Privacy Policy

This Privacy Policy ("Policy") describes how kbl99 ("kbl99," "we," "us," or "our"), the operator of kbl99.vip, collects, uses, discloses, stores, and protects personal information provided by or collected from users ("you" or "Player") of the kbl99 Platform.

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Republic of the Philippines ("DPA"), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC"). Where kbl99's operations intersect with PAGCOR regulatory requirements concerning player data, those requirements are also reflected herein.

By registering an Account on the kbl99 Platform, you acknowledge that you have read, understood, and consent to the collection and processing of your personal information as described in this Policy. If you do not agree with any part of this Policy, you must not create an Account or use the Platform.

This Policy should be read together with kbl99's Terms and Conditions and Responsible Gaming Policy, both of which are accessible on the Platform.

kbl99, the operator of kbl99.vip, is the personal information controller ("PIC") in respect of all personal data collected from Players through the Platform. As the PIC, kbl99 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully and in accordance with this Policy.

For all privacy-related inquiries, requests, and complaints, you may contact kbl99's designated Data Privacy Officer through the contact details set out in Section 15 of this Policy.

kbl99 collects the following categories of personal data in connection with the registration and use of the Platform:

kbl99 does not knowingly collect sensitive personal information as defined under Section 3(l) of the DPA (including racial or ethnic origin, political opinions, religious beliefs, health data, or genetic information) unless specifically required for a mandatory regulatory purpose.

kbl99 collects personal data through the following means:

• Direct Submission: Information you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting customer support, or updating your account profile.
• Automated Collection: Technical data collected automatically when you access the Platform, including IP addresses, device identifiers, session duration, pages visited, game sessions initiated, and browser/device characteristics. This data is collected through server logs, session tracking, and similar technologies.
• Cookies and Tracking Technologies: Information collected via cookies, pixel tags, and similar technologies as described in Section 8 of this Policy.
• Third-Party Sources: Where kbl99 uses third-party identity verification services to conduct KYC checks, data may be received or verified through those services. kbl99 may also receive data from payment processors confirming transaction completion or flagging suspicious activity.
• Publicly Available Sources: In limited circumstances related to fraud prevention or AML compliance, kbl99 may verify information against publicly available databases or regulatory watchlists.

kbl99 processes your personal data for the following purposes:

• Account Creation and Management: To register your Account, authenticate your identity at login, and manage your Account settings including responsible gaming preferences and deposit limits.
• Platform Operation: To enable you to access and use all game sections, process bets and payouts, maintain your wallet balance, and deliver the core services of the kbl99 Platform.
• Payment Processing: To process deposits via GCash, PayMaya, BDO, BPI, and Metrobank, and to execute withdrawal requests to verified payment accounts in your name.
• Identity Verification (KYC/AML): To verify your identity, age (21+ requirement), and the source of funds in compliance with PAGCOR requirements and applicable Philippine anti-money laundering regulations.
• Fraud Prevention and Security: To detect, investigate, and prevent unauthorized access, fraudulent transactions, bonus abuse, multi-accounting, and other prohibited activities. This includes automated risk scoring of session and transaction patterns.
• Responsible Gaming: To monitor gaming patterns for indicators of at-risk behavior, enforce self-imposed account limits, and administer self-exclusion requests in accordance with kbl99's Responsible Gaming Policy.
• Customer Support: To respond to your inquiries, resolve disputes, process complaints, and maintain records of communications for quality assurance and compliance purposes.
• Legal and Regulatory Compliance: To comply with applicable Philippine laws, PAGCOR regulatory requirements, court orders, and lawful requests from competent government authorities, including data retention obligations and AML reporting.
• Service Improvement: To analyze aggregated, de-identified usage data for purposes of improving Platform performance, game library curation, and user experience. This processing does not involve personally identifiable profiling.

