Privacy Policy

§1 Who We Are

spin7 is an online gaming platform operating at spin7.asia, licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR). For the purposes of the Philippine Data Privacy Act of 2012, spin7 acts as the Personal Information Controller (PIC) in respect of the personal data it collects from Players and visitors to the Platform.

spin7 has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with applicable data privacy laws and handling data-related inquiries and complaints. Contact details for the DPO are provided in Section 14 of this Policy.

§2 Data We Collect

spin7 collects the following categories of personal data from Players and Platform visitors:

spin7 does not collect sensitive personal information (as defined under the Data Privacy Act) beyond what is strictly necessary for KYC compliance and PAGCOR regulatory requirements.

§3 How We Collect Data

spin7 collects personal data through the following means:

• Direct interactions: Data you provide when registering an Account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated technologies: Technical data collected automatically when you access the Platform, including through cookies, web beacons, and server logs. See Section 8 for details on our cookie practices.
• Third-party sources: Identity and fraud-screening data from KYC verification providers, payment data from GCash, Maya, and banking partners, and fraud-prevention data from third-party security services.
• PAGCOR and regulatory sources: Information shared by PAGCOR or other regulatory bodies as required for licensing compliance, responsible gaming enforcement, or player protection purposes.

§4 Why We Use Your Data

spin7 uses your personal data for the following purposes:

• Account management: To create, maintain, and secure your spin7 Account, including authentication and password recovery.
• KYC and age verification: To verify that you are at least 21 years of age and to confirm your identity, as required by PAGCOR regulations.
• Payment processing: To process deposits and withdrawals via GCash, Maya, and Philippine bank transfers, and to maintain accurate financial records.
• Game provision: To deliver the games, features, and services available on the spin7 Platform and to maintain game integrity.
• Regulatory compliance: To comply with PAGCOR licensing requirements, anti-money laundering (AML) obligations under Republic Act No. 9160 (as amended), and other applicable Philippine laws.
• Responsible gaming: To monitor gaming activity for signs of problem gambling, enforce self-exclusion requests, and administer deposit limits and cooling-off periods.
• Customer support: To respond to your inquiries, resolve disputes, and improve the quality of our support services.
• Marketing and promotions: To send you relevant promotional offers and updates, where you have consented to receive such communications. You may opt out at any time.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent activity, unauthorized access, and other security threats to the Platform.
• Platform improvement: To analyze usage patterns and technical performance data to improve the spin7 Platform for all Filipino players.

§5 Legal Basis for Processing

Under the Philippine Data Privacy Act of 2012, spin7 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfill our obligations under the spin7 Terms & Conditions, including Account management, game provision, and payment processing.
• Legal obligation: Processing required to comply with PAGCOR regulations, AML laws, tax obligations, and other applicable Philippine legal requirements.
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

§6 Sharing Your Data

spin7 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following circumstances:

• Payment processors: GCash, Maya, and Philippine banking partners receive the financial data necessary to process your deposits and withdrawals.
• KYC and identity verification providers: Third-party KYC service providers receive identity documents and data to perform age and identity verification on spin7's behalf.
• Game providers: Third-party game studios and live dealer providers may receive anonymized or pseudonymized session data necessary to deliver their games on the Platform.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies may receive data as required by law or regulatory order.
• IT and security service providers: Cloud hosting, cybersecurity, and fraud-prevention vendors who process data on spin7's behalf under strict data processing agreements.
• Legal proceedings: Courts, law enforcement agencies, or legal advisors where disclosure is required by a valid court order, subpoena, or applicable law.

All third-party service providers who process personal data on spin7's behalf are required to maintain appropriate technical and organizational security measures and to process data only in accordance with spin7's instructions.

§7 Data Retention

spin7 retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods required by Philippine law:

• Account and KYC data: Retained for a minimum of five (5) years from the date of Account closure, as required by PAGCOR regulations and AML obligations under Republic Act No. 9160.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AML reporting requirements.
• Game session logs: Retained for a minimum of three (3) years for dispute resolution and regulatory audit purposes.
• Customer support communications: Retained for two (2) years from the date of the last interaction, for quality assurance and dispute resolution purposes.
• Marketing consent records: Retained for the duration of your Account plus three (3) years, to demonstrate compliance with consent requirements.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with spin7's data disposal procedures.

