sm77 Privacy Policy

The data controller responsible for the personal information collected and processed through the sm77 platform at sm77.club is sm77 (hereinafter "sm77," "we," "us," or "our"). As data controller, sm77 determines the purposes and means by which your personal data is processed and is responsible for ensuring that processing is carried out in accordance with applicable Philippine data protection law.

sm77's designated Data Protection Officer (DPO) oversees compliance with the Data Privacy Act of 2012 (RA 10173) and its implementing rules, and is the point of contact for all data privacy inquiries and requests from Account Holders. Contact details for the DPO are provided in Section 14 of this policy.

sm77 collects personal data through multiple channels — directly from you during registration and use of the platform, automatically through technical systems during your interaction with the platform, and in limited circumstances from third-party identity verification services. The categories of personal data collected by sm77 include:

sm77 does not collect or process sensitive personal information as defined under RA 10173 (such as racial or ethnic origin, political opinion, religious beliefs, health data, or sexual orientation) unless specifically required by law or with your explicit consent.

sm77 processes your personal data only for the following specified, explicit, and legitimate purposes:

• Account registration and management: To create, verify, and maintain your sm77 Account Holder profile, including authentication of your identity and age.
• Payment processing: To process deposits to and withdrawals from your sm77 account via GCash, PayMaya, BDO, BPI, Metrobank, and cryptocurrency methods.
• Identity and age verification (KYC): To verify that you meet the minimum age requirement of 21 years as required under Philippine gaming law and PAGCOR regulations, and to conduct anti-money laundering (AML) checks.
• Platform operation and game delivery: To provide access to sm77's game library and platform services, including personalization of your account dashboard and game recommendations.
• Customer support: To respond to your inquiries, resolve disputes, and process complaints via live chat, email, and other support channels.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, and other security threats to the sm77 platform and its players.
• Legal and regulatory compliance: To comply with PAGCOR licensing requirements, anti-money laundering obligations under Republic Act No. 9160 (Anti-Money Laundering Act), the Data Privacy Act of 2012, and other applicable Philippine laws.
• Responsible gaming: To monitor player activity for signs of problem gambling behavior and to administer responsible gaming tools including deposit limits, session time controls, and self-exclusion as described in sm77's Responsible Gaming Policy.
• Marketing and promotions: To send you information about sm77 bonuses, promotions, and new features where you have consented to receive such communications. You may withdraw this consent at any time by contacting sm77 support.
• Platform improvement: To analyze aggregated and anonymized usage data for the purposes of improving sm77's platform, game library, and user experience.

sm77 processes your personal data on the following legal bases as recognized under the Data Privacy Act of 2012 (RA 10173) and its implementing rules:

• Performance of a contract: Processing necessary to establish and perform the Account Holder agreement between you and sm77, including account management, game access, and payment processing.
• Legal obligation: Processing required to comply with sm77's obligations under applicable Philippine law, including PAGCOR regulations, AML requirements, and data protection law.
• Legitimate interests: Processing necessary for sm77's legitimate interests in operating a secure and fair gaming platform, including fraud prevention, security monitoring, and responsible gaming oversight, where these interests are not overridden by your rights and interests.
• Consent: Processing for marketing communications and non-essential analytics cookies, where you have provided specific, informed, and freely given consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

sm77 does not sell, rent, or trade your personal data to third parties for commercial purposes. Personal data may be shared with the following categories of recipients only to the extent necessary for the specified purpose:

• Payment service providers: GCash, PayMaya, BDO, BPI, and Metrobank — for the purpose of processing deposits and withdrawals. These providers operate under their own privacy policies and are subject to Philippine financial sector regulation.
• Identity verification service providers: Third-party KYC and AML screening services that assist sm77 in verifying Account Holder identities and conducting required regulatory checks.
• Game software providers: Providers whose games are available in the sm77 lobby (such as Pragmatic Play, NetEnt, and Play'n GO) may receive limited technical session data necessary to deliver and verify game outcomes.
• IT and infrastructure service providers: Cloud hosting, cybersecurity, and platform infrastructure providers who process data on sm77's behalf under data processing agreements that require them to protect your data.
• Regulatory authorities: PAGCOR, the National Privacy Commission (NPC), the Anti-Money Laundering Council (AMLC), and other Philippine government authorities where disclosure is required by law, court order, or regulatory directive.
• Professional advisors: Legal, accounting, and audit firms engaged by sm77, subject to professional confidentiality obligations.

sm77 retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following retention periods and legal obligations:

• Account data: Retained for the duration of your active sm77 account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AML obligations under RA 9160.
• Transaction records: Financial transaction records are retained for a minimum of five (5) years as required by the Anti-Money Laundering Act and applicable PAGCOR regulations.
• KYC and identity verification documents: Retained for the period required by applicable law, which under current AMLC and PAGCOR guidelines is a minimum of five (5) years from account closure or the end of the relevant business relationship.
• Support communications: Customer support records are retained for a minimum of three (3) years to facilitate dispute resolution and quality assurance.
• Technical and usage data: Retained for up to two (2) years for the purposes of security monitoring, fraud detection, and platform improvement, after which data is anonymized or deleted.
• Marketing consent records: Retained for the duration of your consent and for a reasonable period thereafter as evidence of the consent granted.

At the end of the applicable retention period, personal data is securely deleted or anonymized in accordance with sm77's data deletion procedures.

sm77 implements organizational, technical, and physical security measures appropriate to the nature of the personal data it processes and the risks to Account Holders if such data were to be compromised. These measures include:

• 256-bit SSL/TLS encryption applied to all data transmitted between your device and sm77's servers — the same encryption standard used by Philippine banks and major fintech platforms.
• Encryption of sensitive data at rest, including financial information and identity documents stored on sm77's infrastructure.
• Access controls and authentication: Access to personal data within sm77 is restricted to authorized personnel on a need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Account security features available to Account Holders including two-factor authentication via SMS OTP, login anomaly alerts, and automatic session timeouts.
• Penetration testing and security audits conducted regularly to identify and remediate vulnerabilities in sm77's platform infrastructure.
• Incident response procedures to detect, contain, and respond to data security incidents, including breach notification protocols in accordance with NPC reporting requirements under RA 10173.

While sm77 takes all reasonable precautions to protect your personal data, no online platform can guarantee absolute security. In the event that sm77 becomes aware of a data breach that is likely to give rise to a real risk of serious harm to any affected individual, sm77 will notify the National Privacy Commission and affected Account Holders in accordance with the notification requirements of RA 10173.

sm77 uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files placed on your device when you visit sm77.club. They serve the following functions:

• Strictly necessary cookies: Required for the platform to function, including session management, login authentication, and security tokens. These cannot be disabled without preventing access to core platform features.
• Functional cookies: Remember your preferences such as language settings, game display preferences, and responsible gaming tool configurations.
• Analytics cookies: Collect aggregated and anonymized information about how players use the sm77 platform, enabling sm77 to identify areas for improvement. These are used only with your consent.
• Security cookies: Support sm77's fraud detection and security monitoring systems by identifying unusual access patterns or suspicious session behavior.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the sm77 platform. sm77 does not use third-party advertising tracking cookies or share cookie data with advertising networks.

The sm77 platform operates with infrastructure and service providers that may involve the transfer of personal data to countries outside the Philippines. Where such transfers occur, sm77 takes appropriate steps to ensure that your personal data receives adequate protection in the receiving country, including:

• Entering into data transfer agreements with receiving parties that include contractual data protection clauses recognized under RA 10173 and NPC guidelines.
• Transferring data only to jurisdictions that the National Privacy Commission has recognized as providing an adequate level of personal data protection.
• Ensuring that cross-border transfers to game software providers and infrastructure partners are governed by data processing agreements that impose equivalent security and privacy obligations.

sm77 does not transfer your personal data to jurisdictions where adequate safeguards cannot be put in place. A list of the jurisdictions to which data may be transferred is available on request from the sm77 Data Protection Officer.