Under the Data Privacy Act of 2012, kbl99 relies on the following legal bases for processing your personal data:

• Consent (Section 12(a), DPA): Processing based on your freely given, specific, and informed consent, provided at registration and during the use of optional Platform features. You may withdraw consent at any time, subject to applicable limitations set out in this Policy.
• Contractual Necessity (Section 12(b), DPA): Processing necessary to perform the contract between you and kbl99 constituted by the Terms and Conditions — specifically, operating your Account, processing payments, delivering games, and handling support.
• Legal Obligation (Section 12(c), DPA): Processing required to comply with applicable Philippine laws and regulations, including PAGCOR requirements, the Anti-Money Laundering Act (AMLA) and its amendments, and lawful orders from competent authorities.
• Legitimate Interests (Section 12(f), DPA): Processing necessary for kbl99's legitimate interests — including fraud prevention, platform security, and responsible gaming monitoring — where those interests are not overridden by your rights and interests as a data subject.

kbl99 may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment Service Providers: GCash (GXI), PayMaya (Voyager Innovations), BDO Unibank, BPI, Metrobank, and other payment providers, for the purpose of processing deposits and withdrawals.
• Identity Verification Services: Third-party KYC and AML screening providers engaged by kbl99 to assist with identity verification, age verification, and sanctions screening.
• Game Software Providers: Game providers whose titles are integrated into the kbl99 Platform may receive anonymized or pseudonymized session data necessary to deliver games and resolve technical disputes.
• Technology and Hosting Providers: Cloud hosting, content delivery, security, and analytics service providers who process data on kbl99's behalf under data processing agreements that require them to protect your data in accordance with the DPA.
• Regulatory and Law Enforcement Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the NPC, courts of competent jurisdiction, and other government authorities in the Philippines, where disclosure is required by law, regulation, court order, or is necessary to protect the rights and safety of kbl99 or its players.

kbl99 does not share personal data with advertising networks, data brokers, or any party for the purpose of targeted commercial marketing directed at kbl99 Players.

kbl99 uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device that help the Platform remember your preferences and session state, and that allow kbl99 to analyze Platform usage for security and improvement purposes.

kbl99 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential to the operation of the Platform, including session authentication cookies that keep you logged in during a gaming session and security cookies that prevent fraudulent login attempts. These cannot be disabled without impairing core Platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gaming limit configurations, so you don't need to re-enter them on each visit.
• Analytics Cookies: Used to collect aggregated, de-identified information about how Players use the Platform — including which games are most frequently accessed and average session duration — to help kbl99 improve the user experience. kbl99 does not use third-party advertising analytics tools that share this data externally.
• Security and Fraud Prevention Cookies: Used to identify device fingerprints and detect unusual patterns that may indicate unauthorized access attempts, bonus abuse, or multi-accounting.

You may configure your browser to refuse cookies or to alert you when cookies are being set. However, disabling strictly necessary cookies will impair your ability to use the kbl99 Platform, including the ability to stay logged in during a game session. kbl99 does not use third-party advertising cookies or participate in cross-site behavioral tracking networks.

kbl99 retains your personal data for the following periods, or for such longer periods as may be required by applicable law:

• Account Data (Identity, Contact): Retained for the duration of your Account's active status, plus a minimum of five (5) years following Account closure, as required for AML record-keeping obligations under Philippine law.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLA record retention requirements applicable to covered institutions in the Philippines.
• KYC Documents: Retained for the duration of the Account relationship plus five (5) years following Account closure, subject to any applicable regulatory extension.
• Gaming Session Logs: Retained for a minimum of two (2) years for dispute resolution purposes, and for such longer periods as may be required for ongoing regulatory investigations.
• Customer Support Communications: Retained for two (2) years from the date of each communication.
• Technical and Device Data: Retained for up to twelve (12) months for security and fraud prevention purposes, after which it is aggregated or deleted.

Upon expiry of the applicable retention period, kbl99 will securely delete or irreversibly anonymize your personal data, unless retention for a further period is required by law, regulatory direction, or an ongoing dispute or investigation.

kbl99 implements a layered set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption: All data transmitted between your device and kbl99 servers is encrypted using Transport Layer Security (TLS) with 256-bit encryption. Passwords are stored using industry-standard cryptographic hashing (not in plain text).
• Access Controls: Access to personal data systems is restricted to authorized kbl99 personnel on a need-to-know basis, with role-based access controls and audit logging of all data access events.
• Two-Factor Authentication: OTP-based two-factor authentication is available and recommended for all kbl99 Accounts, adding a second layer of verification for login attempts from unrecognized devices.
• Infrastructure Security: kbl99's Platform infrastructure is hosted in secured data center environments with physical access controls, redundant systems, and regular security patching.
• Penetration Testing and Monitoring: kbl99 conducts regular security assessments and maintains real-time monitoring for unusual access patterns, intrusion attempts, and data exfiltration indicators.

