cbr191 Privacy Policy

cbr191 is an online gaming platform operating under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR). The cbr191 platform is accessible at cbr191.cam and is operated for the benefit of Filipino players across the Republic of the Philippines.

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, cbr191 acts as the Personal Information Controller (PIC) in respect of all personal data collected from players and platform visitors. As a PIC, cbr191 determines the purposes for which your personal data is collected, the means by which it is processed, and the conditions under which it is retained or deleted.

Where cbr191 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification services, or cloud infrastructure providers — those parties act as Personal Information Processors (PIPs) under written agreements that bind them to the data protection standards required by Philippine law and this Privacy Policy.

If you have any questions about cbr191's role as data controller, or wish to exercise any rights described in this policy, please contact our Data Protection Officer at the contact details provided in Section 15.

The following table sets out the categories of personal data cbr191 collects, organized by the context in which they are collected:

cbr191 does not collect sensitive personal information beyond what is described above. Specifically, cbr191 does not collect racial or ethnic origin, political opinions, religious beliefs, health data (other than responsible gaming-related disclosures voluntarily provided by the player), or biometric data beyond facial comparison performed as part of KYC identity verification.

cbr191 collects personal data through the following channels:

• Directly from you: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, participating in promotions, or updating your account settings.
• Automatically during platform use: Technical data collected by cbr191's servers and analytics systems when you access the platform — including IP address, device type, browser details, and session activity — regardless of whether you are logged in.
• From payment processors: Transaction confirmation data returned by GCash, Maya, bank payment gateways, and cryptocurrency networks when you deposit or withdraw funds. cbr191 receives confirmation status and transaction identifiers, not your full payment account credentials.
• From identity verification partners: Results of automated or manually reviewed identity verification checks conducted by cbr191's KYC partner, including confirmation of identity match, age, and document authenticity.
• From cookies and similar technologies: Session cookies, preference cookies, and analytics trackers as described in Section 10 of this Policy.

cbr191 uses personal data only for the purposes described below. We do not use personal data for any purpose that is incompatible with the purpose for which it was originally collected without your explicit consent.

• Account creation and management: To register your account, verify your identity, maintain your player profile, and provide access to cbr191's gaming and payment features.
• Payment processing: To process deposits, execute withdrawal requests, maintain transaction records, and resolve payment disputes.
• PAGCOR regulatory compliance: To meet the player data, reporting, and KYC obligations imposed on cbr191 as a PAGCOR-licensed operator. This includes maintaining records of player activity as required by PAGCOR.
• Anti-money-laundering (AML) compliance: To comply with the Anti-Money Laundering Act (AMLA), the Terrorism Financing Prevention and Suppression Act, and AMLC regulations, including player due diligence, transaction monitoring, and suspicious transaction reporting where required.
• Fraud prevention and platform security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, bonus abuse, and other prohibited conduct as described in the cbr191 Terms & Conditions.
• Responsible gaming: To implement and monitor responsible gaming tools including deposit limits, loss limits, cool-off periods, and self-exclusion, and to identify patterns of play that may indicate problem gambling.
• Customer support: To respond to support inquiries, resolve complaints, and improve the quality of cbr191's support service.
• Platform improvement and analytics: To analyze how players use cbr191, identify technical issues, optimize the user experience, and inform product development decisions.
• Marketing communications (with consent): To send promotional offers, bonus notifications, and platform updates to players who have opted in to marketing communications. You may withdraw this consent at any time from your account settings or by contacting support.

Under the Philippine Data Privacy Act of 2012, cbr191 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between cbr191 and you as a player — including account management, game provision, and payment processing. Without this processing, cbr191 cannot provide the service.
• Legal obligation: Processing required to comply with Philippine law — including PAGCOR licensing obligations, AMLA compliance, AMLC reporting requirements, and National Privacy Commission regulations.
• Legitimate interests: Processing necessary for cbr191's legitimate business interests where those interests are not overridden by your privacy rights — including fraud prevention, platform security, and analytics. cbr191 has conducted legitimate interests assessments for each such processing activity.
• Consent: Processing based on your freely given, specific, and informed consent — primarily marketing communications. You have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

cbr191 does not sell, rent, or trade your personal data. We share personal data only in the following circumstances, and only to the minimum extent necessary:

• Payment processors: GCash, Maya, BPI, BDO, Metrobank, and cryptocurrency network operators — to process your deposit and withdrawal transactions. Each processor handles your data subject to their own privacy policies and applicable Philippine financial regulations.
• Identity verification providers: Third-party KYC service providers engaged by cbr191 to conduct identity document verification and facial comparison checks. These providers process your ID documents and selfie data solely for verification purposes under written agreements with cbr191.
• Game content providers: Licensed game studios such as Pragmatic Play and Evolution Gaming, whose game engines integrate with cbr191. These providers may receive anonymized session data necessary to operate their games — they do not receive your full personal profile.
• Cloud infrastructure and security providers: Providers of the hosting, storage, and security infrastructure on which cbr191 operates. These providers act as personal information processors under binding data processing agreements.
• Regulatory and law enforcement authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine government authorities where cbr191 is legally required to disclose personal data — for example, in response to a lawful regulatory inquiry, court order, or mandatory suspicious transaction report.
• With your explicit consent: To any third party where you have provided clear, informed consent to that specific sharing.

All third parties with whom cbr191 shares personal data are required by contract to handle that data in accordance with applicable Philippine data protection law and cbr191's data protection standards.

Some of cbr191's third-party service providers — including certain game content providers and cloud infrastructure partners — operate systems located outside the Republic of the Philippines. Where personal data is transferred to a country that does not provide a level of data protection equivalent to Philippine law, cbr191 implements appropriate safeguards to protect your data, including:

• Contractual clauses that bind the recipient to data protection standards equivalent to those required under the Philippine Data Privacy Act.
• Transfer only to providers that maintain recognized international data security certifications such as ISO/IEC 27001.
• Transfer of only the minimum data necessary for the specific processing purpose.

Where required by the National Privacy Commission, cbr191 registers its cross-border data sharing arrangements. You have the right to request information about the specific safeguards applied to any international transfer of your personal data by contacting our Data Protection Officer.

cbr191 retains personal data for as long as is necessary for the purposes described in this policy, taking into account legal, regulatory, and business requirements. The following retention periods apply:

At the end of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be associated with any individual. Anonymized aggregate data may be retained beyond these periods for statistical and research purposes.

cbr191 implements a layered security architecture to protect your personal data against unauthorized access, disclosure, alteration, and destruction. Key security measures include:

• Encryption in transit: All data transmitted between your browser or device and cbr191's servers is encrypted using TLS 1.2 or higher (256-bit SSL), preventing interception during transmission.
• Encryption at rest: Personal data stored in cbr191's databases is encrypted at rest. Particularly sensitive data — including KYC documents and financial records — is subject to additional encryption layers.
• Access controls: Internal access to personal data is restricted on a strict need-to-know basis using role-based access controls. All data access by cbr191 staff is logged and subject to audit.
• Password security: Player passwords are stored as one-way hashed values using bcrypt with unique salts. cbr191 never stores or has access to your plaintext password.
• Two-factor authentication: cbr191 offers and encourages two-factor authentication for all player accounts, adding a second verification layer that protects against unauthorized access even if your password is compromised.
• Security monitoring: cbr191's systems are monitored continuously for unusual access patterns, intrusion attempts, and anomalous activity. Automated alerts trigger immediate investigation of suspected security events.
• Regular security reviews: cbr191's security architecture undergoes periodic independent review and penetration testing. Critical vulnerabilities are remediated within defined timelines.

