dbx77 Privacy Policy

dbx77 is committed to protecting the privacy and personal data of every Filipino player who uses our platform. We recognize that trust is foundational to the relationship between a gaming platform and its players — and that trust depends in large part on transparency about how personal data is handled.

This Privacy Policy has been prepared in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and the implementing rules and regulations issued by the National Privacy Commission ("NPC"). It applies to all personal data collected through dbx77.vip, our mobile web interface, live chat systems, customer support communications, and any other channel through which you interact with dbx77.

This Policy should be read alongside the dbx77 Terms & Conditions, which govern the overall contractual relationship between you and dbx77. In the event of any conflict between this Policy and the Terms & Conditions on a data privacy matter, this Policy shall take precedence.

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, the data controller responsible for your personal data is:

As data controller, dbx77 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable Philippine data protection law.

dbx77 collects personal data that is necessary to provide our Services, verify your identity, process transactions, and comply with legal obligations. The categories of data we collect include:

• Full legal name as it appears on your Philippine government-issued ID;
• Date of birth (to verify the 21+ age requirement);
• Registered Philippine mobile number;
• Email address (if provided);
• Username and encrypted password hash;
• Account preferences and settings.

• Copy or image of a valid Philippine government-issued photo ID (PhilSys, UMID, Passport, Driver's License, SSS/GSIS card);
• Selfie or live photo taken during identity verification;
• Additional supporting documents requested for enhanced due diligence.

• GCash account number or registered mobile number linked to your GCash wallet;
• PayMaya (Maya) account details where used;
• Bank account details (for BPI, BDO, Metrobank, or other bank transfers);
• Cryptocurrency wallet addresses where applicable;
• Deposit and withdrawal transaction records, including timestamps, amounts in PHP, and payment reference numbers.

• Game session logs, including games played, bets placed, wins and losses;
• Sportsbook bet history (PBA, NBA, UFC, sabong, and other markets);
• Bonus and promotion redemption history;
• VIP tier status and loyalty point accumulation.

• IP address and geolocation data (derived from IP);
• Device type, operating system, and browser version;
• Session timestamps, page navigation paths, and time on site;
• Cookie identifiers and browser storage data (see Section 7).

• Live chat transcripts between you and dbx77 support agents;
• Email correspondence submitted to support or DPO channels;
• Records of SMS notifications sent to your registered number.

dbx77 collects personal data through the following means:

• Direct submission: Data you provide during account registration, KYC verification, deposit and withdrawal requests, and support communications;
• Automated collection: Technical and device data collected automatically when you access the platform, including through cookies, server logs, and analytics tools;
• Third-party processors: KYC verification services may perform identity checks and return verification results to dbx77. Payment processors (GCash, PayMaya, BPI, BDO, Metrobank) provide transaction confirmation data. Game providers log session activity within their systems;
• Publicly available sources: In certain compliance or fraud investigation contexts, dbx77 may cross-reference information against publicly available Philippine government or court records.

dbx77 processes your personal data only for specific, legitimate purposes. The table below summarizes our processing activities and the legal basis under the Data Privacy Act of 2012 for each:

dbx77 does not process your personal data for purposes incompatible with those listed above without first obtaining your explicit consent. Where processing is based on consent, you retain the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

dbx77 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Your data may be shared with the following categories of recipients, strictly on a need-to-know basis and under appropriate contractual data protection safeguards:

To process your GCash, PayMaya, BPI, BDO, Metrobank, or cryptocurrency transactions, necessary payment data is transmitted to the respective payment service providers. Each provider operates under their own data protection policy and applicable BSP/NPC regulations.

Identity and age verification may be conducted using third-party KYC service providers. These providers receive only the data necessary to complete the verification process and are bound by strict confidentiality and data security obligations.

Game providers (such as JILI, PG Soft, Pragmatic Play, and others integrated into the dbx77 lobby) may receive a session token and non-personally identifying player identifiers to facilitate gameplay and log session results. Full personal data including name, ID documents, and payment details are not transmitted to game providers.

dbx77 may be required to disclose personal data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), or other competent Philippine government authorities in response to lawful requests, court orders, or regulatory investigations. Such disclosures will only be made to the extent required by law.

Legal counsel, auditors, and compliance consultants engaged by dbx77 may access personal data on a confidential basis in the course of providing professional services.

dbx77 uses cookies and similar client-side storage technologies to operate the platform, maintain your login session, and understand aggregate usage patterns. We do not use cookies to serve third-party advertisements or share browsing data with advertising networks.

You may control or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging into your dbx77 account. For Chrome on Android (the most common browser among Filipino mobile users), cookie management is accessible under Settings → Privacy and Security → Cookies and other site data.

dbx77 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, and compliance obligations. Our standard retention periods are as follows:

• Active account data: Retained for the duration of your active account relationship with dbx77;
• KYC and identity documents: Retained for a minimum of 5 years following account closure, as required by anti-money laundering regulations applicable in the Philippines;
• Transaction records: Retained for a minimum of 5 years in accordance with BSP and AMLC record-keeping requirements;
• Gaming activity logs: Retained for 2 years following account closure or last activity, whichever is later;
• Customer support communications: Retained for 2 years from the date of the communication;
• Technical and device data: Retained for up to 12 months for security and fraud analysis purposes;
• Dormant account data: Accounts inactive for 12 consecutive months are classified as dormant. Dormant account data is retained but access is restricted, and a notice is issued to the registered mobile number before any data deletion is initiated.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized using industry-standard data sanitization methods. Where data is anonymized rather than deleted, the anonymized data set may be retained indefinitely for aggregate statistical purposes without constituting a retention of personal data under the DPA.

