fb099 Privacy Policy

fb099 ("we," "us," "our," or "the Company") operates the online gaming platform accessible at fb099.app and all associated applications and services (collectively, the "Platform"). As a platform serving Filipino players across Manila, Cebu, Davao, Quezon City, Makati, and the broader Philippine archipelago, fb099 processes personal data in the normal course of its operations.

This Privacy Policy explains how fb099 collects, uses, stores, protects, and shares personal data in connection with your use of the Platform. It applies to all registered users, visitors to the fb099 website, and any individual whose personal data is processed by fb099 in connection with its gaming and betting services.

This Policy is intended to fulfil fb099's transparency obligations under Republic Act No. 10173 (Philippine Data Privacy Act of 2012) and its Implementing Rules and Regulations (IRR), as administered by the National Privacy Commission (NPC) of the Philippines.

For the purposes of RA 10173, fb099 is the personal information controller ("PIC") in respect of all personal data collected and processed through the Platform. As a PIC, fb099 determines the purposes and means of processing your personal data and bears the primary obligations under the Philippine Data Privacy Act.

fb099 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with RA 10173, handling data rights requests from registered users, and liaising with the National Privacy Commission (NPC) on matters related to personal data processing. Contact details for the DPO are provided in Section 15 of this Policy.

The fb099 Platform is governed by and operated in compliance with Philippine law. All data processing activities described in this Policy are conducted under the legal frameworks established by RA 10173, the Anti-Money Laundering Act (Republic Act No. 9160, as amended), and applicable PAGCOR operating regulations.

fb099 collects personal data from different sources and in different categories depending on the nature of your interaction with the Platform. The following table summarises the categories of personal data we collect, the primary sources of that data, and the legal basis for processing under RA 10173:

fb099 uses personal data only for the specific, documented purposes listed below. We do not use your personal data for any purpose that is incompatible with the purpose for which it was originally collected:

1. Account creation and management: Processing your registration, verifying your identity, maintaining your Account, and facilitating your access to the fb099 Login and Platform services.
2. Service delivery: Processing deposits and withdrawals via GCash, Maya, BPI, BDO, and other accepted Philippine payment methods; crediting bonuses; facilitating gaming activity; and providing customer support.
3. Identity verification and KYC compliance: Verifying your identity before processing withdrawals and as required by Philippine AMLA and PAGCOR obligations.
4. Fraud detection and security: Monitoring account activity for signs of fraudulent transactions, unauthorised access, money laundering, collusion, and other prohibited conduct; investigating suspicious activity; and cooperating with Philippine law enforcement where required.
5. Responsible gaming: Administering deposit limits, session controls, self-exclusion requests, and cooling-off periods; detecting and responding to signs of problem gambling behaviour in accordance with fb099's responsible gaming obligations.
6. Legal and regulatory compliance: Meeting obligations under RA 10173, the Philippine AMLA, PAGCOR licensing requirements, and any other applicable Philippine law or regulatory requirement.
7. Communications: Sending transactional notifications (deposits, withdrawals, account security alerts), responding to customer support queries, and where you have consented, sending promotional communications about fb099 offers and services.
8. Platform improvement: Analysing aggregated, anonymised usage data to improve the performance, reliability, and user experience of the fb099 Platform.

fb099 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. Data sharing is limited to the following specific circumstances:

• Payment processors: GCash (G-Xchange Inc.), Maya (PayMaya Philippines Inc.), BPI, BDO, Metrobank, Coins.ph, and other Philippine payment service providers receive only the minimum data necessary to process deposit and withdrawal transactions.
• KYC and identity verification providers: Third-party identity verification service providers contracted by fb099 to process and verify government ID submissions receive identity data solely for KYC verification purposes and are contractually bound to process it only for that purpose.
• Game technology providers: Game software providers whose titles are available in the fb099 Casino lobby receive aggregated, pseudonymised gaming activity data for the purpose of game performance monitoring. They do not receive identifiable personal data of individual players.
• Regulatory and law enforcement authorities: fb099 is required by Philippine law to report certain activities to the Anti-Money Laundering Council (AMLC), PAGCOR, and other regulatory authorities. Personal data is disclosed to these bodies only to the extent required by applicable law.
• Professional advisors: Legal, accounting, and compliance advisors retained by fb099 may access personal data in the course of providing professional services, subject to professional confidentiality obligations.
• Business transfers: In the event of a merger, acquisition, or sale of substantially all of fb099's assets, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. Affected users will be notified of any such transfer.

