Privacy Policy

1. Overview & Scope

This Privacy Policy applies to all personal data collected by sm77 through the sm77.app website, mobile-optimised platform, customer support channels, and any other services operated under the sm77 brand. It covers data collected from registered players, prospective players who browse the platform without registering, and individuals who contact sm77 for support or business purposes.

sm77 acts as the personal information controller in respect of all personal data processed under this Policy. Where sm77 engages third-party service providers to process data on its behalf, those providers act as personal information processors and are bound by data processing agreements that require them to handle your data in accordance with this Policy and applicable Philippine law.

This Policy should be read alongside the sm77 Terms & Conditions, which govern your overall use of the platform.

2. Personal Data We Collect

sm77 collects personal data through several channels, including account registration, identity verification, payment processing, gameplay activity, and customer support interactions. The categories of personal data we collect include:

2.1 Identity & Contact Data

• Full legal name as it appears on your government-issued ID;
• Date of birth (used to verify you are 21 years of age or older);
• Philippine mobile number and email address;
• Residential address (province, city/municipality, barangay, postal code);
• Government-issued identification documents (e.g., Philippine passport, SSS ID, UMID, PhilSys National ID, driver's license).

2.2 Financial Data

• GCash or PayMaya mobile wallet number;
• BPI, BDO, or Metrobank account details used for deposits and withdrawals;
• Transaction history, including deposit amounts, withdrawal requests, and bonus credits;
• Source-of-funds documentation where required for anti-money laundering compliance.

2.3 Gaming Activity Data

• Game session logs, including games played, bet amounts, and outcomes;
• Bonus and promotion usage history;
• Responsible gaming tool settings (deposit limits, session limits, self-exclusion status);
• Account balance history and wagering records.

2.4 Technical & Usage Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Pages visited, time spent on the platform, and navigation patterns;
• Login timestamps and session duration.

2.5 Communications Data

• Records of customer support interactions via live chat, email, or other channels;
• Feedback, complaints, and dispute correspondence;
• Marketing communication preferences.

3. How We Use Your Personal Data

sm77 uses your personal data only for the purposes for which it was collected or for compatible purposes that you would reasonably expect. The primary purposes for which we process your data are set out in the table below:

sm77 does not use your personal data to make fully automated decisions that produce significant legal effects on you without human review. Where automated tools are used for fraud detection or responsible gaming monitoring, a human review process is available upon request.

4. Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, sm77 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and sm77, including account management, payment processing, and delivery of gaming services;
• Legal obligation: Processing required to comply with applicable Philippine laws, including anti-money laundering regulations, age verification requirements, and gaming regulatory obligations;
• Legitimate interests: Processing necessary for sm77's legitimate business interests, including fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your rights;
• Consent: Processing for marketing communications and non-essential cookies, where you have given your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Sharing Your Personal Data

sm77 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following circumstances:

5.1 Service Providers

sm77 engages trusted third-party service providers to assist in operating the platform, including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification providers, game software suppliers, cloud hosting providers, and customer support platforms. These providers are contractually bound to process your data only on sm77's instructions and in accordance with this Policy.

5.2 Regulatory & Legal Authorities

sm77 may disclose your personal data to Philippine government agencies, law enforcement bodies, or regulatory authorities where required by law, court order, or regulatory direction. This includes disclosures required under the Anti-Money Laundering Act (AMLA) and its amendments.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of sm77's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and the applicable privacy terms.

6. Data Retention

sm77 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with AML record-keeping requirements;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction;
• Gaming activity logs: Retained for three (3) years from the date of the activity;
• Customer support records: Retained for two (2) years from the date of the interaction;
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year for audit purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with sm77's data disposal procedures.

7. Data Security

sm77 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the sm77 platform;
• Encryption of sensitive data at rest, including financial information and identity documents;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Multi-factor authentication for administrative access to systems containing personal data;
• Staff training on data privacy obligations and secure data handling practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, sm77 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay where the breach is likely to result in a high risk to their rights.

8. Cookies & Tracking Technologies

sm77 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse usage patterns. The types of cookies we use are:

• Strictly necessary cookies: Required for the platform to function, including session management and security tokens. These cannot be disabled;
• Functional cookies: Remember your language preferences, login state, and responsible gaming settings;
• Analytics cookies: Collect aggregated, anonymised data about how players use the platform to help us improve the experience;
• Marketing cookies: Used only with your explicit consent to deliver relevant promotional content.

You can manage your cookie preferences through your browser settings at any time. Disabling non-essential cookies will not affect your ability to use the core sm77 platform.

9. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by sm77:

• Right to be informed: You have the right to know what personal data sm77 collects about you and how it is used;
• Right of access: You may request a copy of the personal data sm77 holds about you at any time;
• Right to rectification: You may request correction of inaccurate or incomplete personal data;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to sm77's legal retention obligations;
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time;
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format;
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe sm77 has not handled your personal data in accordance with the Data Privacy Act.

To exercise any of these rights, please contact the sm77 Data Protection Officer using the details in Section 12. sm77 will respond to all verified requests within thirty (30) days.

10. Minors & Age Restriction

If you believe a minor has registered on the sm77 platform, please notify us immediately at [email protected] so that we can take prompt action.

11. Changes to This Privacy Policy

sm77 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or platform features. When material changes are made, we will notify registered players via email and post a prominent notice on the platform. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of the sm77 platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms.

12. Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact the sm77 Data Protection Officer:

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you are not satisfied with sm77's response to your privacy concern.