Privacy Policy — How sm77 Handles Your Personal Data

1 Scope & Data Controller

1.1 Data Controller. sm77, operating through sm77.one, is the data controller responsible for the personal information of its registered players and site visitors. As data controller, sm77 determines the purposes and means of processing personal data collected through the Platform.

1.2 Scope. This Privacy Policy covers all personal data processed in connection with your use of the sm77 Platform, including data collected during registration, identity verification (KYC), payment processing, gameplay, customer support, and marketing. It does not cover the data practices of third-party game providers or payment processors, each of which operates under its own privacy framework.

1.3 Legal Framework. sm77 processes personal data in compliance with:

• Republic Act 10173 — Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations;
• Applicable anti-money laundering (AML) regulations in the Philippines;
• Philippine gaming regulatory requirements applicable to the Platform's operations.

2 Personal Data We Collect

sm77 collects the following categories of personal data from players and Platform visitors:

3 How We Collect Your Data

sm77 collects personal data through the following means:

• Direct provision: Information you provide when you register an Account, complete KYC verification, make deposits or withdrawals, set responsible gaming limits, contact customer support, or respond to surveys;
• Automated collection: Technical and usage data collected automatically when you access the Platform, including IP address, device identifiers, browser data, and session activity via cookies and similar tracking technologies;
• Transaction records: Financial data generated when you make a deposit or request a withdrawal through GCash, PayMaya, BPI, BDO, or Metrobank, including transaction reference numbers and timestamps;
• Third-party verification services: Identity and document verification data obtained through third-party KYC and AML service providers used to verify the information you submit;
• Game providers: Aggregated game activity data from the game provider platforms that deliver games through the sm77 interface;
• Customer support systems: Records of live chat sessions, email exchanges, and support ticket interactions.

4 Purposes & Legal Basis for Processing

sm77 processes personal data only for specified, legitimate purposes. The following table summarises our principal processing purposes and the legal basis for each under the Philippine Data Privacy Act:

4.1 Marketing Consent. Where processing is based on consent — specifically for marketing communications — you have the right to withdraw your consent at any time by updating your communication preferences in your Account settings or by contacting sm77 support. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5 Data Sharing & Disclosure

sm77 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share personal data only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment processors: GCash, PayMaya, BPI, BDO, and Metrobank receive transaction data necessary to process deposits and withdrawals. Each payment provider operates under its own privacy policy and is independently responsible for its data practices.
• KYC and AML service providers: Third-party identity verification and AML screening platforms receive your identity documents and personal details for the purpose of verifying your identity and screening against applicable watchlists.
• Game providers: Game studios such as PG Soft, Pragmatic Play, Evolution Gaming, JDB, and Jili receive a player identifier and wallet transaction data necessary to operate game sessions. Game providers do not receive your full identity data.
• Regulatory authorities: sm77 will disclose personal data to the relevant Philippine regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction. We will notify affected players of any such disclosure to the extent permitted by law.
• Platform service providers: Third-party technical service providers (hosting, analytics, fraud detection, customer support software) may process personal data as data processors on sm77's behalf, subject to data processing agreements that require them to handle data in compliance with the Data Privacy Act and sm77's instructions.
• Business transfers: In the event of a merger, acquisition, or sale of assets involving sm77, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Affected players will be notified before their data is transferred and a new privacy policy becomes applicable.

6 International Data Transfers

6.1 Cross-Border Transfers. Some of sm77's third-party service providers — including game studios and technical infrastructure providers — may process personal data outside the Philippines. Where such transfers occur, sm77 takes steps to ensure that an equivalent level of data protection applies, including through contractual data processing agreements that incorporate data protection obligations consistent with the Data Privacy Act.

6.2 Safeguards. Transfers of personal data to countries that do not have data protection laws equivalent to the Philippines are conducted only where appropriate safeguards are in place, such as standard contractual clauses, binding corporate rules, or other mechanisms approved under applicable Philippine data protection law.

