1. Who We Are — Data Controller
1.1 FBMO does not currently have a designated Data Protection Officer. All data protection enquiries should be directed to support@fbmo.net. FBMO will endeavour to respond to all data subject enquiries within thirty (30) calendar days of receipt. FBMO will keep its obligation to appoint a Data Protection Officer under Article 37 GDPR under review as its user base and processing activities develop.
1.2 FBMO does not sell personal data to third parties. This Policy describes all material circumstances in which personal data is shared with third parties.
1.3 Reports of suspicious activity, where required under applicable AML law, are made to the Cayman Islands Financial Reporting Authority ("FRA") under the Proceeds of Crime Act (2020 Revision). Where required by foreign law applicable to FBMO (including international sanctions law), parallel reporting may be made to OFAC, UK OFSI, or equivalent authorities. FBMO is legally prohibited from notifying users when such reports are made.
2. Data We Collect and Why
2.1 FBMO collects personal data across several categories, depending on how you interact with the platform.
Category A — Registration Data
2.2 When you create a User Account, FBMO collects:
2.2.1 Full legal name — required to enable FBMO to fulfil its sanctions screening and AML compliance obligations;
2.2.2 Country of residence — required for the same sanctions screening and AML compliance purposes, and to determine eligibility;
2.2.3 Email address — used as your unique account identifier and as the primary channel for all official communications; and
2.2.4 Login credentials (hashed password) — used for account access and security. Passwords are stored in hashed form and are not accessible to FBMO personnel.
2.3 Provision of full legal name, country of residence, and email address is mandatory. Formal sanctions screening is conducted at the point of each payout request using the data collected at registration, as described in Clause 6.
Category B — Identity Verification Data (KYC)
2.4 Prior to processing any payout request, FBMO may request:
2.4.1 Government-issued photo identification (e.g., passport or national identity card);
2.4.2 Proof of address (e.g., utility bill or bank statement dated within three months);
2.4.3 Payment account documentation (e.g., bank account details, PayPal account, cryptocurrency wallet, or Razorpay account verification); and
2.4.4 Date of birth and/or national identification number — collected only where necessary to resolve potential matches against international sanctions lists (false positives) as described in Clause 6. This data is requested only upon admission to the Funded Account or where a specific sanctions hold arises during payout processing. It is not collected at registration as a matter of course.
2.5 Identity verification data is processed for AML compliance, verifying eligibility to receive Rewards, and resolving sanctions screening holds. It is not used for any other purpose without your explicit consent.
Category C — Performance Data
2.6 During your use of the platform, FBMO collects data relating to your simulated betting activity, including:
2.6.1 Simulated bet history (selections, stakes, markets, sports, and outcomes);
2.6.2 Market selection patterns and timing behaviour;
2.6.3 Risk management indicators (drawdown profile, stake sizing, consistency metrics); and
2.6.4 Progress metrics (profit progress, valid bet count, trading day count).
2.7 Performance data constitutes a genuine commercial asset to FBMO's business and is the primary basis on which Rewards are paid to participants. Performance data is used for internal research, analytical model development, and product improvement. Anonymised versions of this data may be shared with third parties for business analytics purposes. 'Anonymised' for these purposes means data processed in accordance with recognised anonymisation standards (including Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques or its successor guidance) such that it cannot reasonably be used to identify individual users.
Category D — Payment Data
2.8 When you submit a payout request, FBMO collects:
2.8.1 Payment account details corresponding to the payout method selected by the participant, which may include bank account details (account holder name, IBAN or account number, sort code or SWIFT/BIC code), PayPal account identifier, cryptocurrency wallet address, or Razorpay account details.
2.9 Payment data is used solely for the purpose of processing approved Reward payments.
Category E — Technical and Device Data
2.10 FBMO automatically collects technical data when you access the Website:
2.10.1 IP address — used to detect Restricted Jurisdiction access, VPN circumvention, and duplicate accounts;
2.10.2 Device fingerprint — technical characteristics of your device used for fraud detection purposes;
2.10.3 Browser fingerprint — browser-level identifiers used to supplement device fingerprinting; and
2.10.4 Log data — including access timestamps, pages visited, and actions taken on the platform.
2.11 Technical and device data is used exclusively for platform security, fraud prevention, and compliance purposes. It is not used for behavioural advertising.
