bf009 Privacy
Policy
At bf009, we take the privacy and security of your personal information seriously. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and the rights you have as a player under Philippine law.
How bf009 Protects Your Privacy
Six core principles govern how bf009 handles your personal data — from the moment you register to every transaction you make.
Data Minimisation
bf009 collects only the personal data that is strictly necessary to provide our services, comply with PAGCOR licensing requirements, and satisfy Philippine anti-money laundering obligations. We do not collect data speculatively or for purposes beyond those stated in this policy.
Encryption at Every Layer
All data transmitted between your device and bf009's servers is protected by 256-bit SSL/TLS encryption — the same standard used by major Philippine banks including BPI and BDO. Stored personal data is encrypted at rest using industry-standard cryptographic methods.
No Data Selling
bf009 does not sell, rent, or trade your personal information to any third party for commercial or marketing purposes. Your data stays within the bf009 platform ecosystem and is shared with third parties only as described in this policy and only where legally permitted.
Your Rights Under the DPA
The Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) grants you specific rights over your personal data. bf009 honours all rights afforded under the DPA, including your right to access, correct, erase, and object to the processing of your data.
Marketing Opt-Out
You are in control of whether bf009 contacts you with promotional communications. You can opt out of all marketing emails and SMS messages at any time through your Account Settings or by contacting bf009 customer support directly. Opt-out requests are processed within 5 business days.
Defined Retention Periods
bf009 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable Philippine law including PAGCOR regulations and the Anti-Money Laundering Act. Data is securely deleted or anonymised upon expiry of the applicable retention period.
1 Introduction
bf009 ("we", "us", "our", "the Platform") is committed to protecting the privacy and personal data of all individuals who interact with the bf009 platform. This Privacy Policy has been prepared in accordance with the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as well as the applicable requirements of PAGCOR, the Philippine Anti-Money Laundering Council (AMLC), and other relevant regulatory bodies.
This Privacy Policy describes the categories of personal data bf009 collects about you, the purposes for which that data is processed, the legal bases on which processing is carried out, how long we retain your data, the parties with whom we may share your data, and the rights you are entitled to exercise in respect of your personal data.
We encourage all bf009 players — whether in Manila, Cebu, Davao, Quezon City, Makati, or anywhere else in the Philippines — to read this policy carefully and to contact us if any part of it is unclear. The protection of your data is not an obligation we treat lightly.
2 Data Controller
For the purposes of the Data Privacy Act of 2012, bf009 is the Personal Information Controller in respect of personal data collected through the bf009 platform. As Personal Information Controller, bf009 determines the purposes and means of processing your personal data and is responsible for ensuring that all processing activities comply with applicable Philippine data privacy laws.
Where bf009 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification services, or cloud hosting providers — those parties act as Personal Information Processors and are contractually bound to process data only in accordance with bf009's instructions and applicable Philippine law.
3 Data We Collect
bf009 collects the following categories of personal data in the course of providing its services:
4 How We Collect Your Data
bf009 collects personal data through the following means:
4.1 Directly From You
- When you register an account on the bf009 platform;
- When you complete KYC verification by submitting identity and address documents;
- When you make a deposit or request a withdrawal;
- When you contact bf009 customer support via live chat, email, or any other channel;
- When you update your account settings or communication preferences.
4.2 Automatically Through Platform Use
- Through server logs and session tracking technologies when you access and use the platform;
- Through cookies and similar tracking technologies as described in Section 10 of this policy;
- Through game engine records each time you participate in any game on the bf009 platform.
4.3 From Third Parties
- Identity and fraud verification data from licensed KYC and identity verification service providers;
- Payment confirmation data from GCash, PayMaya, BPI, BDO, Metrobank, and other payment processors;
- Compliance screening data from AMLC-mandated screening services where applicable.
5 Purpose & Legal Basis for Processing
bf009 processes personal data only where it has a lawful basis for doing so under the Data Privacy Act of 2012. The following table summarises the primary purposes for which bf009 processes personal data and the corresponding legal basis for each:
6 Data Sharing & Disclosure
bf009 does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:
6.1 Regulated Disclosures
- PAGCOR: As our licensing regulator, PAGCOR may require access to player account data, gaming records, and KYC documentation for audit and compliance purposes;
- AMLC: Transaction and identity data may be disclosed to the Anti-Money Laundering Council where required under the Anti-Money Laundering Act of 2001, as amended;
- Law enforcement: bf009 will disclose personal data to Philippine law enforcement or judicial authorities where required by a valid court order, subpoena, or equivalent legal instrument.
6.2 Service Providers
- Payment processors: GCash, PayMaya, and bank partners receive transactional data necessary to process deposits and withdrawals;
- KYC providers: Licensed identity verification services receive identity and address documents for verification purposes;
- Cloud infrastructure: bf009's platform is hosted on cloud infrastructure providers operating under data processing agreements consistent with Philippine data privacy law;
- Customer support platforms: Support tools used to manage player communications may process communications data.
All third-party service providers with whom bf009 shares personal data are contractually required to maintain the confidentiality and security of that data and to use it only for the specified purpose.
7 International Data Transfers
Where personal data is transferred to, stored in, or processed in a jurisdiction outside the Philippines — for example, by cloud infrastructure providers or internationally operating game software vendors — bf009 ensures that adequate safeguards are in place to protect that data to a standard equivalent to Philippine data privacy law requirements.