The fb099 website uses cookies and similar tracking technologies to enable platform functionality, improve user experience, analyse usage patterns, and support security operations. The following categories of cookies are used on the fb099 Platform:

1. Strictly necessary cookies: Required for the Platform to function. These include session management cookies that maintain your logged-in state during your fb099 visit, security cookies that protect your session, and load-balancing cookies that ensure stable platform performance. These cookies cannot be disabled without breaking core platform functionality.
2. Functional cookies: Remember your preferences, such as language settings, display preferences, and responsible gaming configurations, so you don't need to re-enter them on each visit.
3. Analytics cookies: Used to collect anonymised and aggregated data about how users navigate and interact with the fb099 Platform. This information helps fb099 identify performance issues, improve page load times, and optimise the user interface for Filipino players using various device types.
4. Security and fraud prevention cookies: Support fb099's fraud detection systems by creating a recognisable device fingerprint associated with your Account. These cookies help fb099 identify unauthorised access attempts and flag potentially fraudulent login activity.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair platform functionality. fb099 does not use third-party advertising cookies or behavioural tracking cookies that share your data with advertising networks.

fb099 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. Key security measures include:

• Transport encryption: All data transmitted between your device and fb099's servers is encrypted using TLS 1.3 / 256-bit SSL encryption — the same standard used by Philippine commercial banks and BSP-regulated e-wallet operators.
• Storage encryption: Personal data stored in fb099's databases is encrypted at rest using AES-256 encryption. Password data is stored exclusively as salted cryptographic hashes — plain-text passwords are never retained.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. All fb099 employees and contractors with data access are subject to confidentiality obligations and receive data protection training consistent with RA 10173 requirements.
• Two-factor authentication: fb099's own internal systems require multi-factor authentication for staff access to production data environments. Players may also enable 2FA on their own fb099 Accounts.
• Regular security audits: The fb099 Platform undergoes regular security assessments, penetration testing, and vulnerability scanning by qualified security professionals.
• Incident response: fb099 maintains a documented data breach response procedure, including procedures for notifying the NPC and affected data subjects within the timeframes required by RA 10173 in the event of a personal data breach.

While fb099 employs robust security measures, no internet-based platform can guarantee absolute security against all threats. You share responsibility for Account security — please use a strong, unique password for your fb099 Account and enable two-factor authentication via your Account Settings.

fb099 retains personal data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with fb099's data disposal procedures. Where anonymisation is applied, the resulting data is no longer personal data under RA 10173 and may be retained indefinitely for statistical and analytical purposes.

As a data subject under the Philippine Data Privacy Act, you have the following rights in relation to your personal data held by fb099. These rights may be exercised by contacting fb099's Data Protection Officer as described in Section 15:

The fb099 Platform is intended exclusively for individuals who are 21 years of age or older, consistent with Philippine PAGCOR age restrictions for online gaming. fb099 does not knowingly collect or process personal data from individuals under the age of 21.

fb099 actively enforces the 21+ age requirement through date-of-birth collection at registration and government ID verification during KYC. Any account found upon investigation to be registered by or operated by an individual under 21 will be immediately suspended, and all personal data associated with the account will be deleted or anonymised at the earliest opportunity consistent with applicable legal obligations.

In certain circumstances, the operation of the fb099 Platform may involve the transfer of personal data to servers or service providers located outside the Philippines — for example, in connection with cloud hosting infrastructure, international game software providers, or global fraud detection services.

