mm77 Casino Privacy Policy

Scope & Data Controller

This Privacy Policy applies to all personal data collected, processed, stored, and used by mm77 in connection with the mm77 online gaming platform accessible at mm77.bio and all associated services, features, and communications provided to registered and prospective players.

mm77 acts as the Data Controller in respect of your personal information, as defined under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 of the Philippines (hereinafter "RA 10173"), and its Implementing Rules and Regulations. mm77 is subject to the oversight of the National Privacy Commission (NPC) of the Philippines with respect to its personal data processing activities.

This Policy governs data processed in relation to all Filipino players and any other individuals whose personal information is handled by mm77 in the course of its operations, including but not limited to account holders, identity verification subjects, and support correspondents.

Personal Data We Collect

mm77 collects personal data in several categories depending on the nature of your interaction with the platform. The following table outlines the categories of personal data collected and their purpose at the point of collection:

mm77 does not collect special categories of sensitive personal data as defined under RA 10173 (such as health information, racial or ethnic origin, political opinions, or biometric data) unless specifically required for regulatory identity verification purposes and with explicit consent where applicable.

How We Collect Your Data

mm77 collects personal data through the following channels and mechanisms:

• Direct provision by you: Information you enter during account registration, KYC document submission, deposit and withdrawal requests, support communications, promotional participation, and responsible gaming tool activation.
• Automated collection during platform use: Technical and usage data collected automatically through server logs, session tracking, and platform analytics when you access mm77 via browser or mobile device.
• Cookie and tracking technologies: First-party cookies, session tokens, and similar technologies used to maintain your login session, remember preferences, and monitor platform performance. See Section 9 for full cookie details.
• Payment processors: Transaction confirmation data and payment method references received from GCash, PayMaya, and Philippine bank partners as part of deposit and withdrawal processing.
• Identity verification services: Where required for KYC compliance, mm77 may use third-party identity verification service providers to validate government-issued Philippine identification documents.
• Third-party game providers: Game session and outcome data generated within games provided by certified third-party providers operating within the mm77 platform.

Purpose & Legal Basis of Processing

mm77 processes personal data only where a legitimate legal basis exists under RA 10173. The following table sets out the primary purposes of data processing and the corresponding legal bases relied upon:

Data Sharing & Third-Party Disclosure

mm77 does not sell, rent, or commercially trade your personal data. Personal information is shared only with the following categories of recipients, strictly on a need-to-know basis and where a legitimate purpose and legal basis exist:

• Payment processors and e-wallet providers: GCash (Mynt), PayMaya (Voyager Innovations), BPI, BDO, Metrobank, and other Philippine financial institutions — data shared is limited to what is required to process your specific transaction.
• Certified game providers: Third-party game studios and RNG providers who power games available on mm77 receive anonymized or pseudonymized session data necessary for game operation, RTP audit, and technical support.
• Identity verification services: Third-party KYC providers engaged by mm77 for document validation and age verification — only the identification data relevant to the verification process is shared.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and Philippine law enforcement agencies — where legally required or obligated under PAGCOR's licensing conditions.
• Platform infrastructure and security providers: Cloud hosting, cybersecurity, and fraud detection service providers who process data on behalf of mm77 under binding data processing agreements with equivalent privacy protections.
• Legal and professional advisers: External legal counsel, auditors, and compliance consultants where necessary for dispute resolution, regulatory filings, or enforcement of mm77's rights.

Cross-Border Data Transfers

Certain data processing activities — particularly those involving certified international game providers, cloud infrastructure providers, and cybersecurity services — may involve the transfer of personal data outside the Republic of the Philippines.

Where such transfers occur, mm77 ensures they are conducted in compliance with RA 10173 and NPC regulations governing cross-border data flows. Specifically, mm77 takes appropriate safeguards including: contractual clauses requiring the overseas recipient to provide protection equivalent to RA 10173 standards; verification that the destination jurisdiction has adequate data protection laws; or explicit consent from the data subject where required.

For the avoidance of doubt, KYC identity document data and Philippine financial transaction records are processed and stored on infrastructure located within or contractually governed by Philippine law obligations wherever operationally feasible.

Data Retention

mm77 retains personal data only for as long as necessary to fulfill the purpose for which it was collected or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active account data: Retained for the full duration of your mm77 account and for a minimum of 5 years following account closure, in compliance with PAGCOR record-keeping requirements.
• Financial transaction records: Retained for a minimum of 5 years from the date of the transaction as required under Philippine Anti-Money Laundering Act (AMLA) obligations.
• KYC and identity verification documents: Retained for a minimum of 5 years post-account closure, or longer if required by PAGCOR audit or regulatory investigation.
• Gaming session and activity records: Retained for a minimum of 5 years for regulatory audit purposes and dispute resolution.
• Support and communication records: Retained for a minimum of 3 years from the date of the communication for dispute resolution and service quality purposes.
• Cookies and session data: Session cookies expire at the end of each browser session. Persistent cookies are retained for periods specified in Section 9.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized using industry-standard data destruction methods. Data that has been anonymized to a standard where individual re-identification is not reasonably possible may be retained for platform analytics and service improvement indefinitely.

Security Measures

mm77 implements a multi-layered information security framework to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Security measures include, but are not limited to, the following:

• Encryption in transit: All data transmitted between your device and mm77's servers is encrypted using 256-bit TLS/SSL encryption — the same standard used by Philippine online banking portals.
• Encryption at rest: Sensitive personal data stored in mm77's databases, including identity documents and financial references, is encrypted at rest using industry-standard algorithms.
• Access controls: Access to personal data is restricted on a strict need-to-know basis using role-based access control (RBAC). Personnel with data access are subject to confidentiality obligations and regular security training.
• Password security: User passwords are never stored in plain text. mm77 uses one-way cryptographic hashing with salting to store password credentials.
• Two-factor authentication: Two-factor authentication (2FA) via SMS OTP is available for all mm77 accounts and is strongly recommended for all players.
• Fraud and anomaly detection: Real-time monitoring systems flag unusual login activity, suspicious transaction patterns, and potential account compromise for immediate investigation.
• Penetration testing and security audits: mm77's platform infrastructure is subject to periodic third-party security assessments.

Cookies & Tracking Technologies

mm77 uses first-party cookies and similar browser-based technologies to operate the platform effectively. No third-party advertising cookies are used on mm77. The following cookie categories are used:

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using core mm77 platform features. mm77 does not use cookies to deliver third-party advertising or to track your activity on websites outside of mm77.bio.

Your Data Subject Rights

Under RA 10173, you have the following rights in relation to the personal data mm77 holds about you. These rights may be exercised by contacting mm77's Data Protection Officer as described in Section 14.

mm77 will respond to data subject requests within 30 days of receipt. In complex cases requiring additional investigation, mm77 may extend this period by a further 30 days with written notification to the requester. Data subject requests that are manifestly unfounded or excessive may be refused with written explanation.

If you are not satisfied with mm77's response to a data subject request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

Minors & Age Protection

mm77 does not knowingly collect personal data from individuals under the age of 21. Under PAGCOR regulations and Philippine law, access to real-money online gaming is restricted to adults aged 21 years and above. mm77 employs age verification processes as part of account registration and KYC review to enforce this requirement.

If mm77 becomes aware that personal data has been collected from a person under 21 years of age, the relevant account will be immediately suspended, all associated data will be reviewed and handled in accordance with child data protection obligations under RA 10173, and any real funds deposited will be returned in accordance with applicable law.

Data Breach Notification Procedures

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, mm77 will comply with the breach notification requirements under RA 10173 and NPC Circular No. 16-03 (Personal Data Breach Management).

Specifically, mm77 will notify the National Privacy Commission within 72 hours of becoming aware of a qualifying breach, as required. Where the breach is likely to present a high risk to the rights and freedoms of affected data subjects, mm77 will also notify affected individuals without undue delay, via their registered email address or in-platform notification, providing information on the nature of the breach, the data affected, likely consequences, and the measures mm77 has taken or proposes to take to address it.

mm77 maintains an incident response plan specifically addressing data security events, including procedures for containment, impact assessment, notification, and remediation. All suspected or confirmed data security incidents are managed by mm77's designated Data Protection Officer.

Changes to This Privacy Policy

mm77 reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance from PAGCOR or the NPC, platform feature additions, or operational changes that affect data processing activities.

Where amendments are material — meaning they substantively affect your rights or the manner in which your data is processed — mm77 will provide advance written notice to registered players via the email address on file and/or through a prominent notice on the platform prior to the revised Policy taking effect. The effective date of any revised Privacy Policy will be clearly displayed at the top of the document.

Continued use of mm77 following notice of a material Privacy Policy update constitutes your acknowledgment of the revised Policy. If you do not agree with any material changes, you may close your account as described in mm77's Terms & Conditions.

Contact & Data Protection Officer

mm77 has designated a Data Protection Officer (DPO) in compliance with RA 10173 requirements. The DPO is responsible for overseeing mm77's data protection compliance, handling data subject requests, managing data breach response, and liaising with the National Privacy Commission.

To exercise any of your data subject rights, raise a privacy concern, or report a potential data security issue, please contact mm77 through the following channels:

You also have the right to escalate unresolved privacy concerns to the National Privacy Commission of the Philippines. The NPC accepts complaints through its official channels as published on the NPC's official government website. mm77 cooperates fully with any NPC inquiry or investigation.