sm777 Privacy Policy

01 Introduction

This Privacy Policy ("Policy") describes how sm777 ("sm777," "we," "us," or "our") collects, uses, stores, shares, and protects the personal data of individuals ("you," "the Player," or "the User") who access or use the sm777 online gaming platform available at sm777.live, including any associated subdomains, mobile-optimised versions, and related services.

sm777 operates in the Philippines and serves Filipino players. We are committed to handling your personal data responsibly and in accordance with applicable Philippine data protection law, including the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as well as any other applicable privacy legislation.

This Policy should be read alongside our Terms & Conditions, which govern your use of the sm777 platform. Capitalised terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

02 Data Controller

For the purposes of applicable data protection law, sm777 is the data controller responsible for the personal data collected through the sm777 platform. As data controller, sm777 determines the purposes and means of processing your personal data.

If you have any questions about how sm777 handles your personal data, or if you wish to exercise any of your data subject rights described in Section 11 of this Policy, you may contact our Data Protection Officer using the contact details provided in Section 14.

03 Personal Data We Collect

sm777 collects the following categories of personal data from players and platform users:

3.1 Identity & Contact Data

Full Name Date of Birth Gender Nationality Email Address Mobile Number Residential Address

This data is collected during account registration and KYC verification. It is used to verify your identity, confirm your eligibility to use the platform, and communicate with you about your account.

3.2 Identity Verification Documents

Government-Issued Photo ID Proof of Address Selfie / Liveness Check

Copies of government-issued identification documents (such as a Philippine passport, PhilSys National ID, SSS ID, UMID card, or driver's licence) and proof of address documents are collected as part of our mandatory KYC process. These documents are stored securely and used solely for identity verification and anti-money laundering compliance purposes.

3.3 Financial Data

GCash Account Details PayMaya Account Details Bank Account Details Transaction History Deposit & Withdrawal Records

Financial data is collected to process deposits and withdrawals, verify payment method ownership, and comply with anti-money laundering obligations. sm777 does not store full card numbers or complete bank account credentials on its servers.

3.4 Gaming & Behavioural Data

Game History Wager Amounts Win/Loss Records Session Duration Bonus Usage Loyalty Points

Gaming activity data is collected to operate the platform, calculate winnings and loyalty rewards, detect problem gambling patterns, and comply with regulatory reporting requirements.

3.5 Technical & Device Data

IP Address Device Type & OS Browser Type Geolocation Data Login Timestamps Session Logs

Technical data is collected automatically when you access the sm777 platform. It is used for security monitoring, fraud detection, platform optimisation, and to verify that you are accessing the platform from a permitted jurisdiction.

3.6 Communications Data

Records of your communications with sm777's customer support team, including live chat transcripts, email correspondence, and support ticket history, are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

04 How We Collect Your Data

sm777 collects personal data through the following means:

• Direct collection: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and device data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access the sm777 platform.
• Third-party sources: Identity verification data from KYC service providers; fraud and risk data from anti-fraud service providers; payment verification data from payment processors including GCash, PayMaya, BPI, BDO, and Metrobank.
• Publicly available sources: In limited circumstances, sm777 may supplement your data with information from publicly available sources for fraud prevention or compliance purposes.

05 How We Use Your Personal Data

sm777 uses your personal data for the following purposes:

sm777 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by law or where you have provided explicit consent.

06 Legal Basis for Processing

sm777 processes your personal data on the following legal bases under the Data Privacy Act of 2012 and applicable regulations:

• Contractual necessity: Processing required to perform our contract with you, including account management, payment processing, and delivery of gaming services.
• Legal obligation: Processing required to comply with applicable law, including anti-money laundering regulations, KYC requirements, age verification obligations, and regulatory reporting duties.
• Legitimate interests: Processing necessary for sm777's legitimate business interests, including fraud prevention, platform security, responsible gaming monitoring, and improving our services — provided these interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent, including marketing communications and certain cookie-based tracking. You may withdraw consent at any time without affecting the lawfulness of prior processing.

07 Data Sharing & Disclosure

sm777 does not sell your personal data to third parties. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• KYC and identity verification providers: Third-party services that assist with identity verification, document authentication, and age verification as part of our KYC process.
• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers necessary to process your deposits and withdrawals.
• Game content providers: Licensed game studios and live dealer operators who supply gaming content to the sm777 platform. These providers may receive limited gaming session data necessary to operate their games.
• Anti-fraud and security providers: Third-party services that assist sm777 in detecting and preventing fraud, money laundering, and other prohibited activities.
• Regulatory and law enforcement authorities: Government agencies, regulators, courts, and law enforcement bodies where disclosure is required by applicable law, court order, or regulatory direction.
• Professional advisers: Lawyers, auditors, accountants, and other professional advisers engaged by sm777 in connection with its business operations, subject to confidentiality obligations.

All third parties with whom sm777 shares personal data are required to handle that data in accordance with applicable privacy law and are prohibited from using it for any purpose other than the specific purpose for which it was shared.

