buenas Privacy Policy

1. About This Policy

This Privacy Policy ("Policy") describes how buenas.one ("buenas," "we," "us," or "our") collects, uses, stores, and discloses personal data about individuals ("you," "your," or "Player") who access or use the buenas online gaming platform, including all games, services, promotions, and content available at buenas.one.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Philippine Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). By registering for a buenas account or otherwise using the buenas platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read together with the buenas Terms & Conditions, which govern your use of the platform. Capitalized terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

2. Data We Collect

buenas collects the following categories of personal data about you:

2.1 Identity and Registration Data

• Full legal name;
• Date of birth (to verify the 21+ age requirement);
• Gender;
• Nationality;
• Government-issued identification number (e.g., Philippine passport number, SSS/ UMID, driver's license number);
• Username and password (stored in hashed form).

2.2 Contact Data

• Email address;
• Mobile phone number;
• Residential address (city, province, postal code);
• City of residence (e.g., Manila, Cebu, Davao, Quezon City, Makati).

2.3 Financial Data

• Deposit and withdrawal transaction history;
• Payment method details (e.g., GCash mobile number, PayMaya account reference, BPI/BDO/Metrobank account details — stored only to the extent necessary for transaction processing and verification);
• Account balance and wagering history;
• Source of funds declarations where required for compliance purposes.

2.4 Technical and Usage Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session duration and login timestamps;
• Pages visited and features used on the buenas platform;
• Game play history and betting patterns;
• Referral source and marketing attribution data.

2.5 Communications Data

• Records of communications between you and the buenas support team, including live chat transcripts and email correspondence;
• Responses to surveys, promotions, or feedback requests.

2.6 Sensitive Personal Information

In limited circumstances, buenas may collect sensitive personal information as defined under the DPA, including government-issued identification numbers and financial account details, solely for the purpose of identity verification and regulatory compliance. Such data is handled with the heightened protections required by the DPA.

3. How We Collect Your Data

buenas collects personal data through the following means:

3.1 Directly from You

When you register for a buenas account, complete KYC verification, make a deposit or withdrawal, contact the support team, participate in a promotion, or otherwise interact with the buenas platform, you provide personal data directly to buenas.

3.2 Automatically

When you access buenas.one, buenas automatically collects technical and usage data through cookies, web beacons, pixel tags, and similar tracking technologies. This includes your IP address, device identifiers, browser type, and behavioral data about how you interact with the platform.

3.3 From Third Parties

buenas may receive personal data about you from the following third-party sources:

• Payment processors (e.g., GCash, PayMaya, BPI, BDO, Metrobank) — to confirm transaction status and verify payment method ownership;
• Identity verification and KYC service providers — to validate government-issued identification documents;
• Fraud prevention and anti-money laundering screening services;
• Marketing and analytics partners — to understand how players discover buenas;
• Regulatory authorities — where required by law.

4. How We Use Your Data

buenas uses your personal data for the following purposes:

5. Legal Basis for Processing

buenas processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012:

• Consent: Where you have given your explicit consent to the processing of your personal data for a specific purpose, such as receiving marketing communications or the processing of sensitive personal information.
• Contractual Necessity: Where processing is necessary to perform the contract between you and buenas — specifically, to operate your account, process transactions, and deliver platform services.
• Legal Obligation: Where processing is required to comply with a legal obligation applicable to buenas, including PAGCOR licensing conditions, AML regulations, and tax reporting requirements.
• Legitimate Interests: Where processing is necessary for the legitimate interests of buenas, such as fraud prevention, platform security, and responsible gaming monitoring, provided those interests are not overridden by your rights and interests.

6. Sharing Your Data

buenas does not sell your personal data to third parties. buenas may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data protection obligations:

6.1 Service Providers

buenas engages trusted third-party service providers to assist in operating the platform, including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), KYC and identity verification providers, cloud hosting and infrastructure providers, customer support software providers, and analytics and fraud prevention services. These providers are contractually bound to process your data only on buenas's instructions and in accordance with applicable data protection law.

6.2 Regulatory and Law Enforcement Authorities

buenas may disclose your personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, law enforcement agencies, or other government authorities where required by law, court order, or regulatory directive, or where buenas reasonably believes disclosure is necessary to protect the rights, property, or safety of buenas, its players, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of buenas's business, your personal data may be transferred to the relevant successor entity. You will be notified of any such transfer and of any material changes to this Policy that result from it.