§8 Cookies & Tracking

The spin7 Platform uses cookies and similar tracking technologies to operate correctly, remember your preferences, and analyze Platform usage. The types of cookies we use are:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies and security tokens. These cannot be disabled.
• Functional cookies: Remember your language preferences, display settings, and responsible gaming configurations between sessions.
• Analytics cookies: Collect anonymized data about how Players use the Platform — such as pages visited and session duration — to help us improve the user experience. Used only with your consent.
• Marketing cookies: Used to deliver relevant promotional content within the spin7 Platform. Used only with your consent.

You may manage your cookie preferences through the cookie settings panel available on the Platform. Disabling non-essential cookies will not affect your ability to use the core features of spin7. Note that blocking strictly necessary cookies may impair Platform functionality.

§9 Data Security

spin7 implements industry-standard technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the spin7 Platform.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Regular third-party security audits and penetration testing of the Platform's infrastructure.
• Multi-factor authentication (MFA) for all internal systems that process personal data.
• Incident response procedures aligned with the National Privacy Commission's breach notification requirements under the Data Privacy Act.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, spin7 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected Players without undue delay, in accordance with NPC Circular No. 16-03.

While spin7 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for keeping your Account credentials confidential and for notifying spin7 immediately if you suspect unauthorized access to your Account.

§10 Your Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in respect of your personal data held by spin7:

• Right to be informed: The right to know what personal data spin7 collects about you and how it is used — which is the purpose of this Privacy Policy.
• Right of access: The right to request a copy of the personal data spin7 holds about you.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to erasure: The right to request deletion of your personal data, subject to spin7's legal retention obligations under PAGCOR regulations and AML law.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe spin7 has violated your data privacy rights.

To exercise any of these rights, please contact spin7's Data Protection Officer using the contact details in Section 14. spin7 will respond to all verified requests within fifteen (15) business days, as required by the Data Privacy Act. We may need to verify your identity before processing your request.

§11 Children's Privacy

The spin7 Platform is strictly intended for persons who are 21 years of age or older, in accordance with PAGCOR regulations governing online gambling in the Philippines. spin7 does not knowingly collect personal data from individuals under 21 years of age.

If spin7 discovers that personal data has been collected from a person under 21 years of age, the relevant Account will be immediately closed, all data will be deleted in accordance with our data disposal procedures, and any deposits will be returned to the original payment source. If you believe a minor has registered on the spin7 Platform, please contact us immediately at the details provided in Section 14.

§12 Cross-Border Transfers

Some of spin7's third-party service providers — including cloud infrastructure providers, KYC verification platforms, and game studios — may process personal data outside of the Philippines. Where such cross-border data transfers occur, spin7 ensures that appropriate safeguards are in place, including:

• Contractual clauses requiring the recipient to apply data protection standards equivalent to those required under the Philippine Data Privacy Act.
• Transfers only to jurisdictions or organizations that the National Privacy Commission has recognized as providing adequate data protection.
• Data processing agreements with all third-party processors that impose binding obligations on data handling, security, and confidentiality.

By using the spin7 Platform, you acknowledge and consent to the transfer of your personal data to third-party processors in other jurisdictions, subject to the safeguards described above.

§13 Changes to This Policy

spin7 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, spin7 will notify registered Players via email or an in-platform notification at least seven (7) days before the changes take effect, where practicable.

The effective date at the top of this page will always reflect the date of the most recent revision. We encourage you to review this Privacy Policy periodically. Your continued use of the spin7 Platform after any changes constitutes your acceptance of the revised Policy.

§14 Contact & DPO

If you have any questions, concerns, or requests regarding this Privacy Policy or spin7's data practices, please contact our Data Protection Officer:

Data Protection Officer — spin7
Email: [email protected]
General Support: [email protected]

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines (NPC) if you believe your data privacy rights have been violated. The NPC can be reached through its official government website and published contact channels.