ybet Privacy Policy

ybet ("we," "us," or "our") is committed to protecting the privacy and personal data of every individual who accesses or uses the ybet platform, including the website at ybet.bio and any associated applications or services (collectively, the "Platform"). This Privacy Policy has been prepared in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as well as applicable PAGCOR regulatory requirements governing licensed online gaming operators.

This policy applies to all registered players, prospective players, visitors to the ybet website, and any other individuals whose personal data ybet collects or processes in connection with the Platform. By registering on ybet or by continuing to use the Platform after being presented with this policy, you acknowledge that you have read and understood its contents.

This Privacy Policy should be read alongside the ybet Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. If you have any questions about how ybet handles your personal data, please refer to Section 14 of this policy for contact details.

For the purposes of the Philippine Data Privacy Act of 2012, ybet is the personal information controller in respect of all personal data collected and processed through the ybet Platform. As the personal information controller, ybet determines the purposes and means of processing your personal data and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently.

ybet operates under the regulatory oversight of the Philippine Amusement and Gaming Corporation (PAGCOR). All data processing activities carried out by ybet are subject to both the requirements of RA 10173 and applicable PAGCOR data governance standards for licensed gaming operators.

ybet collects personal data that is necessary for the operation of a licensed online gaming platform, including for identity verification, regulatory compliance, fraud prevention, and the delivery of a safe and personalised gaming experience. The categories of personal data we collect include:

ybet only collects personal data that is adequate, relevant, and limited to what is necessary for the stated purposes. We do not collect sensitive personal information — such as biometric data or health records — unless specifically required for regulatory compliance and only with your explicit consent.

ybet collects personal data through several means, always in a manner that is transparent and lawful. The primary collection methods are:

• Direct collection at registration: When you create a ybet account, you voluntarily provide your name, date of birth, email address, mobile number, and other registration details.
• KYC verification submissions: When you submit identity documents — such as a Philippine passport, driver's licence, or SSS/UMID card — as part of the account verification process.
• Transactional activity: When you make deposits or withdrawals via GCash, Maya, GrabPay, QR Ph, BPI, BDO, Metrobank, or InstaPay, relevant transaction data is recorded.
• Platform usage: Automatically collected as you interact with the ybet website and games, including through cookies, session tokens, and server logs.
• Customer support interactions: When you contact ybet's support team via email, live chat, or other channels.
• Third-party sources: In limited circumstances, ybet may receive data from identity verification service providers, payment processors, fraud detection partners, or PAGCOR — for compliance purposes only.

ybet uses your personal data for the following purposes, each grounded in a lawful basis as described in Section 6:

1. Account creation and management: To register your account, verify your identity, maintain your profile, and communicate account-related information to you.
2. Age verification and regulatory compliance: To confirm that you are at least 21 years old and to fulfil ybet's obligations as a PAGCOR-licensed operator, including mandatory player registration and reporting requirements.
3. Payment processing: To process deposits and withdrawals via your chosen Philippine payment methods and to maintain accurate financial records.
4. Anti-money laundering (AML) compliance: To monitor transactions for suspicious activity as required under the Philippine Anti-Money Laundering Act (AMLA) and to file reports with the Anti-Money Laundering Council (AMLC) where legally required.
5. Responsible gaming monitoring: To track gaming patterns that may indicate problem gambling behaviour and to implement the responsible gaming tools you have activated on your account, such as deposit limits or self-exclusion.
6. Fraud prevention and platform security: To detect, investigate, and prevent fraudulent activity, account takeovers, bonus abuse, and other security threats.
7. Customer support: To respond to your enquiries, resolve disputes, and improve the quality of ybet's support services.
8. Marketing communications: To send you promotional offers, bonus notifications, and personalised recommendations — but only where you have provided your explicit consent to receive such communications. You may withdraw consent at any time.
9. Platform improvement and analytics: To analyse usage patterns, improve game offerings, optimise the user experience, and inform product development decisions on an aggregated and anonymised basis where possible.

Under the Philippine Data Privacy Act of 2012, ybet must have a lawful basis for each type of personal data processing it conducts. The legal bases ybet relies upon are:

• Contractual necessity: Processing that is necessary to perform the contract between ybet and you as a registered player — including account creation, payment processing, and game delivery.
• Legal obligation: Processing required to comply with Philippine laws applicable to ybet, including PAGCOR licensing conditions, AMLA reporting obligations, and the Data Privacy Act itself.
• Legitimate interests: Processing necessary for ybet's legitimate interests in operating a secure, fair, and commercially viable gaming platform — including fraud prevention, security monitoring, and aggregated analytics — where those interests are not overridden by your rights.
• Consent: Processing for marketing communications and certain optional features of the platform, which ybet only conducts where you have given your clear, informed, and freely given consent. You may withdraw consent at any time by contacting support@ybet.bio or by using the communication preference settings in your account.

ybet does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate safeguards:

• PAGCOR and regulatory authorities: ybet is obligated to submit player data, transaction records, and gaming activity reports to PAGCOR as a condition of its licence. We may also be required to disclose data to the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine government bodies pursuant to a lawful request or court order.
• Payment processors and financial institutions: Transaction data is shared with GCash, Maya, GrabPay, BPI, BDO, Metrobank, InstaPay, and other payment service providers solely to process your deposits and withdrawals.
• Identity verification and KYC service providers: ybet uses third-party KYC providers to verify the authenticity of identity documents submitted during registration. These providers process data under strict data processing agreements.
• Game software providers: Certain gameplay data may be shared with ybet's third-party game studios and RNG providers for the purpose of delivering certified fair games and resolving technical disputes.
• Fraud and security service providers: Device and behavioural data may be shared with specialist fraud prevention and cybersecurity partners to protect the platform and its players.
• Cloud infrastructure and hosting providers: Player data is stored on secure cloud infrastructure. Our hosting partners operate under binding confidentiality and data processing obligations.