6.4 With Your Consent

buenas may share your personal data with other third parties where you have given your explicit consent to such sharing.

7. Data Retention

buenas retains your personal data for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

As a general guide, buenas applies the following retention periods:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with PAGCOR and AMLC record-keeping requirements.
• Transaction and financial data: Retained for a minimum of five (5) years following the date of the transaction, in accordance with applicable AML and tax regulations.
• Communications data: Retained for up to three (3) years from the date of the communication, unless a longer period is required for dispute resolution or legal proceedings.
• Technical and usage data: Retained for up to twenty-four (24) months from collection, after which it is anonymized or deleted.
• Marketing consent records: Retained for the duration of your consent and for a reasonable period thereafter to demonstrate compliance.

Where personal data is no longer required, buenas will securely delete or anonymize it in accordance with its internal data disposal procedures.

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files placed on your device when you visit buenas.one. They allow the platform to recognize your device, remember your preferences, and collect information about how you use the site. buenas also uses similar technologies such as web beacons, pixel tags, and local storage objects.

8.2 Types of Cookies Used

• Essential Cookies: Required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against fraud. These cannot be disabled without affecting platform functionality.
• Performance Cookies: Collect anonymized data about how players use buenas.one, such as which pages are visited most often. This data helps buenas improve platform performance and user experience.
• Functional Cookies: Remember your preferences, such as language settings and display options, to provide a more personalized experience.
• Analytics Cookies: Used to understand player behavior in aggregate, measure the effectiveness of features, and guide platform development decisions.

8.3 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the buenas platform. Instructions for managing cookies are available in the help documentation of your browser (Chrome, Firefox, Safari, Edge, or your mobile browser on Android or iOS).

9. Data Security

buenas implements a range of technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and buenas.one;
• Encryption of sensitive data at rest, including passwords (stored using one-way hashing) and payment details;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Regular security assessments, penetration testing, and vulnerability scanning;
• Multi-factor authentication for administrative access to buenas systems;
• Incident response procedures for detecting, reporting, and managing personal data breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, buenas will notify the National Privacy Commission and affected players in accordance with the requirements of the DPA and NPC regulations.

10. Your Rights Under the Data Privacy Act

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by buenas:

• Right to be Informed: You have the right to be informed about how your personal data is collected, used, and shared — which is the purpose of this Policy.
• Right of Access: You have the right to request a copy of the personal data buenas holds about you and information about how it is processed.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held by buenas.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to buenas's legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission if you believe buenas has violated your data privacy rights.

To exercise any of these rights, please contact the buenas Data Privacy Officer at the contact details provided in Section 14. buenas will respond to your request within the timeframe required by applicable law.

11. Children's Privacy

The buenas platform is strictly intended for adults aged 21 years and above. buenas does not knowingly collect personal data from individuals under the age of 21. If buenas becomes aware that personal data has been collected from a person under 21, buenas will take immediate steps to delete that data and close the associated account.

If you are a parent or guardian and believe that a minor has registered for a buenas account or provided personal data to buenas, please contact the support team immediately at the details provided in Section 14.

12. Cross-Border Data Transfers

buenas primarily stores and processes personal data within the Philippines. In some cases, personal data may be transferred to and processed by service providers located outside the Philippines — for example, cloud infrastructure providers or international KYC verification services.

Where personal data is transferred outside the Philippines, buenas ensures that appropriate safeguards are in place to protect your data in accordance with the DPA and NPC regulations. These safeguards may include contractual data protection clauses, adequacy assessments, or other mechanisms recognized under Philippine data protection law.

13. Changes to This Policy

buenas reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or buenas's data processing practices. The date of the most recent revision is indicated at the top of this page.

Where changes are material, buenas will provide reasonable advance notice to registered players via email or a prominent notice on the buenas platform. Your continued use of the buenas platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

buenas encourages you to review this Policy periodically to stay informed about how your personal data is being protected.

14. Contact and Complaints

If you have any questions about this Privacy Policy, wish to exercise your data privacy rights, or want to raise a concern about how buenas handles your personal data, please contact the buenas Data Privacy Officer:

If you are not satisfied with buenas's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines: