22bmw Casino Privacy Policy

This Privacy Policy ("Policy") is issued by 22bmw ("22bmw," "the Company," "we," "us," "our") and governs the collection, use, storage, disclosure, and protection of personal information provided by or collected from users ("Player," "you," "your") of the 22bmw online gaming platform available at 22bmw.co and all associated subdomains, features, and services ("the Platform").

This Policy is prepared in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and applicable directives issued by the National Privacy Commission (NPC) of the Philippines. Where applicable, this Policy also reflects the principles of international data protection standards.

By registering an account, accessing the Platform, or submitting any personal information to 22bmw, you consent to the collection and processing of your personal data as described in this Policy. This Policy should be read together with our Terms & Conditions, which also form part of your agreement with 22bmw.

22bmw collects only the personal information necessary to provide you with a secure, compliant, and personalised gaming experience. The categories of personal data we collect are set out below.

• Full legal name as it appears on your government-issued identification.
• Date of birth (collected to verify the mandatory 21+ age requirement under PAGCOR regulations).
• Philippine mobile number used for account verification, SMS OTP authentication, and communications.
• Email address (if provided).
• Username and encrypted password.
• Residential address within the Philippines.

• Copies or scans of government-issued identification documents (e.g., PhilSys National ID, passport, driver's licence, UMID card, SSS or GSIS ID, voter's ID).
• Proof of address documents (e.g., utility bills, bank statements issued in the Philippines).
• Selfie photographs or video verification captures for liveness-check procedures where required.
• Proof of payment method ownership (e.g., screenshot of GCash account showing registered name).

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment channel used.
• GCash or PayMaya account reference numbers associated with transactions (no full wallet credentials are stored).
• Bank account details where bank transfers are used for withdrawals.
• Cryptocurrency wallet addresses where applicable.

• Game session records, including games played, bet amounts, win/loss outcomes, and session duration.
• Sports betting selections, odds accepted, and settlement outcomes.
• Bonus activation records and wagering progress.
• VIP program tier status and loyalty point history.

• IP address and approximate geographic location at the time of login.
• Device type, operating system version, and browser type and version.
• Session timestamps, login and logout records.
• Cookie identifiers and session tokens (see Section 8).

• Records of your communications with 22bmw customer support via live chat, email, or other channels.
• Feedback, survey responses, and complaints submitted to 22bmw.

22bmw collects your personal information through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion.
• Automatically: When you use the Platform, our servers automatically collect technical data such as your IP address, device information, browser type, and session activity logs through standard web server logs, cookies, and similar technologies.
• From payment processors: When you initiate a GCash, PayMaya, bank transfer, or card transaction, our payment processing partners share transaction reference data necessary to credit or debit your account. We do not receive or store your full GCash PIN, bank password, or card CVV at any time.
• From identity verification services: Where third-party KYC or liveness-verification services are used to assist in identity confirmation, we may receive a verification result and supporting data from those services in accordance with their own privacy policies.

22bmw processes your personal data only for legitimate purposes directly related to the provision of our services. The table below summarises the primary purposes for which your data is used:

22bmw does not use your personal data for automated decision-making that produces legal or similarly significant effects on you without providing you with an opportunity to request human review of that decision.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, 22bmw processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the Terms and Conditions you agreed to when registering your account — including account management, payment processing, and the delivery of gaming services.
• Legal obligation: Processing required to comply with applicable Philippine laws, including anti-money laundering obligations under the Anti-Money Laundering Act (AMLA), PAGCOR licensing conditions, and reporting requirements to regulatory authorities.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and platform analytics where such processing does not override your fundamental rights and freedoms.
• Consent: Processing for direct marketing and promotional communications, where you have explicitly opted in to receive such communications. You may withdraw this consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

22bmw does not sell your personal data. We share your personal information only in the limited circumstances described below, and only to the extent necessary for the relevant purpose.

We engage trusted third-party service providers to assist in operating the Platform, including payment processors (GCash, PayMaya, banking partners), KYC and identity verification services, cloud hosting and infrastructure providers, customer support software vendors, and cybersecurity services. These providers process data only under our instruction and are contractually bound to maintain confidentiality and data security standards consistent with this Policy.

Certain game software providers who supply games accessible through the 22bmw Platform may receive limited technical data necessary to operate their games within the 22bmw environment (such as a session token and player account identifier). These providers do not receive your full personal profile or financial information.

22bmw may be required to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine government authorities in response to lawful orders, investigations, or regulatory reporting obligations. Such disclosures are made only to the extent required by law.

22bmw may disclose personal data if required to do so by court order, subpoena, or other binding legal process, or where necessary to protect the legal rights, safety, or property of 22bmw, its players, or the public.

22bmw retains your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. Our standard retention guidelines are as follows:

• Account data & KYC records: Retained for a minimum of five (5) years from the date of account closure, in compliance with AMLA record-keeping requirements applicable to Philippine gaming operators.
• Transaction records: Retained for a minimum of five (5) years from the transaction date, as required by applicable AML and financial record-keeping regulations.
• Gaming activity logs: Retained for three (3) years from the relevant session date for regulatory audit and responsible gaming purposes.
• Customer support communications: Retained for two (2) years from the date of the last communication, or longer if related to an unresolved dispute or legal matter.
• Marketing consent records: Retained for the duration of your account plus three (3) years, to demonstrate consent status for regulatory purposes.