ybet uses cookies and similar tracking technologies on the Platform to ensure it functions correctly, to maintain your session security, and — where you consent — to personalise your experience and analyse usage patterns. The types of cookies used by ybet include:

• Strictly necessary cookies : Essential for the platform to operate. These include session authentication tokens, security cookies, and load-balancing cookies. They cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, game lobby filters, and responsible gaming tool configurations. Disabling these cookies may affect your user experience.
• Analytics cookies: Used to understand how players interact with the ybet platform — such as which games are most popular and where players encounter difficulties. Data collected is aggregated and anonymised where possible.
• Marketing cookies: Used only where you have provided consent, to deliver relevant promotions and track the effectiveness of ybet's marketing campaigns. You may opt out of marketing cookies at any time through your account settings.

You can control cookie settings through your browser. However, disabling strictly necessary cookies will prevent you from logging into and using the ybet platform. For a full list of cookies used by ybet and instructions on how to manage them, please contact support@ybet.bio.

ybet retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulatory obligations. The following retention periods apply:

After the applicable retention period expires, ybet will securely delete or irreversibly anonymise your personal data. Where data is anonymised, it may be retained indefinitely for aggregated statistical and analytical purposes without constituting personal data processing under RA 10173.

ybet implements technical and organisational security measures appropriate to the risk level of the personal data we process. These measures are designed to protect your data against unauthorised access, disclosure, alteration, accidental loss, and destruction. Our security practices include:

• Encryption in transit: All data transmitted between your device and the ybet platform is encrypted using TLS (Transport Layer Security) protocols. The ybet website operates exclusively over HTTPS.
• Encryption at rest: Sensitive personal data — including identity documents and financial data — is stored in encrypted form on ybet's secure cloud infrastructure.
• Access controls: Access to personal data within ybet is restricted on a strict need-to-know basis. Staff with access to player data undergo data privacy training and are bound by confidentiality obligations.
• Two-factor authentication: ybet strongly recommends that all players enable two-factor authentication (2FA) on their accounts to prevent unauthorised access.
• Penetration testing and vulnerability management: ybet's systems are subject to regular security assessments to identify and remediate potential vulnerabilities before they can be exploited.
• Incident response: ybet maintains a data breach response plan. In the event of a personal data breach that poses a risk to your rights, ybet will notify the National Privacy Commission (NPC) within 72 hours of discovery and will notify affected individuals without undue delay, as required by RA 10173.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by ybet. To exercise any of these rights, please contact the ybet Data Protection Officer at support@ybet.bio with the subject line "Data Subject Rights Request":

• Right to be informed: The right to know whether ybet holds personal data about you, the purpose for which it is being processed, and how it is being handled — which is fulfilled by this Privacy Policy.
• Right of access: The right to request a copy of the personal data ybet holds about you. ybet will respond to access requests within 30 calendar days.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data held by ybet. You may also update certain details directly through your ybet account profile page.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, provided this does not conflict with ybet's legal retention obligations under PAGCOR and AMLA requirements.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format, where technically feasible and where processing is based on consent or contract.
• Right to object: The right to object to processing based on legitimate interests, including profiling and direct marketing. Upon receipt of a valid objection to marketing, ybet will cease processing your data for that purpose immediately.
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe ybet has processed your personal data in violation of the Data Privacy Act. The NPC may be contacted through the official Philippine government channels.

ybet will acknowledge all data subject rights requests within 5 business days and will provide a substantive response within 30 calendar days. Where a request is complex or ybet receives a large volume of requests concurrently, we may extend this timeframe by an additional 30 days, in which case we will notify you of the extension and the reasons for it.

The ybet platform is strictly intended for individuals who are at least 21 years of age. This age restriction is consistent with Philippine gaming laws applicable to casino-style gambling activities. ybet does not knowingly collect personal data from any individual under the age of 21.

As part of the registration and KYC process, ybet requires all players to verify their date of birth and submit a valid government-issued ID as proof of age. Accounts where the player's age cannot be verified, or where evidence of underage use is discovered, will be immediately suspended and permanently closed.

Parents and guardians are encouraged to use internet filtering tools and to have open conversations with young people about responsible internet use and the legal restrictions on online gambling in the Philippines.

ybet may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory guidance from the NPC or PAGCOR. The "Last Updated" date at the top of this document will always reflect the date of the most recent revision.

Where changes are material — meaning they significantly affect how ybet processes your personal data or your rights as a data subject — ybet will notify you via email to your registered address and/or via a prominent notice on the ybet platform at least 7 days before the changes take effect.

Minor updates — such as clarifications, corrections of typographical errors, or updates to reflect changes in the law that do not alter ybet's processing practices — may be made without prior notice. Your continued use of the ybet platform following the effective date of any update constitutes acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to how ybet handles your personal data, please contact the ybet Data Protection Officer using the details below. All privacy-related correspondence is treated with strict confidentiality.

• Email: support@ybet.bio — please include "Data Privacy" or "DPO" in the subject line so your message is routed correctly.
• Response time: The ybet DPO aims to acknowledge all privacy enquiries within 5 business days and to provide a substantive response within 30 calendar days.
• Language: You may write to the ybet DPO in English or Filipino. ybet's support team includes Filipino-speaking staff available 24/7.

If you are not satisfied with ybet's response to your privacy enquiry or data subject rights request, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for personal data protection matters under RA 10173.