6.3 Notification. By using the sm77 Platform, you acknowledge and consent to the transfer of your personal data to third parties and service providers that may operate outside the Philippines, subject to the safeguards described in this section.

7 Data Retention

7.1 General Retention. sm77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The following retention periods apply as general guidelines:

• Account and identity data: Retained for the duration of the active account relationship plus five (5) years following account closure, in compliance with AML record-keeping requirements;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, consistent with Philippine AML and tax record-keeping obligations;
• KYC documents: Retained for the duration of the account relationship plus five (5) years following account closure;
• Game activity and betting records: Retained for three (3) years from the date of the activity;
• Customer support records: Retained for two (2) years from the date of the last interaction, unless the record relates to a pending dispute or legal matter;
• Marketing data: Retained until you withdraw consent for marketing communications or request deletion, whichever occurs first.

7.2 Responsible Gaming Records. Self-exclusion records, deposit limit settings, and responsible gaming intervention notes may be retained for longer periods where required by applicable regulatory obligations or where retention is necessary to protect the player's vital interests.

7.3 Deletion. Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

8 Data Security

8.1 Technical Measures. sm77 implements industry-standard technical security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform;
• Encryption at rest for sensitive personal data stored in sm77's systems;
• Multi-factor authentication (OTP) for account login and high-value transactions;
• Automated session monitoring and anomaly detection to identify unusual account activity;
• Access controls limiting employee access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of Platform infrastructure.

8.2 Organisational Measures. sm77 maintains internal data handling policies, staff training on data protection obligations, and incident response procedures. Access to personal data is restricted to personnel whose roles require it.

8.3 Data Breach Notification. In the event of a personal data breach that is likely to result in significant harm to affected individuals, sm77 will notify the Philippine National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players within a reasonable timeframe, in accordance with the Data Privacy Act.

8.4 Your Responsibility. While sm77 takes extensive measures to protect your data, the security of your Account also depends on your own practices. You are responsible for keeping your login credentials, OTPs, and withdrawal PIN confidential and for notifying sm77 immediately if you suspect unauthorised access to your Account.

9 Cookies & Tracking Technologies

9.1 What We Use. sm77 uses cookies and similar tracking technologies (such as web beacons and local storage) to operate the Platform, maintain your login session, prevent fraud, and improve the user experience. The following types of cookies are used:

• Strictly necessary cookies: Required for the Platform to function, including session management, authentication, and security. These cannot be disabled without impairing Platform functionality.
• Performance cookies: Collect anonymised data about how players use the Platform — pages visited, time spent, errors encountered — to help sm77 improve its services. Data is aggregated and not linked to individual players.
• Functional cookies: Remember your preferences, such as language settings and game lobby layout preferences, to provide a personalised experience.
• Marketing cookies: Track your interaction with sm77 promotional materials to measure campaign effectiveness. These are only deployed where you have provided consent.

9.2 Managing Cookies. You can control non-essential cookies through your browser settings. Disabling certain cookies may affect the functionality of specific Platform features. Instructions for managing cookies are available in your browser's help documentation.

10 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by sm77:

10.1 How to Exercise Your Rights. To exercise any of the above rights, contact sm77 via the support email at [email protected] with the subject line "Data Subject Request" and specify the right you wish to exercise and the data concerned. sm77 will acknowledge receipt within forty-eight (48) hours and provide a substantive response within fifteen (15) working days, or within thirty (30) working days where the request is complex.

10.2 Identity Verification. For security purposes, sm77 may require you to verify your identity before processing a data subject request. This ensures that personal data is not disclosed to or modified at the direction of unauthorised parties.

10.3 Limitations. The right to erasure and the right to object do not apply where sm77 is required by law to retain data — for example, KYC records required under AML regulations. sm77 will inform you of any applicable limitation when responding to your request.

10.4 Complaints to the NPC. If you are not satisfied with sm77's response to your data subject request, or if you believe your data rights have been violated, you have the right to lodge a complaint with the Philippine National Privacy Commission (NPC).

