hybet Privacy Policy

In this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" / "Personal Information" refers to any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information, would directly and certainly identify an individual. This definition is consistent with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines.
• "Sensitive Personal Information" refers to personal information about an individual's race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations, health, education, genetic or sexual life, proceedings for any offence, government-issued identification numbers, and financial information, as defined in RA 10173.
• "Processing" refers to any operation or set of operations performed upon personal data, including collection, recording, organisation, storage, updating, modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction of data.
• "Data Controller" refers to hybet as the entity that controls the collection, holding, processing, or use of personal data in relation to the Platform.
• "Data Processor" refers to any natural or legal person, public authority, agency, or other body that processes personal data on behalf of hybet.
• "NPC" refers to the National Privacy Commission of the Philippines, the independent government body established under RA 10173 to administer and enforce data privacy laws.
• "PAGCOR" refers to the Philippine Amusement and Gaming Corporation.
• "Platform" refers to the hybet website at hybet.biz and all services made available thereon.

The data controller responsible for your personal information is hybet, the operator of hybet.biz. hybet is a PAGCOR-regulated online gaming operator serving Filipino players across the Philippines.

As data controller, hybet determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable Philippine law, including the Data Privacy Act of 2012 and its Implementing Rules and Regulations (IRR), as well as PAGCOR's data handling requirements for licensed operators.

hybet has designated a Data Protection Officer (DPO) responsible for overseeing data privacy compliance. Contact details for the DPO are provided in Section 17 of this Policy.

hybet collects the following categories of personal data from Filipino players and Platform users:

hybet collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical and device data collected automatically when you access the Platform, including through cookies, server logs, and analytics tools. See Section 8 for details on cookie usage.
• Third-party sources: Identity verification data may be cross-referenced with third-party KYC verification partners and public records where permitted by Philippine law. PAGCOR's self-exclusion registry is checked at registration and periodically thereafter.
• Payment processors: Transactional data associated with GCash, Maya, bank transfers, and other approved payment channels is shared with hybet by the respective payment service providers to the extent necessary to process and record transactions.

Under the Data Privacy Act of 2012, hybet processes your personal data on the following legal bases:

hybet uses the personal data it collects for the following identified purposes:

• Account administration: Creating, maintaining, and managing your hybet account, including authentication, password management, and account recovery;
• Identity and age verification: Confirming that you meet the minimum age requirement of 21 years and verifying your identity as required by PAGCOR and AML regulations;
• Payment processing: Processing your GCash, Maya, bank transfer, and other approved deposit and withdrawal transactions, including fraud screening and transaction monitoring;
• Gaming services: Providing access to games, recording game outcomes, calculating and awarding winnings, and applying bonuses and promotions to your account;
• Regulatory compliance: Fulfilling hybet's reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), and other Philippine regulatory authorities;
• Responsible gaming: Monitoring gaming behaviour for indicators of problem gambling, enforcing responsible gaming tools you have activated, and complying with PAGCOR's responsible gaming requirements;
• Customer support: Responding to your inquiries, resolving disputes, and maintaining records of communications;
• Security and fraud prevention: Detecting, investigating, and preventing fraudulent, unauthorised, or illegal activity on the Platform;
• Service improvement: Analysing aggregated usage data to improve the Platform's performance, user experience, and game offerings;
• Marketing (with consent): Sending promotional offers, bonus notifications, and Platform updates to Filipino players who have opted in to marketing communications.

hybet does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared with third parties only in the following circumstances:

• Payment service providers: GCash (operated by G-Xchange, Inc.), Maya (PayMaya Philippines, Inc.), BPI, BDO, Metrobank, and other approved payment channels receive transactional data necessary to process your deposits and withdrawals;
• KYC and identity verification partners: Third-party verification service providers may process your identity documents and biometric data to confirm your identity and age as required by PAGCOR and AML regulations;
• Game software providers: Game developers and live dealer studio operators receive gaming session data necessary to deliver game services. These providers are contractually prohibited from using player data for any purpose other than game delivery;
• Regulatory authorities: PAGCOR, the AMLC, the NPC, and other competent Philippine government authorities may receive personal data pursuant to hybet's legal obligations or in response to lawful requests;
• Law enforcement: Philippine law enforcement agencies may receive personal data in response to lawful court orders, subpoenas, or official investigations;
• IT and infrastructure providers: Cloud hosting, cybersecurity, and technical infrastructure providers who process personal data on hybet's behalf under data processing agreements that impose equivalent data protection obligations;
• Professional advisers: Lawyers, auditors, and other professional advisers to hybet who are bound by confidentiality obligations.

All third-party data processors engaged by hybet are required to implement appropriate technical and organisational security measures and are prohibited from processing personal data for any purpose beyond that specified in their data processing agreements with hybet.

hybet uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device when you visit the Platform. Cookies enable the Platform to recognise your device, maintain your login session, and collect analytical data about how the Platform is used.