Category F — Communications Data
2.12 When you contact FBMO via email or Telegram, FBMO retains records of those communications for the purposes of resolving queries, processing complaints, maintaining records of appeals, and complying with legal obligations.
3. Legal Basis for Processing (GDPR — EU/EEA Users)
3.1 For users located in the European Union or European Economic Area, FBMO processes personal data on the following legal bases under Article 6 GDPR:
Data category: Registration data (full name, country of residence, email address) Purpose: Account management; eligibility verification; sanctions screening and AML compliance. Legal basis: Art. 6(1)(b) — performance of contract Art. 6(1)(c) — legal obligation
Data category: Identity verification data (KYC documents, date of birth, national ID) Purpose: AML compliance; payout eligibility verification; sanctions false-positive resolution. Legal basis: Art. 6(1)(c) — legal obligation Art. 6(1)(f) — legitimate interests
Data category: Performance data (bet history, market selection patterns, timing, risk indicators) Purpose: Platform operation; internal research; analytical model development; product improvement. Legal basis: Art. 6(1)(b) — performance of contract Art. 6(1)(f) — legitimate interests
Data category: Payment data (bank account, PayPal, cryptocurrency wallet, or Razorpay details) Purpose:
Processing approved Reward payments. Legal basis: Art. 6(1)(b) — performance of contract
Data category: Technical and device data (IP address, device/browser fingerprints, log data) Purpose: Fraud prevention; duplicate-account and VPN detection; platform security. Legal basis: Art. 6(1)(f) — legitimate interests
Data category: Communications data (emails, support messages) Purpose: Query resolution; complaints handling; appeals processing; legal compliance. Legal basis: Art. 6(1)(b) — performance of contract Art. 6(1)(f) — legitimate interests
Data category: Sanctions screening logs (timestamps, results, outcomes) Purpose: Audit trail for international sanctions compliance obligations. Legal basis: Art. 6(1)(c) — legal obligation
Data category: PEP screening records Purpose: AML compliance under FATF Recommendation 12 and Cayman AML Regulations. Legal basis: Art. 6(1)(c) — legal obligation
Data category: Meta Pixel data (advertising and retargeting) Purpose: Advertising effectiveness measurement; Meta advertising ecosystem. Legal basis: Art. 6(1)(a) — consent (EU/EEA/UK users) Art. 6(1)(f) — legitimate interests (other users)
3.2 Where FBMO relies on legitimate interests (Art. 6(1)(f)), FBMO has assessed that its legitimate interests in platform security, fraud prevention, sanctions compliance, and product development are not overridden by the data subject's interests or fundamental rights and freedoms, given the limited and proportionate nature of the data processed.
3.3 Where FBMO relies on legal obligation (Art. 6(1)(c)), this refers to FBMO's obligations under the Cayman Islands Data Protection Act (2021 Revision), the Cayman Islands Anti-Money Laundering Regulations (2023 Revision), the Proceeds of Crime Act (2020 Revision), applicable international sanctions law (including OFAC regulations), and AML requirements.
4. How We Use Your Data
4.1 FBMO uses the personal data it collects for the following purposes:
4.1.1 Account management and service provision;
4.1.2 Sanctions screening and AML compliance;
4.1.3 Identity verification;
4.1.4 Payment processing;
4.1.5 Platform research and development (using anonymised performance data);
4.1.6 Fraud prevention and platform integrity;
4.1.7 Communications and legal notices; and
4.1.8 Legal compliance and reporting, including compliance with the Cayman Islands Data Protection Act, AML regulations, international sanctions requirements, and applicable tax reporting obligations.
4.2 FBMO does not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on users, except for the automated sanctions screening process described in Clause 6, which is always subject to mandatory human review before any adverse action is taken.
4.3 FBMO does not use personal data for its own behavioural advertising or targeted marketing campaigns. However, FBMO uses the Meta Pixel (fbevents.js) on the Website, which may result in data being shared with Meta Platforms, Inc. for purposes that include Meta's own advertising ecosystem. For EU/EEA and UK users, this use is subject to prior consent as described in Clause 9.