Despite these measures, no online platform can guarantee absolute security. In the event of a personal data breach that is likely to result in harm to affected individuals, kbl99 will notify the NPC within the timeframe required by the DPA and will inform affected Players without undue delay.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by kbl99:

• Right to be Informed: The right to be informed about how your personal data is collected, used, and processed — as set out in this Policy.
• Right to Access: The right to request a copy of the personal data that kbl99 holds about you, including information about how it has been used.
• Right to Correction: The right to request correction of inaccurate, incomplete, or outdated personal data in your kbl99 Account.
• Right to Erasure or Blocking: The right to request deletion or blocking of personal data where processing is unlawful, the data is no longer necessary for the purpose for which it was collected, or consent is withdrawn — subject to overriding legal retention obligations.
• Right to Object: The right to object to the processing of your personal data where processing is based on kbl99's legitimate interests, or where personal data is used for direct marketing purposes.
• Right to Data Portability: The right to receive a copy of your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contractual necessity.
• Right to Damages: The right to claim compensation for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully obtained personal data, in accordance with the DPA.

To exercise any of the above rights, please contact kbl99's Data Privacy Officer using the contact details in Section 15. kbl99 will respond to all data subject requests within thirty (30) days of receipt, and will extend this period by a further thirty (30) days where the complexity of the request requires it, with notice to you of the extension and its reason.

The kbl99 Platform is strictly intended for adults aged 21 years and above in accordance with PAGCOR regulations governing real-money online gaming in the Philippines. kbl99 does not knowingly collect personal data from any individual under the age of 21.

Age verification is conducted during Account registration and as part of the KYC process. Where kbl99 identifies or has reasonable grounds to believe that an Account has been registered by a person under the age of 21, the Account will be immediately suspended, all pending transactions voided, and the matter referred to appropriate personnel for investigation.

If a parent, guardian, or other responsible adult believes that a minor has registered or attempted to register an Account on kbl99, they should contact kbl99 support immediately so that the Account can be reviewed and closed, and any deposited funds returned to the verified adult payment account.

In the course of operating the kbl99 Platform, certain personal data may be transferred to or accessed from systems or personnel located outside the Philippines — for example, where game software providers, cloud infrastructure providers, or KYC service providers operate servers or processing facilities in other countries.

Where such cross-border transfers occur, kbl99 ensures that appropriate safeguards are in place to protect the transferred data in a manner consistent with the requirements of the Data Privacy Act of 2012 and the NPC's guidelines on cross-border data transfers. Safeguards may include contractual data transfer clauses, adequacy assessments, or reliance on jurisdictions recognized as providing equivalent data protection.

kbl99 does not transfer your personal data outside the Philippines for purposes inconsistent with those set out in this Policy, and does not transfer data to jurisdictions that do not provide appropriate protection for personal data without additional contractual safeguards.

kbl99 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, regulatory requirements, or Platform functionality. The effective date of the current version of this Policy is displayed at the top of this page.

Where changes to this Policy are material — meaning they significantly affect your rights, the categories of data collected, or the purposes for which data is used — kbl99 will provide at least fourteen (14) days' prior notice via email to your registered address and/or a prominent notice on the Platform before the changes take effect.

Minor or non-substantive changes (including clarifications, corrections, and changes required by law with immediate effect) may be made without advance notice. Continued use of the kbl99 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the revised Policy.

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about how kbl99 handles your personal data, please contact our Data Privacy Officer through the following channels:

• Email: [email protected] — please include "Privacy Request" or "DPO Query" in the subject line.
• Live Chat: Available 24/7 on the kbl99 website. Ask to be connected to the Data Privacy Officer team for privacy-related matters.

kbl99 will acknowledge receipt of your query within 48 hours and will provide a substantive response within 30 calendar days, or such extended period as may apply for complex requests.

If you are not satisfied with kbl99's response to a privacy complaint, or believe that your personal data has been processed in violation of the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Information about the NPC's complaint process is available on the NPC's official website.