You may manage cookie preferences through your browser settings. Note that disabling certain cookies may impair Platform functionality. Detailed cookie information is available in hybet's Cookie Policy, accessible from the Platform's footer.

hybet implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data it processes. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and hybet's servers;
• AES-256 encryption at rest for all stored personal data and Sensitive Personal Information;
• Role-based access controls limiting employee access to personal data to those with a demonstrable business need;
• Multi-factor authentication for all administrative access to systems that process personal data;
• Regular penetration testing and vulnerability assessments by qualified cybersecurity professionals;
• Continuous monitoring of Platform systems for unauthorised access attempts and anomalous activity;
• Annual security awareness training for all staff with access to personal data;
• Documented incident response procedures in compliance with the NPC's data breach notification requirements.

While hybet takes all reasonable technical and organisational precautions to protect your personal data, no internet transmission or electronic storage system is entirely secure. You also bear responsibility for maintaining the security of your hybet account credentials, as described in the Terms and Conditions.

hybet retains personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with hybet's data deletion procedures. Data that is subject to a legal hold, active dispute, regulatory investigation, or pending legal proceedings will be retained until the relevant matter is concluded.

As a data subject under the Data Privacy Act of 2012, Filipino players have the following rights with respect to personal data held by hybet. These rights may be exercised by submitting a written request to hybet's Data Protection Officer using the contact details in Section 17.

hybet's Platform and services are strictly intended for individuals aged 21 years and above. hybet does not knowingly collect personal data from any person under the age of 21. This restriction applies to all Philippine players regardless of parental consent or other circumstances.

Where hybet becomes aware that personal data has been collected from a person under the age of 21 — whether through a registration attempt, KYC review, or other means — that data will be immediately deleted and the associated account registration will be refused or terminated in accordance with hybet's Terms and Conditions.

If you are a parent or guardian and believe that a person in your care under the age of 21 may have attempted to register with or access hybet's Platform, please contact hybet's customer support immediately so that appropriate action can be taken.

With your consent, hybet may send you promotional communications including bonus offers, game announcements, and Platform updates. Marketing communications are sent via SMS, email, and in-Platform notifications to your registered mobile number and email address.

You may opt out of marketing communications at any time by:

• Updating your notification preferences in your hybet account settings;
• Replying "STOP" to any promotional SMS message received from hybet;
• Clicking the unsubscribe link in any promotional email from hybet;
• Contacting hybet's customer support team via live chat.

Opting out of marketing communications does not affect transactional messages — you will continue to receive account-related notifications such as deposit confirmations, withdrawal processing updates, security alerts, and customer support responses, as these are necessary for the operation of your account.

hybet does not send unsolicited bulk commercial messages and complies with the anti-spam provisions of applicable Philippine law.

hybet has implemented a documented data breach response procedure in compliance with the National Privacy Commission's requirements under Circular No. 16-03 (Personal Data Breach Management). In the event of a personal data breach, the following process applies:

• Upon becoming aware of a potential breach, hybet's incident response team conducts an immediate assessment to determine the nature, scope, and likely consequences of the breach;
• Where the breach is likely to result in a real risk of serious harm to affected data subjects, hybet will notify the NPC within 72 hours of confirming the breach;
• Affected Filipino players will be notified without undue delay, in a clear and plain manner, describing the nature of the breach, the categories of data affected, the likely consequences, and the measures hybet has taken or proposes to take in response;
• All data breach incidents, whether notifiable or not, are documented in hybet's internal breach register and reviewed by the Data Protection Officer.

If you believe your personal data held by hybet has been compromised, or if you observe any suspicious activity on your account, contact hybet's customer support team immediately via live chat and change your account password without delay.

Some of hybet's third-party service providers — including game software developers, cloud infrastructure providers, and cybersecurity services — may be located or operate servers in countries outside the Philippines. Where personal data is transferred to a country that does not provide an equivalent level of data protection to the Philippines, hybet ensures that appropriate safeguards are in place, including:

• Data processing agreements requiring the recipient to observe data protection standards equivalent to those required under RA 10173;
• Contractual clauses approved by the NPC where applicable;
• Transfer to recipients in countries recognised as providing adequate protection for personal data.

By using hybet's Platform, you acknowledge and consent to the transfer of your personal data as described in this section, subject to the safeguards described above.

hybet may update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulations, hybet's data processing activities, or industry best practices. The date of the most recent revision is shown at the top of this Policy.

Where changes are material — including changes that affect the legal basis for processing, the categories of personal data collected, or the rights available to data subjects — hybet will notify registered Filipino players by email and via a notice on the Platform at least fourteen (14) days before the changes take effect, where practicable.

Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acknowledgment of and agreement to the revised terms. If you do not agree to the revised Policy, you must cease using the Platform and may close your account as described in hybet's Terms and Conditions.

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or have concerns about how hybet processes your personal data, please contact us through the following channels:

hybet will acknowledge all formal privacy requests within five (5) Philippine business days and provide a substantive response within thirty (30) calendar days. Complex requests may require up to sixty (60) calendar days, in which case hybet will notify you of the extended timeline and the reason for the delay.