5. Data Sharing and Disclosure
5.1 FBMO does not sell personal data. FBMO shares personal data with third parties only in the following circumstances:
Meta Platforms, Inc. (Meta Pixel)
5.2 FBMO uses the Meta Pixel on the Website, which transmits data about your visit to Meta Platforms, Inc. For EU/EEA and UK users, this data sharing occurs only with your prior consent, as described in Clause 9. Meta's privacy policy is available at https://www.facebook.com/privacy/policy/.
Payment Processors
5.3 FBMO shares payment data with the relevant payment processor or financial institution solely for the purpose of processing approved Reward payments.
Sanctions Screening and AML Service Providers
5.4 FBMO uses a third-party sanctions screening service provider to conduct automated screening prior to payout processing. This provider receives only the data necessary to perform the screening and is contractually prohibited from using that data for any other purpose.
Analytics and Business Intelligence Providers
5.5 FBMO may share anonymised and aggregated performance data with third-party analytics providers. No personally identifiable information is shared for these purposes.
Law Enforcement and Regulatory Authorities
5.6 FBMO may disclose personal data to law enforcement agencies, regulatory authorities, or other competent bodies where required to do so by applicable law, including:
5.6.1 Reports of suspicious activity to the Cayman Islands Financial Reporting Authority (FRA) or other competent authorities as required under the Cayman Islands Anti-Money Laundering Regulations (2023 Revision) and the Proceeds of Crime Act (2020 Revision). FBMO IS LEGALLY PROHIBITED FROM NOTIFYING THE USER WHEN SUCH A REPORT IS MADE ("tipping-off" prohibition), and this Policy constitutes general advance notice of the possibility that such reporting may occur;
5.6.2 Where FBMO determines that a participant is a sanctioned person or entity, reports to relevant sanctions authorities as required under applicable law. FBMO is similarly legally prohibited from notifying the user in such cases; and
5.6.3 Any other disclosure required by a court order, regulatory requirement, or competent authority.
5.7 The legal basis for disclosures to law enforcement and regulatory authorities is compliance with a legal obligation (GDPR Art. 6(1)(c) and the Cayman Islands Data Protection Act). FBMO will not make such disclosures beyond what is required by law.
Corporate Transactions
5.8 In the event of a merger, acquisition, restructuring, or sale of all or part of FBMO's business, personal data may be transferred to the relevant successor entity. FBMO will provide reasonable notice to users and will ensure that the successor entity is bound by data protection obligations no less protective than those in this Policy.
6. Sanctions Screening and AML Compliance
6.1 Prior to processing any payout request, FBMO conducts automated screening of the participant's full legal name and country of residence against the following international sanctions lists, using a third-party screening service updated on a regular basis in line with the screening service provider's standard refresh cycle:
6.1.1 OFAC Specially Designated Nationals (SDN) List;
6.1.2 OFAC Non-SDN Consolidated Sanctions List;
6.1.3 UN Security Council Consolidated Sanctions List;
6.1.4 EU Financial Sanctions List (as maintained by the European Commission);
6.1.5 UK OFSI Consolidated List of Financial Sanctions Targets; and
6.1.6 The Cayman Islands sanctions regime, including measures imposed under the Cayman Islands Sanctions Regulations and any sanctions measures extended to the Cayman Islands by applicable law.
6.2 All screening checks are logged with timestamps and retained for audit purposes for a minimum period of five (5) years from the date of the screening check.
6.3 WHERE A POTENTIAL MATCH IS GENERATED: the payout will be placed on hold and the participant will be notified within two (2) Business Days. FBMO will complete manual review within ten (10) Business Days of the hold being applied. FBMO may request additional identifying information — including date of birth or national identification number — to assist in resolving the hold.
6.4 FALSE POSITIVE OUTCOME: if manual review confirms that the match is a false positive, the payout will be released and processed within the standard timeframe. Additional identifying data collected solely for the purpose of resolving a false positive will be deleted within thirty (30) calendar days of the resolution, unless retention is required by applicable law.
6.5 CONFIRMED SANCTIONS MATCH: if FBMO determines that the participant is a sanctioned person or entity, the payout will be permanently blocked, the accrued Reward balance will be frozen, and FBMO will take such further action as may be required under applicable law. FBMO is legally prohibited from notifying the user when a report is made to a regulatory authority.
6.6 FBMO's obligation to comply with applicable international sanctions law takes precedence over any contractual obligation to process a payout.
6.7 In connection with its AML compliance obligations, FBMO may also conduct screening of participants against PEP lists in accordance with the Cayman Islands AML Regulations (2023 Revision) and FATF Recommendation 12. Where a participant is identified as a PEP or close associate of a PEP, FBMO may apply enhanced due diligence measures.
6.8 FBMO may also monitor transaction patterns, Challenge Fee payment history, and payout request behaviour for indicators of potential financial crime. Where suspicious activity is identified, FBMO may request additional documentation, suspend the User Account, or make a report to the FRA or other relevant authorities.
7. International Data Transfers
7.1 FBMO is incorporated in the Cayman Islands. Personal data collected from users located in the European Union, United Kingdom, or other jurisdictions may be transferred to and processed in other countries in connection with FBMO's operations and third-party service providers. The Cayman Islands does not currently hold a general adequacy decision from the European Commission.
7.2 For transfers of personal data from the EU/EEA or the United Kingdom to the Cayman Islands (where FBMO Ltd. is incorporated and processes data), and to any other country, FBMO relies on the following transfer mechanisms:
7.2.1 Standard Contractual Clauses (SCCs) as adopted by the European Commission Implementing Decision (EU) 2021/914 (or the equivalent UK International Data Transfer Agreement / Addendum), executed with FBMO Ltd. acting as data importer and/or onward data exporter as applicable, and, where applicable, third-party processors as further importers. FBMO maintains records of executed SCCs and makes them available to data subjects upon request at support@fbmo.net;
7.2.2 Supplementary measures where required following the assessment under Schrems II (CJEU Case C-311/18), including technical measures (encryption in transit and at rest), contractual measures (data processor obligations), and organisational measures (access controls and audit logs); and
7.2.3 Derogations under GDPR Article 49 only in respect of occasional, non-systematic transfers, including where the transfer is necessary for the performance of a contract (Art. 49(1)(b)) or for the establishment, exercise, or defence of legal claims (Art. 49(1)(e)).
7.3 For transfers necessitated by FBMO's legal obligations — in particular, international sanctions compliance and AML reporting — such transfers are based on legal obligation (Art. 6(1)(c)) and the derogation in Art. 49(1)(d) (transfers necessary for important reasons of public interest).
7.4 You may request further information about the transfer mechanisms applicable to your data by contacting support@fbmo.net.
8. Data Retention
8.1 FBMO retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:
Data category: Full legal name and country of residence Retention period: Account active + 5 years post-closure. Basis: AML compliance; Cayman Data Protection Act; international sanctions audit requirements.
Data category: Email address and login credentials Retention period: Account active + 2 years post-closure. Basis: Contractual obligation; dispute resolution.
Data category: KYC identity documents (passport, proof of address) Retention period: 5 years from collection or date of last payout, whichever is later. Basis: Cayman AML Regulations (2023 Revision); regulatory requirements.
Data category: Date of birth / national identification number Retention period: 5 years from collection or last payout, whichever is later, when collected at payout under Clause 13.7. 30 calendar days from resolution of hold when collected solely to resolve a sanctions false positive under Clause 6.4. Basis: Cayman AML Regulations (routine payout collection); Proportionality and privacy by design (false-positive resolution).
Data category: Performance data (bet history, market selection patterns) Retention period: Account active + 3 years post-closure. Anonymised data retained indefinitely. Basis: Legitimate interests (research and product development).
Data category: Payment data (bank account, PayPal, cryptocurrency wallet, or Razorpay details) Retention period: 5 years from date of last payout. Basis: Proceeds of Crime Act; AML financial record-keeping.
Data category: Technical and device data (IP addresses, fingerprints, log data) Retention period: 2 years from date of collection. Basis: Fraud prevention; platform security.
Data category: Sanctions screening logs (timestamps and results) Retention period: Minimum 5 years from date of screening check. Basis: Cayman AML Regulations; international sanctions compliance audit.
Data category: PEP screening records Retention period: 5 years from date of screening. Basis: Cayman AML Regulations (2023 Revision); FATF Recommendation 12.
Data category: Communications data (emails, support messages) Retention period: 3 years from date of communication. Basis: Legitimate interests (dispute resolution).
Data category: AML suspicious activity records Retention period: 5 years from date of report. Basis: Proceeds of Crime Act; AML legal obligation.
Data category: Meta Pixel and advertising cookie data Retention period: Subject to Meta's own data retention policy; revoked on consent withdrawal. Basis: Consent (EU/EEA/UK users); legitimate interests (other users).
8.2 Upon account termination, FBMO will begin the deletion process for data that has reached the end of its retention period within a reasonable timeframe, typically within ninety (90) calendar days of the account closure date.
8.3 Anonymised performance data is retained indefinitely and is not subject to deletion requests, as it has been processed in accordance with recognised anonymisation standards (including Article 29 Working Party Opinion 05/2014) and cannot reasonably be used to identify individual users.
9. Cookies and Technical Tracking
9.1 FBMO uses cookies and similar tracking technologies on the Website. Cookies are small text files stored on your device. The following categories apply:
Strictly Necessary Cookies
9.2 Required for the basic operation of the Website and platform. No consent is required for strictly necessary cookies.
Functional Cookies
9.3 Used to remember your preferences and settings across sessions. Where required by applicable law, your consent will be obtained before these cookies are placed.
Analytics Cookies
9.4 FBMO may use analytics tools to collect aggregated, anonymised data about how users interact with the Website. Where required by applicable law — including for EU/EEA users under the ePrivacy Directive — your prior consent will be obtained before analytics cookies are placed.
Advertising and Third-Party Tracking — Meta Pixel
9.5 The Meta Pixel is currently inactive and is not loaded on the Website. It will only be deployed once a compliant consent management platform is in place. The following describes how the Meta Pixel operates when active. FBMO uses the Meta Pixel (fbevents.js), a tracking technology provided by Meta Platforms, Inc. ("Meta"). The Meta Pixel transmits data about your visit to Meta's servers and may be used by Meta for purposes that include: measuring the effectiveness of FBMO's advertising campaigns; building advertising audiences; and supporting Meta's own advertising ecosystem. FBMO does not control how Meta uses this data once transmitted. Meta's privacy policy is available at https://www.facebook.com/privacy/policy/.
9.6 FOR USERS LOCATED IN THE EU/EEA AND THE UNITED KINGDOM: the Meta Pixel will not be loaded on your session without your prior, freely given, specific, informed, and unambiguous consent, obtained through a consent management platform ("CMP") displayed on your first visit to the Website. You may withdraw your consent at any time through the cookie preference centre accessible on the Website.
9.7 FOR USERS LOCATED OUTSIDE THE EU/EEA AND THE UNITED KINGDOM: the Meta Pixel may be active by default. You may opt out through Meta's privacy settings at https://www.facebook.com/settings/?tab=ads.
9.8 The legal basis for loading the Meta Pixel is: consent (GDPR Art. 6(1)(a) and ePrivacy Directive) for EU/EEA and UK users; and legitimate interests for users in other jurisdictions.
Managing Your Cookie Preferences
9.9 You may also disable cookies through your browser settings. In addition to cookies, FBMO collects IP addresses, device fingerprints, and browser fingerprints for fraud prevention purposes, as described in Clause 2.10. These technical identifiers are collected on the legal basis of legitimate interests independently of your cookie consent choices.
10. Your Rights — EU/EEA Users (GDPR)
10.1 If you are located in the European Union or European Economic Area, you have the following rights under the GDPR:
10.1.1 Right of access (Art. 15): right to request a copy of the personal data FBMO holds about you;
10.1.2 Right to rectification (Art. 16): right to request correction of inaccurate or incomplete personal data;
10.1.3 Right to erasure (Art. 17): right to request deletion where data is no longer necessary or processing is unlawful. This right is subject to legal obligations requiring FBMO to retain certain data (e.g., AML records and sanctions screening logs under Cayman Islands law);
10.1.4 Right to restriction of processing (Art. 18): right to request restriction in certain circumstances;
10.1.5 Right to data portability (Art. 20): right to receive personal data in a structured, machine-readable format where processing is based on contract or consent and carried out by automated means;
10.1.6 Right to object (Art. 21): right to object to processing based on legitimate interests; and
10.1.7 Rights regarding automated decision-making (Art. 22): FBMO does not make decisions with legal or similarly significant effects based solely on automated processing. The automated sanctions screening process is always subject to mandatory human review before any adverse action is taken.
10.2 To exercise any of the above rights, please submit a written request to support@fbmo.net. FBMO will respond within thirty (30) calendar days.
10.3 If you are not satisfied with FBMO's response, you have the right to lodge a complaint with your national data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
11. Your Rights — Other Users
11.1 Users located outside the EU/EEA may also have rights under the data protection laws of their jurisdiction. FBMO is committed to handling personal data responsibly and will consider reasonable requests from all users to access, correct, or delete their personal data, subject to FBMO's legal obligations to retain certain data under the Cayman Islands Data Protection Act (2021 Revision) and applicable AML legislation.
11.2 FBMO extends reasonable privacy rights to users in all jurisdictions as a matter of good practice. FBMO continuously reviews its compliance obligations under applicable privacy regimes and adapts its practices as its business develops.
11.3 To submit a data request, please contact support@fbmo.net. FBMO will respond within thirty (30) calendar days.
12. Data Security
12.1 FBMO implements technical and organisational security measures including:
12.1.1 Encryption of data in transit using TLS/HTTPS protocols;
12.1.2 Hashing of user passwords — FBMO personnel do not have access to plaintext passwords;
12.1.3 Access controls limiting internal access to personal data to personnel who require it;
12.1.4 Regular review of security practices and third-party service provider agreements; and
12.1.5 Logging and monitoring of access to sensitive data systems.
12.2 In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, FBMO will notify the relevant supervisory authority within seventy-two (72) hours of becoming aware of the breach, where required by applicable law (GDPR Art. 33; Cayman Islands Data Protection Act). Where the breach is likely to result in a HIGH RISK to the rights and freedoms of data subjects, FBMO will also notify the affected individuals WITHOUT UNDUE DELAY in accordance with GDPR Article 34.
12.3 You are responsible for maintaining the confidentiality of your Account Credentials. If you believe your account has been compromised, notify FBMO immediately at support@fbmo.net.
13. Children's Privacy
13.1 The Services are not directed at persons under eighteen (18) years of age. FBMO does not knowingly collect personal data from minors. The minimum age under this Policy and the FBMO Terms (18 years) is higher than the age of digital consent under GDPR Article 8 (16 years in most EU member states), and the contractual minimum age of 18 prevails for all purposes under this Policy and the FBMO Terms.
13.2 If you are a parent or guardian and believe that your child has provided personal data to FBMO, please contact support@fbmo.net immediately.
14. Changes to This Policy
14.1 FBMO reserves the right to update this Policy at any time. Material changes will be notified to registered users via their registered email address or through the User Account dashboard at least seven (7) calendar days before the changes take effect.
14.2 Your continued use of the Services after the effective date of any update constitutes acceptance of the updated Policy.
15. Contact and Complaints
15.1 For all privacy-related queries, data subject requests, and complaints regarding FBMO's handling of personal data, please contact: FBMO Ltd. 123 Church Street, George Town, KY1-1102, Cayman Islands Website: https://fbmo.net Email: support@fbmo.net Telegram: https://t.me/fbmo_support
15.2 FBMO will acknowledge all privacy-related enquiries within five (5) Business Days and will endeavour to resolve them within thirty (30) calendar days. For complex requests, FBMO may extend this period by a further thirty (30) calendar days.
15.3 If you are not satisfied with FBMO's response to a privacy-related enquiry or data subject request, you have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction. For EU/EEA users, a list of national supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. The Cayman Islands supervisory authority for data protection matters is the Ombudsman. Current contact details are published by the Cayman Islands Government. The right to complain to the Ombudsman is available to all data subjects whose personal data is processed by FBMO, regardless of their country of residence, to the extent provided by the Cayman Islands Data Protection Act (2021 Revision).