Such safeguards may include contractual clauses consistent with the National Privacy Commission's standard contractual clauses, or equivalent protections agreed with the recipient. bf009 will not transfer personal data to a jurisdiction that does not offer adequate data protection standards unless appropriate supplementary measures are in place.
8 Data Retention
bf009 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:
- Account and identity data: Retained for the duration of the active account relationship, plus a minimum of five (5) years following account closure, as required by PAGCOR licensing terms and anti-money laundering regulations;
- Financial transaction records: Retained for a minimum of ten (10) years in accordance with the Anti-Money Laundering Act of 2001, as amended by Republic Act No. 10365;
- Gaming records: Retained for a minimum of five (5) years, subject to PAGCOR audit requirements;
- Customer support records: Retained for three (3) years following the closure of the relevant support interaction;
- Marketing preferences and consent records: Retained for the duration of the account relationship plus three (3) years.
Upon expiry of the applicable retention period, personal data is securely deleted from bf009's systems or anonymised such that it can no longer be linked to an identifiable individual.
9 Security Measures
bf009 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Key security measures include:
- 256-bit SSL/TLS encryption for all data in transit between your device and bf009's servers;
- AES-256 encryption for personal and financial data stored in bf009's databases;
- Bcrypt hashing with unique salts for all stored account passwords;
- Two-factor authentication (2FA) available for all player accounts;
- Role-based access controls limiting internal staff access to personal data to those with a demonstrable operational need;
- Automated intrusion detection and real-time security monitoring;
- Regular third-party penetration testing and security audits;
- Account lockout after five consecutive failed login attempts.
Despite these measures, no data transmission over the internet is completely secure. In the event of a data breach that is likely to result in high risk to the rights and freedoms of affected individuals, bf009 will notify the National Privacy Commission and affected data subjects in accordance with the Data Privacy Act and NPC Circular No. 16-03.
10 Cookies & Tracking Technologies
The bf009 platform uses cookies and similar tracking technologies to deliver a functional, personalised, and secure experience. The following categories of cookies are used:
10.1 Strictly Necessary Cookies
These cookies are essential for the operation of the bf009 platform and cannot be disabled. They include session management cookies that maintain your logged-in state, security cookies that prevent cross-site request forgery attacks, and load balancing cookies that ensure platform stability.
10.2 Functional Cookies
These cookies remember your preferences — such as language settings, display preferences, and recently played games — to enhance your experience on the bf009 platform. Disabling these cookies may affect the availability of certain personalised features.
10.3 Analytics Cookies
These cookies help bf009 understand how players use the platform by collecting aggregated, anonymised data about page visits, session duration, game engagement, and navigation paths. This data is used exclusively for internal platform improvement purposes.
You can control cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from using the bf009 platform. You may also manage your cookie preferences through the bf009 cookie preference centre accessible from the platform footer.
11 Your Rights Under the Data Privacy Act
The Data Privacy Act of 2012 (RA 10173) grants you the following rights in relation to your personal data held by bf009. Requests to exercise these rights should be submitted to bf009's Data Protection Officer at the contact details listed in Section 14.
Right to Access
You have the right to obtain a copy of the personal data bf009 holds about you and information about how it is being processed.
Right to Correction
You have the right to have inaccurate or incomplete personal data corrected or updated without undue delay.
Right to Erasure
You may request deletion of your personal data where processing is no longer necessary, subject to overriding legal retention obligations.
Right to Object
You have the right to object to processing carried out on the basis of legitimate interests, including direct marketing.
Right to Portability
You may request a machine-readable copy of the personal data you have provided to bf009 for transfer to another service.
Right to Complain
You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe bf009 has violated your data privacy rights.
bf009 will respond to valid data subject rights requests within fifteen (15) business days of receipt. Where additional time is required due to the complexity of the request, bf009 will notify you of the extended timeline and the reason for it.
12 Minors
The bf009 platform is strictly intended for individuals aged 21 and above in accordance with PAGCOR's applicable regulations. bf009 does not knowingly collect personal data from individuals under the age of 21. Where bf009 discovers that personal data has been collected from an individual who is under 21 years of age, that data will be deleted immediately and the associated account permanently closed.
13 Changes to This Privacy Policy
bf009 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where changes are material, bf009 will provide advance notice via email to your registered address or via a prominent notice on the platform.
The date of the most recent update is displayed in the "Last Updated" notice at the top of this page. We encourage you to review this Privacy Policy periodically. Continued use of the bf009 platform following the effective date of any amendment constitutes your acknowledgment of the revised policy.
14 Contact Us & Data Protection Officer
bf009 has appointed a Data Protection Officer ("DPO") in compliance with the Data Privacy Act of 2012 and NPC Advisory Opinion requirements. If you have any questions about this Privacy Policy, wish to exercise any of your data subject rights, or wish to raise a privacy concern, please contact the bf009 DPO using the details below:
DPO Contact Email
Response Timeline
Within 15 business days of receipt
Regulatory Authority
National Privacy Commission (NPC), Philippines
Gaming Regulator
PAGCOR — Philippine Amusement and Gaming Corporation
This Privacy Policy was last reviewed and updated on 1 January 2026. The current version supersedes all prior versions.
Your Data Is Safe at bf009
bf009 is built on a foundation of transparency, fair play, and genuine respect for player privacy. GCash accepted. PAGCOR licensed. Compliant with the Philippine Data Privacy Act. All games for players aged 21 and above only.
PAGCOR Licensed · 21+ Only · DPA 2012 Compliant · 256-bit SSL Encryption