The sm77 platform is strictly intended for adults aged 21 years and above. sm77 does not knowingly collect or process personal data from individuals under the age of 21. Registration on sm77 constitutes a representation and warranty by the Account Holder that they are at least 21 years of age.

Where sm77 discovers or has reasonable grounds to believe that an Account Holder is under 21 years of age, it will immediately suspend the account, retain sufficient data to support the investigation and any regulatory reporting obligations, and permanently close the account. Any balance in an underage account will be handled in accordance with applicable PAGCOR directives.

If a parent or guardian becomes aware that their child has registered on sm77, they should contact the sm77 Data Protection Officer immediately using the contact details in Section 14. sm77 will take immediate steps to close the account and delete any personal data collected, subject to any legal retention obligations.

Under the Data Privacy Act of 2012 (RA 10173) and its implementing rules and regulations, you have the following rights with respect to your personal data held by sm77:

• Right to be informed: You have the right to be informed of how your personal data is being collected and processed by sm77. This Privacy Policy fulfills that obligation.
• Right of access: You may request a copy of the personal data sm77 holds about you, including information about the purposes of processing and the categories of data held.
• Right to rectification: You may request that sm77 correct any inaccurate or incomplete personal data held about you. Minor details such as contact information can often be updated directly in your sm77 account settings.
• Right to erasure ("right to be forgotten"): Subject to sm77's legal retention obligations (see Section 6), you may request deletion of your personal data. sm77 will comply with such requests where it is not prevented from doing so by applicable law.
• Right to restriction of processing: You may request that sm77 restrict the processing of your personal data in certain circumstances, such as while a dispute about the accuracy of the data is being resolved.
• Right to data portability: You may request that sm77 provide your personal data in a commonly used, machine-readable format to enable transfer to another service provider where technically feasible.
• Right to object: You may object to certain types of processing, including processing for marketing purposes. Such objections must be honored immediately where marketing processing is concerned.
• Right to indemnity: You have the right to seek compensation for any damage suffered as a result of inaccurate, incomplete, outdated, false, or unlawfully obtained personal data used by sm77 in connection with your account.

To exercise any of these rights, contact the sm77 Data Protection Officer using the details in Section 14. sm77 aims to respond to all verifiable data subject requests within thirty (30) calendar days. Requests may be subject to identity verification before they are processed.

If you believe that sm77 has not handled your personal data in accordance with this Privacy Policy or applicable Philippine data protection law, you should first raise your concern directly with the sm77 Data Protection Officer as described in Section 14. sm77 takes all privacy complaints seriously and will investigate and respond to complaints in good faith.

If you remain dissatisfied with sm77's response, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the government agency responsible for administering and enforcing the Data Privacy Act of 2012. The NPC can be contacted at its official offices or through the channels published on the NPC website.

You also retain the right to seek redress through the Philippine court system for any violation of your rights under RA 10173.

sm77 may update this Privacy Policy from time to time to reflect changes in the platform, changes in applicable law, or changes in how we process personal data. The effective date at the top of this document indicates when the current version came into force.

Where changes to this Privacy Policy are material — meaning they could significantly affect your rights or the way your data is processed — sm77 will notify Account Holders via the registered email address or via a prominent notice displayed upon login to the sm77 platform before the changes take effect.

Your continued use of the sm77 platform after the effective date of any update constitutes your acknowledgment of the revised Privacy Policy. The most current version is always available at sm77.club/privacy-policy.

For all data privacy inquiries, requests to exercise your data subject rights, privacy complaints, or questions about how sm77 processes your personal data, please contact the sm77 Data Protection Officer:

Please include your registered Philippine mobile number and the subject line "Data Privacy Request" in your email or chat message so that we can verify your identity and process your request efficiently.