason to believe that a minor has registered a bay896 account using false age information, please contact our Data Protection Officer immediately using the details in Section 16. Bay896 takes such reports seriously and will investigate and act on them as a matter of priority.

13. International Data Transfers

Bay896's primary data processing infrastructure is located within the Philippines. Where bay896 engages service providers who process data in other jurisdictions — for example, cloud infrastructure providers or international KYC platform operators — such transfers are subject to the following safeguards:

• Bay896 enters into data processing agreements with all international processors that include standard contractual clauses equivalent to those prescribed by the NPC;
• Transfers are made only to countries or organisations that provide an adequate level of data protection as assessed by bay896 in consultation with applicable NPC guidance;
• No personal data is transferred internationally for the purpose of marketing, sale, or exchange with third parties.

14. Third-Party Links

The bay896 Platform does not include links to external third-party websites. All navigation within the Platform remains within bay896.cam. This Policy applies only to data processing conducted by bay896 in connection with the Platform. Bay896 is not responsible for the privacy practices of any third-party payment provider's own website or application, such as GCash's app or PayMaya's interface. You should review the privacy policies of those services independently.

15. Updates to This Privacy Policy

Bay896 reviews and, where necessary, updates this Privacy Policy periodically to reflect changes in our data processing activities, applicable law, regulatory guidance, or platform features. The effective date of the current version is displayed at the top of this page.

Where changes to this Policy are material — for example, a new category of data collection, a new sharing arrangement, or a change in your rights — bay896 will notify registered users via their registered email address or SMS to their registered Philippine mobile number at least seven (7) days before the changes take effect.

Your continued use of the bay896 Platform after a revised Privacy Policy takes effect constitutes your acceptance of the updated Policy. If you do not accept a material change, you should close your bay896 account and cease using the Platform before the change takes effect.

16. Contact Us & Data Protection Officer

For all data privacy enquiries, data subject rights requests, or to report a suspected data privacy breach involving your bay896 account, please contact the bay896 Data Protection Officer:

• Email: [email protected] (subject line: "Data Privacy – DPO Request")
• Live Chat: Available 24/7 from your bay896 account dashboard — specify "Data Privacy Request" when initiating the chat
• Response Time: The bay896 DPO will acknowledge your request within two (2) business days and provide a substantive response within fifteen (15) business days of receiving a verifiable request

For complaints that have not been resolved to your satisfaction through bay896's internal process, you may contact the National Privacy Commission of the Philippines. The NPC accepts complaints and enquiries through its official channels published on its website.