dbx77 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption in transit: All data transmitted between your browser or mobile device and dbx77 servers is encrypted using TLS 1.2 or higher. The padlock icon in your browser confirms an active secure connection;
• Encryption at rest: Sensitive data stored in dbx77 databases — including KYC documents and payment details — is encrypted at rest using AES-256 encryption;
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis. Employee access logs are maintained and regularly reviewed. KYC documents are accessible only to authorized compliance personnel;
• Password security: User passwords are never stored in plain text. Only salted cryptographic hashes are retained;
• Two-factor authentication: 2FA via SMS OTP is available for all player accounts and strongly recommended. It provides an additional barrier against unauthorized login;
• Vulnerability management: dbx77 conducts regular security assessments and maintains a vulnerability disclosure process. Critical security patches are applied within 24 hours of identification;
• Data breach response: In the event of a personal data breach that poses a risk to your rights, dbx77 will notify affected players and the National Privacy Commission within 72 hours of breach discovery, in accordance with NPC Circular 16-03.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by dbx77. These rights may be exercised by contacting our Data Protection Officer using the details in Section 15:

• Right to be Informed: The right to know how your personal data is collected, used, and processed — which is the purpose of this Privacy Policy;
• Right to Access: The right to request a copy of the personal data dbx77 holds about you, including account data, KYC status, and transaction history;
• Right to Correction: The right to request correction of inaccurate or incomplete personal data in your dbx77 account;
• Right to Erasure (Right to be Forgotten): The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements under AML, gaming, and financial regulations;
• Right to Object: The right to object to the processing of your personal data for direct marketing or where processing is based on legitimate interest, in cases where your particular situation warrants such an objection;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format where technically feasible;
• Right to File a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data protection rights have been violated.

dbx77 will respond to all data subject requests within 30 calendar days of receipt. In complex cases requiring additional processing time, we will notify you of the extension and expected resolution timeline. Note that some rights — particularly the right to erasure — may be limited by our legal obligations to retain certain data under AML and gaming regulatory requirements.

dbx77 enforces the 21+ age requirement through mandatory date-of-birth collection at registration and KYC document verification prior to withdrawal access. Automated checks flag accounts where the stated date of birth indicates a player under 21 years of age.

If dbx77 discovers that personal data has been collected from a player who is under 21 years of age — whether through self-disclosure, parental notification, or detection by our compliance systems — the following actions will be taken immediately:

• The account will be permanently closed;
• All personal data associated with the account will be deleted, except where retention is required by law;
• Any account balance will be returned to the payment method on file, less any bonuses already claimed;
• The incident will be logged for regulatory reporting purposes.

If you are a parent or guardian and believe your child has registered an account with dbx77, please contact our Data Protection Officer immediately at [email protected] with supporting information. We will investigate and act promptly.

The dbx77 platform may contain links to third-party services that are operationally necessary — such as payment gateway interfaces for GCash and PayMaya. When you interact with these third-party services, you are subject to their respective privacy policies, which are independent of dbx77's Privacy Policy.

dbx77 is not responsible for the data practices of third-party services, even where those services are embedded within or linked from the dbx77 platform. We recommend reviewing the privacy policies of GCash (G-Xchange, Inc.) and PayMaya (Maya Philippines, Inc.) separately, as they govern how those platforms handle your financial and personal data during payment processing.

dbx77 does not embed third-party advertising networks, social media tracking pixels, or analytics tools that transmit personal data to advertising platforms on any part of the dbx77.vip website.

dbx77 primarily processes and stores personal data on infrastructure located in or serving the Asia-Pacific region. In certain circumstances, personal data may be processed by or transferred to third-party service providers whose infrastructure is located outside the Philippines — for example, cloud infrastructure providers, international KYC verification services, or game providers with processing systems in other jurisdictions.

Where personal data is transferred outside the Philippines, dbx77 ensures that such transfers are subject to:

• Appropriate contractual safeguards, including data processing agreements that require the receiving party to provide a level of data protection equivalent to that required under the DPA 2012;
• Transfers only to jurisdictions with adequate data protection frameworks, or with supplementary safeguards where the receiving jurisdiction's protections are assessed as insufficient;
• Notification to the National Privacy Commission where required under applicable NPC regulations.

By using dbx77, you acknowledge that your personal data may be processed in the manner described above. If you have concerns about specific international transfers, you may direct them to our Data Protection Officer.

dbx77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance from the National Privacy Commission. When material changes are made, we will notify you through:

• Publication of the updated Policy on this page with a revised "Last Updated" date;
• An in-platform notification banner visible upon your next login to dbx77;
• An SMS notification to your registered Philippine mobile number for changes that materially affect your rights or how your data is used.

Your continued use of the dbx77 Services following the effective date of an amended Privacy Policy constitutes your acceptance of the updated Policy. If you do not agree to the amended Policy, you must stop using the Services and contact support to arrange account closure and data deletion (subject to mandatory retention obligations).

We recommend bookmarking this page and reviewing the Policy periodically. The version number and effective date at the top of this document allow you to track changes over time.

For all data privacy-related inquiries, data subject access requests, complaints, or concerns regarding dbx77's handling of your personal data, please contact our Data Protection Officer:

All data subject requests will be acknowledged within 5 business days and resolved within 30 calendar days of receipt. Complex requests requiring extended processing will be communicated to you with a revised timeline.

If you are not satisfied with dbx77's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines:

dbx77 takes all data privacy complaints seriously. We cooperate fully with NPC investigations and are committed to resolving any legitimate concerns about our data practices in good faith and in compliance with Philippine law.