Despite these measures, no online system is entirely immune to risk. In the event of a personal data breach that is likely to result in harm to affected players, cbr191 will notify the National Privacy Commission and affected individuals in accordance with the Data Privacy Act and NPC breach notification requirements.

cbr191 uses cookies and similar tracking technologies to operate the platform, maintain your session, and analyze usage patterns. The following types of cookies are used:

• Essential cookies: Strictly necessary for the cbr191 platform to function. These include session authentication cookies that keep you logged in during your visit and security cookies that help protect against cross-site request forgery. Essential cookies cannot be disabled without affecting platform functionality.
• Preference cookies: Store your platform preferences — such as language settings, responsible gaming tool configurations, and display preferences — so they persist across sessions.
• Analytics cookies: Collect anonymized data about how players navigate and use cbr191, helping the platform team identify technical issues and improve the user experience. Analytics data is aggregated and does not identify individuals.
• Security and fraud-prevention cookies: Help cbr191 identify and investigate unusual access patterns, track device consistency across login sessions, and support the platform's anti-fraud and anti-bot systems.

cbr191 does not use third-party advertising cookies or tracking technologies that would share your browsing behavior with advertisers.

Most browsers allow you to control cookie settings through the browser's preferences menu. Disabling essential cookies will affect your ability to use cbr191. Disabling analytics or preference cookies will not prevent you from using the platform but may affect the consistency of your experience.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by cbr191. To exercise any of these rights, contact cbr191's Data Protection Officer using the contact details in Section 15. cbr191 will respond to all rights requests within 30 calendar days of receipt.

cbr191 is strictly intended for individuals who are 21 years of age or older. The platform does not knowingly collect or process personal data from individuals under the age of 21.

Registration requires declaration of date of birth, and cbr191 enforces age verification as part of the KYC process before processing any withdrawal. Where cbr191 discovers or has reasonable grounds to believe that an account has been registered by a person under the age of 21, the account will be immediately suspended, all gameplay will be voided in accordance with PAGCOR requirements, and all deposits will be returned to the registered payment method following identity verification.

If you are a parent or guardian and believe that a minor has created an account on cbr191 using false date of birth information, please contact cbr191 support immediately. cbr191 treats underage registration as a serious compliance matter and will act promptly upon notification.

The cbr191 platform integrates with third-party services — including payment gateways and game content providers — to deliver the full gaming experience. These services operate under their own privacy policies and terms of service.

While cbr191 selects service providers that meet our data protection standards and binds them by contract to handle data appropriately, cbr191 is not responsible for the independent privacy practices of third-party organizations. We encourage you to review the privacy policies of any service you interact with directly — including your GCash or Maya account, your bank, or any other payment method you use in connection with cbr191.

cbr191 does not include links to external websites on the platform pages covered by this Privacy Policy, and this policy applies only to data collected and processed by cbr191 directly.

cbr191 may update this Privacy Policy from time to time to reflect changes in our data practices, changes in Philippine data protection law, updates to PAGCOR requirements, or improvements to our platform. The effective date at the top of this policy indicates when the current version came into force.

When we make material changes to this Privacy Policy — changes that affect how we use your personal data or the rights available to you — we will notify registered players via email to their registered email address and/or via an in-platform notification on next login, at least seven days before the changes take effect.

Minor updates — such as clarifications that do not change the substance of how we handle personal data — may be made without prior notification, though the effective date will always be updated. We encourage you to review this Privacy Policy periodically to stay informed of any changes.

Your continued use of cbr191 after the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated terms. If you do not accept the updated Privacy Policy, you should close your account and withdraw your remaining balance before the effective date.

cbr191 has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and with the Philippine Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Privacy Policy or to your personal data, please contact the cbr191 DPO through the following channels:

• Live Chat Support: Available 24/7 from within the cbr191 platform. For data rights requests, please indicate "Data Privacy Request" at the start of your chat message so the agent can escalate directly to the DPO team.
• Email: [email protected] — please include "Privacy Policy" or "Data Rights Request" in your subject line. The DPO team responds to data rights inquiries within 5 business days of receipt and provides a final response within 30 calendar days.

If your concern relates to a personal data breach, a suspected unauthorized disclosure of your information, or an urgent data security matter, please mark your communication as urgent. cbr191 treats data breach notifications with the highest priority and has dedicated response procedures for these situations.

If you are not satisfied with cbr191's response to a data rights request or privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. The NPC's mandate includes investigating complaints against personal information controllers and issuing binding orders where violations are found. Contact details for the National Privacy Commission are publicly available on the NPC's official website.

This Privacy Policy was last reviewed and updated on 1 January 2026 and supersedes all previously published versions of the cbr191 Privacy Policy.