After the applicable retention period expires, personal data is securely deleted or anonymised in accordance with established data disposal procedures. Where anonymisation is applied, the resulting data no longer constitutes personal data and may be retained for statistical or analytical purposes without limitation.

22bmw uses cookies and similar tracking technologies (such as local storage and session tokens) on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function correctly — including maintaining your login session, processing your game selections, and remembering your account preferences. These cannot be disabled without affecting Platform functionality.
• Performance cookies: Used to collect aggregated, anonymised data about how players navigate and use the Platform — such as which pages are visited most frequently or where technical errors occur. This data helps us improve Platform performance.
• Functional cookies: Remember your preferences such as language settings, display preferences, and previously selected game categories to personalise your experience on return visits.

22bmw does not use third-party advertising cookies or behavioural tracking technologies that follow you across external websites. You can control or delete cookies through your browser settings. Note that disabling essential cookies may prevent certain Platform functions from operating correctly, including your ability to stay logged in between pages.

22bmw implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction:

• SSL 256-bit encryption for all data transmitted between your device and 22bmw servers.
• Encrypted storage of sensitive personal data (including passwords, which are stored as salted cryptographic hashes and are never accessible in plain text, even to 22bmw staff).
• Two-factor authentication (2FA) available on all player accounts as an additional access control layer.
• Restricted internal access — personal data is accessible only to 22bmw employees and authorised service providers who have a legitimate need for access to fulfil their role, governed by role-based access controls.
• Regular security assessments including vulnerability scanning and penetration testing of Platform infrastructure.
• Automatic session timeouts for inactive sessions to protect accounts on shared or unattended devices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, 22bmw will notify the National Privacy Commission within 72 hours of becoming aware of the breach, as required under the Data Privacy Act, and will notify affected players without undue delay.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by 22bmw:

• Right to be Informed: The right to know how your personal data is being collected, processed, and used — which is the purpose of this Privacy Policy.
• Right of Access: The right to obtain confirmation of whether 22bmw holds personal data about you, and to receive a copy of that data in a structured, commonly used format upon request.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected or updated without undue delay.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to our legal and regulatory retention obligations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on our legitimate interests. Upon a valid objection, we will cease processing for that purpose.
• Right to Data Portability: The right to receive your personal data in a machine-readable format and, where technically feasible, to have it transmitted directly to another data controller.
• Right to Lodge a Complaint: The right to submit a complaint to the National Privacy Commission of the Philippines (privacy.gov.ph) if you believe your data rights have been violated.

To exercise any of the rights above, please contact our Data Protection Officer at the contact details provided in Section 14. We will respond to all verifiable data rights requests within thirty (30) days. We may request proof of identity before processing a data rights request to protect against unauthorised access to your information.

The 22bmw Platform is strictly intended for persons aged 21 years and above in compliance with PAGCOR regulations governing online gaming in the Philippines. 22bmw does not knowingly collect, solicit, or process personal information from persons under the age of 21.

If we become aware that personal information has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the personal data in question without undue delay, and refer the matter to relevant authorities as appropriate.

If you are a parent or guardian and believe your minor child has provided personal data to 22bmw, please contact our support team or Data Protection Officer immediately using the contact details in Section 14.

The 22bmw Platform may contain references or links to third-party services, game software, or payment providers. This Privacy Policy applies solely to the 22bmw Platform and does not extend to any third-party websites, applications, or services. Once you leave the 22bmw Platform — for example, when completing a GCash or bank transfer through a third-party payment portal — you are subject to the privacy policy of that third party.

22bmw is not responsible for the privacy practices, data handling, or content of any third-party services. We encourage you to review the privacy policies of any third-party service you use in connection with your 22bmw account.

22bmw reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Material changes to this Policy will be communicated to registered players via email notice to the address on file or through a prominent notice displayed on the Platform before the changes take effect.

The effective date at the top of this Policy will be updated whenever amendments are made. We encourage you to review this Policy periodically to stay informed about how 22bmw protects your personal information. Your continued use of the Platform following notification of changes constitutes your acceptance of the revised Policy.

If you have material concerns about any amendments to this Policy, you may contact our Data Protection Officer or request account closure through customer support.

22bmw has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Philippine Data Privacy Act and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data, or if you wish to exercise any of your data rights described in Section 10, please contact us through the following channels:

• Live Chat Support: Available 24/7 through the 22bmw Platform — our fastest response channel for all account and privacy enquiries.
• Email (Data & Privacy): [email protected] — Please include "Privacy Request" or "Data Rights" in the subject line to ensure your message is routed directly to our data protection team.
• FAQ: Visit our FAQ page for answers to common privacy and account questions.

All privacy requests are acknowledged within 48 hours of receipt and resolved within thirty (30) days, unless complexity requires an extension. In such cases, we will notify you of the extension and the reason for it within the initial 30-day period.

If you are not satisfied with 22bmw's response to a privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines at privacy.gov.ph.