bidaph Privacy Policy
Transparent, Lawful & Filipino-First

1 Who We Are

bidaph (accessible at bidaph.net) is an online gaming platform built for Filipino players, offering slots, live casino tables, sports betting, online bingo, sabong, EVO live dealer games, and the bidaph Wheel. The platform operates within the regulatory framework established by the Philippine Amusement and Gaming Corporation (PAGCOR).

For the purposes of this Privacy Policy, bidaph is the personal information controller (PIC) as defined under the Philippine Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations. This means bidaph determines the purposes and means by which your personal data is processed.

We have appointed a Data Protection Officer (DPO) to oversee compliance with RA 10173 and to serve as your point of contact for all data privacy concerns. The DPO's contact details are set out in Section 13 of this policy.

2 Data We Collect

bidaph collects only the personal data that is necessary for us to provide you with a secure, compliant, and enjoyable gaming experience. The categories of personal data we collect are described in the table below.

3 How We Collect Your Data

bidaph collects personal data through the following channels:

• Directly from you — when you register a bidaph account, complete identity verification (KYC), make a deposit or withdrawal, contact our support team, participate in promotions, or update your account profile;
• Automatically — through cookies, web beacons, and server logs when you browse bidaph.net or use the bidaph platform (see Section 7 for our full Cookies policy);
• From third-party verification services — identity verification providers and fraud screening services that help bidaph confirm the authenticity of government-issued IDs you submit during KYC;
• From payment processors — GCash, PayMaya, and our partner banks provide transaction confirmation data (reference numbers, amounts, timestamps) to allow bidaph to credit deposits and process withdrawals;
• From analytics providers — aggregated, anonymised usage analytics that help bidaph understand how players navigate the platform and where improvements can be made. This data does not identify individual players.

bidaph does not purchase personal data from data brokers or third-party list providers. All personal data we hold about you was either provided by you directly or generated through your use of the bidaph platform.

4 Why We Use Your Data

bidaph processes your personal data for the following specific purposes. We do not process personal data for any purpose incompatible with those listed below without first obtaining your consent.

• Account management — creating, maintaining, verifying, and securing your bidaph account, including processing your bidaph Login credentials and managing password resets;
• Identity verification (KYC) — confirming that you are who you say you are, that you are aged 21 or above, and that your account is not being used for fraudulent or money laundering purposes, as required under PAGCOR regulations and RA 9160 (Anti-Money Laundering Act);
• Providing gaming services — enabling you to access and play all games on the bidaph platform, processing bets, crediting winnings, and managing your PHP wallet balance;
• Processing payments — facilitating deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank, and maintaining financial transaction records as required by law;
• Customer support — responding to your enquiries, resolving disputes, and providing assistance through live chat and email;
• Responsible gaming — monitoring gaming patterns to identify potentially problematic behaviour, administering self-exclusion and limit-setting tools, and fulfilling our duty of care obligations under PAGCOR's responsible gaming framework;
• Fraud prevention and security — detecting and preventing unauthorised access, account takeover attempts, collusion, bonus abuse, and other fraudulent activities;
• Legal and regulatory compliance — fulfilling our obligations under Philippine law, including responding to lawful requests from PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent authorities;
• Platform improvement — analysing aggregated usage data to improve game selection, website performance, and the overall bidaph player experience;
• Marketing communications — sending you promotional emails, SMS, or in-platform notifications about bidaph offers and new games, but only where you have given your explicit consent and have not subsequently opted out.

5 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, bidaph relies on the following legal bases when processing your personal data:

• Contractual necessity — the majority of data processing by bidaph is necessary to perform the contract between bidaph and you (i.e., providing you with the bidaph gaming platform as described in our Terms & Conditions). This includes account creation, game provision, payment processing, and customer support;
• Legal obligation — certain processing activities are required to comply with Philippine law, including KYC identity verification under PAGCOR's licensing conditions, transaction monitoring under RA 9160 (AMLA), and data retention obligations under relevant statutes;
• Legitimate interests — bidaph processes some data on the basis of its legitimate interests as an online gaming operator, including fraud detection, platform security, and aggregated analytics. We ensure that our legitimate interests do not override your fundamental rights and freedoms;
• Consent — where bidaph processes data for marketing purposes or for any purpose beyond those listed above, we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time without penalty.

6 Sharing Your Personal Data

bidaph does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. Your data is shared only in the limited circumstances described below, and always subject to appropriate data protection safeguards.

• Payment processors — GCash, PayMaya, BPI, BDO, and Metrobank receive the minimum data necessary to process your deposit or withdrawal transaction (e.g., your registered mobile number for GCash, or your account name for bank transfers);
• Identity verification providers — regulated KYC and fraud screening services that verify the authenticity of your government-issued ID against Philippine national identity databases, as required for PAGCOR compliance;
• Game content providers — third-party game studios whose games are available on the bidaph platform receive anonymised session data (e.g., a pseudonymous player ID and bet data) necessary to operate the game. These providers do not receive your name, contact details, or financial information;
• Regulatory authorities — PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities, where bidaph is required to disclose data by law or pursuant to a valid regulatory order;
• Professional advisers — lawyers, auditors, and compliance consultants who are bound by professional confidentiality obligations and process data only as necessary to provide their professional services to bidaph;
• Business transfers — in the event of a merger, acquisition, or sale of bidaph's business assets, your personal data may be transferred to the successor entity, subject to the same data protection obligations set out in this policy. You will be notified of any such transfer in advance.

All third parties with whom bidaph shares personal data are required to process that data in accordance with applicable Philippine data privacy law and bidaph's data processing standards.

7 Cookies & Tracking Technologies

bidaph uses cookies and similar tracking technologies on bidaph.net to ensure the platform functions correctly, to remember your preferences, and to understand how players interact with the site. By continuing to use bidaph.net, you consent to the use of cookies as described in this section.

Types of cookies used by bidaph:

• Strictly necessary cookies — essential for the bidaph platform to operate. These include session authentication tokens that keep you logged in to your bidaph account during a gaming session. These cookies cannot be disabled without preventing core functionality;
• Functional cookies — remember your preferences such as your chosen language, lobby display settings, and responsible gaming reminder configurations, so you do not need to re-enter them on each visit;
• Analytics cookies — collect anonymised, aggregated data about how players navigate bidaph.net (e.g., which games are most visited, where users drop off in the registration flow). This data helps bidaph improve the platform. No individual player is identified from analytics data;
• Security cookies — assist bidaph in detecting and preventing fraudulent activity, account takeover attempts, and bot traffic.

bidaph does not use third-party advertising or retargeting cookies that track your browsing behaviour across external websites. You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies may prevent you from accessing certain features of the bidaph platform.

8 Data Retention

bidaph retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Account and identity data — retained for the duration of your active bidaph account, plus a minimum of five (5) years following account closure, as required under PAGCOR licensing conditions and the Anti-Money Laundering Act;
• Financial transaction records — retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC record-keeping requirements and BIR audit obligations;
• Gaming activity data — retained for three (3) years from the date of each gaming session, for the purposes of dispute resolution, responsible gaming monitoring, and regulatory reporting;
• Customer support communications — retained for two (2) years from the date of each interaction, to enable bidaph to reference prior contact in the event of subsequent disputes or enquiries;
• Marketing consent records — retained for the duration of your account plus two (2) years, to evidence consent given and subsequent withdrawals;
• Technical and usage data — retained for up to thirteen (13) months in identifiable form, after which it is anonymised and may be retained indefinitely for aggregated analytics purposes.

Once your personal data reaches the end of its applicable retention period, bidaph will securely delete or anonymise it in accordance with our internal data destruction procedures.

9 Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to the personal data bidaph holds about you. These rights can be exercised by contacting bidaph's Data Protection Officer (see Section 13).

bidaph will respond to all data subject rights requests within fifteen (15) days of receipt. If additional time is needed due to the complexity of the request, we will notify you within the initial 15-day period and provide an estimated completion date.

10 Data Security

bidaph implements a comprehensive set of technical, organisational, and physical security measures to protect your personal data from unauthorised access, disclosure, alteration, loss, or destruction. Our security framework includes, but is not limited to:

• Transport Layer Security (TLS) — all data transmitted between your browser and bidaph.net is encrypted using current TLS protocols, ensuring your login credentials, payment details, and personal information cannot be intercepted in transit;
• Data encryption at rest — sensitive personal data stored in bidaph's databases, including identity documents and financial records, is encrypted using industry-standard encryption algorithms;
• Access controls — bidaph staff are granted access to personal data on a strict need-to-know basis. All staff who access personal data are subject to confidentiality obligations and receive data privacy training in line with RA 10173 requirements;
• Two-factor authentication (2FA) — available on all bidaph accounts to add an additional layer of protection to your bidaph Login credentials beyond your password alone;
• Fraud monitoring systems — automated real-time monitoring of account activity to detect suspicious login attempts, unusual transaction patterns, and potential account compromises;
• Regular security assessments — bidaph conducts periodic vulnerability assessments and penetration testing of its platform infrastructure to identify and remediate security weaknesses before they can be exploited.

In the event of a personal data breach that is likely to result in harm to you, bidaph will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects within the timeframes required under RA 10173 and NPC regulations.

11 Children's Privacy

The bidaph platform is strictly for adults. Real-money gaming on bidaph is restricted to verified players aged 21 years and above, in accordance with Philippine gambling regulations and the age restrictions applicable under PAGCOR's licensing framework.

bidaph does not knowingly collect personal data from any person under the age of 21. Our identity verification (KYC) process is specifically designed to confirm that all registered players meet the minimum age requirement before they can access real-money gaming services.

If bidaph becomes aware that personal data has been collected from a person under 21 years of age, we will:

• Immediately suspend the account pending investigation;
• Delete all personal data associated with the underage account as soon as reasonably practicable;
• Void any transactions and return any real-money funds deposited, net of any winnings derived from underage play, to the payment method used for the original deposit;
• Report the matter to the relevant regulatory authorities where required by law.

If you believe that a person under 21 has accessed or registered on the bidaph platform, please contact our Data Protection Officer immediately using the contact details in Section 13.

12 Changes to This Privacy Policy

bidaph may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The "Last updated" date at the top of this policy will always reflect the date of the most recent revision.

Where a change to this Privacy Policy is material — meaning it significantly affects your rights or the way bidaph processes your personal data — bidaph will notify you in advance by email to your registered address or via a prominent in-platform notification. Minor clarifications or corrections that do not affect your substantive rights will take effect upon publication without prior individual notice.

Your continued use of the bidaph platform following notification of a material change constitutes your acknowledgement of the updated Privacy Policy. If you do not accept the changes, you may request account closure as described in bidaph's Terms & Conditions.

The current version of this Privacy Policy is always available at bidaph.net/privacy-policy. We encourage you to review this page periodically to stay informed about how bidaph protects your personal data.

13 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the way bidaph handles your personal data, you can reach us through the following channels:

• Live chat — available 24/7 inside your bidaph account. This is the fastest way to reach a support agent for any privacy-related concern;
• Email — our support email address is listed in the footer of every page on bidaph.net. Please include "Privacy Request" in your subject line and provide your registered bidaph username to help us locate your account.

bidaph's Data Protection Officer (DPO) is specifically responsible for overseeing compliance with RA 10173 and handling formal data subject rights requests and data breach notifications. You may contact the DPO directly using the same email address, marking your message for the attention of the Data Protection Officer.

If you are not satisfied with bidaph's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing RA 10173.