Where such transfers occur, fb099 ensures that adequate safeguards are in place to protect the transferred data to a standard equivalent to that required by RA 10173. Such safeguards may include:

• Contractual data transfer agreements incorporating NPC-approved standard contractual clauses or equivalent protections.
• Transfer of data only to countries or organisations recognised as providing an adequate level of data protection by the Philippine NPC or equivalent regulatory determination.
• Implementation of technical measures — including encryption and pseudonymisation — that protect personal data in transit and at the destination jurisdiction.

fb099 does not transfer personal data internationally beyond what is necessary for the specific purposes described in Section 4 of this Privacy Policy. The categories of international transfers currently include cloud infrastructure hosting and game performance analytics — in both cases, data is processed under contractual agreements that impose obligations equivalent to RA 10173 on the receiving entities.

The fb099 Platform may contain links to or integrations with third-party services, including Philippine payment providers such as GCash and Maya. When you interact with these third-party services, you are subject to their own privacy policies, which are separate from and independent of this fb099 Privacy Policy.

fb099 is not responsible for the privacy practices of any third-party service or website. We encourage you to review the privacy policies of any third-party service before providing your personal data to them. In particular:

• GCash (G-Xchange Inc.) processes your GCash account data in accordance with its own privacy policy and the BSP's data protection regulations.
• Maya (PayMaya Philippines Inc.) processes your Maya account data under its own privacy terms.
• Game software providers whose titles appear in the fb099 Casino lobby operate under their own data protection frameworks, with which fb099 contractually requires compliance before listing their games on the Platform.

fb099 does not control the content, privacy practices, or data handling of any third-party service, and accepts no liability for any consequences arising from your interaction with third-party platforms accessed through or in connection with fb099.

In the event of a personal data breach that poses a real risk to the rights and freedoms of affected data subjects, fb099 will respond in accordance with the following procedure, as required by RA 10173 and the NPC's Circular on Personal Data Breach Management:

1. Containment: Upon discovery of a breach, fb099's security team will immediately work to contain the incident, prevent further unauthorised access, and preserve evidence for investigation.
2. Assessment: fb099 will assess the nature, scope, and potential impact of the breach — including the categories and volume of personal data involved and the likely consequences for affected data subjects.
3. NPC notification: Where the breach meets the threshold for mandatory reporting under RA 10173, fb099 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, or as soon as reasonably practicable thereafter, providing all information required by the NPC's breach notification form.
4. Data subject notification: Where a breach is likely to result in a high risk to the rights and freedoms of individual data subjects, fb099 will notify affected users without undue delay via their registered email address or mobile number, providing clear information about what happened, what data was affected, and what steps affected users should take to protect themselves.
5. Post-incident review: Following remediation of any breach, fb099 will conduct a thorough post-incident review and implement any additional security measures necessary to prevent recurrence.

fb099 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is displayed at the top of this page.

Where changes to this Privacy Policy are material — meaning they significantly affect your rights or our obligations in relation to your personal data — fb099 will:

• Display a prominent notice on the fb099 Platform for a minimum of 14 days following publication of the updated Policy.
• Send a notification to all registered users at their registered email address or mobile number, summarising the key changes.
• Where required by RA 10173, seek your renewed consent before implementing changes that affect the legal basis on which we process your data.

Your continued use of the fb099 Platform following publication of an updated Privacy Policy constitutes acceptance of the revised terms. If you do not accept the revised Policy, you must cease using the Platform and may request Account closure in accordance with the fb099 Terms & Conditions.

For all matters relating to this Privacy Policy, including the exercise of your data subject rights under RA 10173, data rights requests, privacy complaints, or general data protection enquiries, please contact the fb099 Data Protection Officer (DPO):

If you are not satisfied with fb099's response to a data rights request or privacy complaint, you have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines. The NPC can be contacted through its official website at privacy.gov.ph.