08 Data Retention

sm777 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

As a general guide, sm777 applies the following retention periods:

• Account and identity data: Retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering regulations applicable in the Philippines.
• KYC verification documents: Retained for a minimum of five (5) years following the completion of the verification process or account closure, whichever is later.
• Financial transaction records: Retained for a minimum of five (5) years following the date of the transaction, in accordance with applicable financial record-keeping requirements.
• Gaming activity records: Retained for a minimum of three (3) years following account closure or the date of the last gaming activity, whichever is later.
• Customer support communications: Retained for a minimum of two (2) years following the resolution of the relevant support interaction.
• Marketing consent records: Retained for the duration of your account and for one (1) year following account closure or withdrawal of consent.
• Technical and device logs: Retained for up to twelve (12) months from the date of collection, unless retention for a longer period is required for security investigations or legal proceedings.

Upon expiry of the applicable retention period, sm777 will securely delete or anonymise your personal data in accordance with its data disposal procedures. Where data is anonymised rather than deleted, the anonymised data may be retained indefinitely for analytical and statistical purposes.

09 Security Measures

sm777 implements a comprehensive set of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the sm777 platform;
• Encryption at rest for sensitive personal data stored on sm777 servers, including identity documents and financial data;
• Access controls limiting access to personal data to authorised sm777 personnel on a strict need-to-know basis;
• Multi-factor authentication for internal systems that process personal data;
• Regular security audits and penetration testing conducted by independent third-party security specialists;
• Segregated player funds held in accounts separate from sm777's operational funds;
• Incident response procedures to detect, contain, and respond to data security incidents in a timely manner.

While sm777 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, sm777 will notify you and the relevant regulatory authority in accordance with applicable law.

You are responsible for maintaining the security of your sm777 account credentials. You should use a strong, unique password for your sm777 account and must not share your login details with any third party. If you suspect that your account has been compromised, please contact sm777 customer support immediately.

10 Cookies & Tracking Technologies

sm777 uses cookies and similar tracking technologies on its platform to enhance your user experience, maintain session security, and gather analytical data about platform usage. The following categories of cookies are used:

• Strictly necessary cookies: Essential for the operation of the sm777 platform, including session management, authentication, and security functions. These cookies cannot be disabled without affecting platform functionality.
• Functional cookies: Used to remember your preferences, such as language settings and display options, to provide a more personalised experience.
• Analytical cookies: Used to collect aggregated, anonymised data about how players use the sm777 platform, including pages visited, session duration, and navigation paths. This data helps sm777 improve platform performance and user experience.
• Marketing cookies: Used, with your consent, to deliver relevant promotional content and measure the effectiveness of sm777's marketing campaigns. You may opt out of marketing cookies at any time through your account settings or browser controls.

You can manage your cookie preferences through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the sm777 platform. Strictly necessary cookies cannot be disabled as they are essential for platform operation.

11 Your Data Subject Rights

Under the Data Privacy Act of 2012 and applicable regulations, you have the following rights in relation to your personal data held by sm777:

• Right to be informed: The right to be informed about how your personal data is collected and used, as set out in this Privacy Policy.
• Right of access: The right to request a copy of the personal data sm777 holds about you, along with information about how it is processed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data sm777 holds about you. You may update certain account details directly through your sm777 account settings.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to sm777's legal obligations to retain certain data.
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request that it be transmitted to another data controller where technically feasible.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on sm777's legitimate interests.
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe that sm777 has processed your personal data in violation of applicable privacy law.

To exercise any of the above rights, please contact sm777's Data Protection Officer using the contact details in Section 14. sm777 will respond to all valid data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, in which case sm777 will notify you of the extension and the reasons for it.

Please note that certain rights are subject to limitations and exceptions under applicable law. For example, sm777 may be unable to delete personal data that it is legally required to retain for anti-money laundering or regulatory compliance purposes.

12 Children's Privacy

The sm777 platform is strictly intended for adults aged 21 years and above, as required under Philippine law governing casino-style gambling and online gaming. sm777 does not knowingly collect personal data from individuals under the age of 21.

sm777 implements age verification controls as part of its KYC process to prevent underage individuals from accessing the platform. If sm777 becomes aware that it has inadvertently collected personal data from an individual under the age of 21, it will immediately close the associated account, return any deposited funds to the source payment method, and securely delete the personal data in question.

If you are a parent or guardian and believe that your child has registered an sm777 account, please contact our customer support team immediately using the contact details in Section 14.

13 Changes to This Privacy Policy

sm777 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is displayed at the top of this page.

Where changes to this Policy are material, sm777 will notify registered players via email or an in-platform notification prior to the changes taking effect. Your continued use of the sm777 platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms.

We encourage you to review this Privacy Policy periodically to stay informed about how sm777 protects your personal data. If you do not agree with any changes to this Policy, you should cease using the platform and may request account closure in accordance with the Terms & Conditions.

14 Contact & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or sm777's handling of your personal data, please contact our Data Protection Officer:

• Email: [email protected]
• Support: Visit our FAQ page or use the live chat feature within the sm777 platform
• Response time: sm777 aims to acknowledge all privacy-related enquiries within 48 hours and to provide a substantive response within 30 days

If you are not satisfied with sm777's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.