11 Children & Minors

11.1 Age Restriction. The sm77 Platform is strictly intended for persons aged twenty-one (21) years and older. sm77 does not knowingly collect personal data from individuals under the age of 21. Age is verified at registration and at the point of first withdrawal through KYC documentation.

11.2 Underage Data. If sm77 discovers that personal data has been collected from a person under 21 years of age, the associated Account will be immediately closed, all data will be securely deleted to the extent not required for regulatory reporting, and any balance held in the account will be handled in accordance with applicable regulatory requirements.

11.3 Parental Responsibility. sm77 strongly encourages parents and guardians to take active measures to prevent minors from accessing online gambling platforms, including using parental control software and keeping login credentials for sm77 accounts private and inaccessible to persons under 21.

12 Responsible Gaming Data

12.1 Special Handling. Personal data relating to a player's responsible gaming status — including self-exclusion records, deposit and loss limits, session timer settings, cooling-off periods, and any problem gambling flags applied by the sm77 risk team — is treated as sensitive personal information and is subject to heightened access controls and retention policies.

12.2 Purpose of Processing. Responsible gaming data is processed for the sole purpose of protecting the player's welfare and fulfilling sm77's obligations under PAGCOR-aligned responsible gaming standards. This data is not used for marketing profiling or shared with third parties for commercial purposes.

12.3 Self-Exclusion Records. Where a player has submitted a self-exclusion request, sm77 retains a record of that exclusion and its terms for the full duration of the exclusion period and for a reasonable period thereafter, to prevent circumvention through account re-registration.

For more information on responsible gaming tools available to sm77 players, please visit the Responsible Gaming page.

13 Third-Party Services & Links

13.1 Game Providers. Games delivered through the sm77 Platform are operated by independent third-party studios including PG Soft, Pragmatic Play, Evolution Gaming, JDB, Jili, and others. While sm77 integrates these games into its platform, each provider operates its own infrastructure and may process player identifiers and game activity data under its own terms. sm77 is not responsible for the data practices of independent game providers beyond the data processing agreements that govern their access to sm77 player data.

13.2 Payment Providers. GCash, PayMaya, BPI, BDO, and Metrobank are independent entities with their own privacy policies. Your use of these payment services is subject to their respective terms and data practices. sm77 receives only the transaction data necessary to credit or debit your sm77 Wallet.

13.3 No Responsibility for Third Parties. sm77 is not responsible for the privacy practices of any third-party service provider or platform. We encourage you to review the privacy policies of any third-party services you use in connection with your sm77 Account.

14 Amendments to This Policy

14.1 Right to Amend. sm77 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or Platform services. The updated policy will be published on this page with a revised "Last Updated" date.

14.2 Notification of Material Changes. Where an amendment materially affects your rights or how sm77 processes your personal data, sm77 will notify registered players by email or in-platform notification prior to the change taking effect. Where the change requires your consent (for example, a new processing purpose), sm77 will request that consent before processing begins.

14.3 Continued Use. Your continued use of the sm77 Platform following the effective date of any amended Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with an amendment, you should discontinue using the Platform and may request Account closure by contacting sm77 support.

15 Contact & Complaints

15.1 Privacy Enquiries. For any questions, requests, or complaints related to this Privacy Policy or sm77's data practices, please contact our data protection contact at:

• Email: [email protected] — subject line: "Privacy Policy Enquiry" or "Data Subject Request"
• Live Chat: Available 24/7 through the sm77 Platform after login

sm77 will acknowledge all privacy-related enquiries within forty-eight (48) hours and provide a substantive response within fifteen (15) working days. Complex requests involving data access, erasure, or portability may take up to thirty (30) working days.

15.2 NPC Complaints. If you are not satisfied with sm77's handling of a privacy complaint or data subject request, you have the right to lodge a formal complaint with the Philippine National Privacy Commission (NPC). Information about how to contact the NPC is available on the NPC's official website.