spin7 Privacy Policy

1Who We Are and How to Contact Us

spin7 ("spin7," "we," "our," or "the Company") operates the online gaming platform accessible at spin7.biz. spin7 is operated under the PAGCOR regulatory framework — the Philippine Amusement and Gaming Corporation, which is the government body responsible for licensing and supervising gambling operations in the Philippines.

For the purposes of Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations ("IRR"), spin7 is the Personal Information Controller in respect of the personal data it collects from players and visitors to spin7.biz.

spin7 has designated a Data Protection Officer (DPO) in compliance with Section 21 of the Data Privacy Act and its IRR. All formal data privacy requests and complaints should be directed to the DPO through the contact details above.

2Information We Collect

spin7 collects personal information from you at various points during your interaction with the Platform. The categories of information collected are as follows:

2.1 Registration and Identity Information

• Full legal name as it appears on your government-issued Philippine identification document;
• Date of birth (required to verify that you meet the 21+ age requirement under PAGCOR regulations);
• Philippine mobile number;
• Residential address in the Philippines;
• Username selected during registration;
• Email address (if provided).

2.2 Identity Verification (KYC) Documents

• Copies or photographs of government-issued Philippine identification documents (e.g., PhilSys / National ID, passport, driver's license, UMID, SSS ID, GSIS ID, PRC ID);
• Selfie or liveness check photographs used to verify that the submitted ID belongs to the registering player;
• Source of funds documentation where required for enhanced due diligence.

2.3 Financial and Transaction Information

• Deposit and withdrawal amounts, dates, and payment method details (e.g., GCash account reference, Maya account reference, bank account name);
• Transaction reference numbers and timestamps;
• Account balance history.

2.4 Gaming Activity Information

• Game session records including games played, wager amounts, outcomes, and session duration;
• Bonus and promotion usage records;
• Responsible gaming tool settings (deposit limits, self-exclusion status, cooling-off periods).

2.5 Technical and Device Information

• IP address and approximate geographic location at the time of login;
• Device type, operating system, and browser type;
• Session tokens and authentication logs;
• Cookie identifiers and similar tracking data as described in Section 6.

2.6 Communications

• Records of live chat communications with spin7 customer support;
• SMS and push notification interaction records;
• Any written correspondence submitted to spin7 via email or support ticket.

3How We Use Your Information

spin7 uses your personal information for the following purposes:

• Account creation and management: To register your account, verify your identity, and maintain your player profile on the spin7 Platform;
• Age and eligibility verification: To confirm that you are 21 years of age or older and legally eligible to participate in online gaming in the Philippines;
• Transaction processing: To process deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, and other supported payment methods in Philippine Peso;
• Regulatory compliance: To meet spin7's obligations under PAGCOR regulations, the Anti-Money Laundering Act (AMLA), Republic Act No. 9160 as amended, and other applicable Philippine laws;
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, unauthorized account access, money laundering, and other prohibited activities described in our Terms and Conditions;
• Customer support: To respond to your inquiries, process complaints, and resolve disputes through live chat and other support channels;
• Responsible gaming: To monitor gaming patterns for indicators of problematic gambling behavior and to administer responsible gaming tools including deposit limits, loss limits, and self-exclusion;
• Platform improvement: To analyze usage patterns, identify technical issues, and improve the performance and functionality of the spin7 Platform;
• Marketing communications: To send you promotional offers and bonus notifications where you have provided consent and have not opted out. You may withdraw marketing consent at any time through your account settings or by contacting support;
• Legal proceedings: To establish, exercise, or defend legal claims against or on behalf of spin7.

4Legal Basis for Processing

spin7 processes your personal data on the following legal bases as recognized under the Data Privacy Act of 2012 (Republic Act No. 10173) and its IRR:

• Contractual necessity: Processing required to perform our obligations under our Terms and Conditions and to provide you with the services you have requested;
• Legal obligation: Processing required to comply with spin7's obligations under PAGCOR regulations, AMLA, the Data Privacy Act, and other applicable Philippine laws and regulatory requirements;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and business analytics, where such processing does not override your rights and freedoms;
• Consent: Processing for direct marketing communications, where you have provided explicit consent. You have the right to withdraw this consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5Sharing Your Information

spin7 may share your personal information with the following categories of third parties under the circumstances described:

5.1 Regulatory and Government Authorities

spin7 is required by law and PAGCOR regulations to share player information with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities upon valid legal request or as required by applicable regulations. Such disclosures are made strictly in compliance with legal requirements.

5.2 Payment Processors and Financial Service Providers

To process your deposits and withdrawals, spin7 shares necessary transaction data with payment service providers including GCash, Maya, BPI, BDO, Metrobank, and other payment processors. This data is limited to what is strictly necessary to execute the requested transaction and is governed by the privacy policies and data handling agreements of the respective payment providers.

5.3 Game Content Providers

spin7's game library is powered by third-party providers including JILI, Pragmatic Play, PG Soft, Evolution Gaming, NetEnt, and others. These providers may receive anonymized or pseudonymized session data necessary to operate their games and detect fraud. They do not receive your full identity or financial information.

5.4 Identity Verification and KYC Service Providers

spin7 uses third-party identity verification services to process KYC documentation. These providers receive the identity documents you submit and return a verification result to spin7. They are contractually prohibited from using your data for any purpose other than identity verification for spin7.

5.5 Professional Advisors

spin7 may share relevant personal data with legal counsel, auditors, and other professional advisors where necessary for the conduct of spin7's business, subject to confidentiality obligations.

6Cookies and Tracking Technologies

spin7.biz uses cookies and similar tracking technologies to operate and improve the Platform. A cookie is a small text file placed on your device when you visit a website. The following categories of cookies are used on spin7.biz:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. These cannot be disabled;
• Functional cookies: Used to remember your preferences such as language settings, responsible gaming limit displays, and session timeout preferences;
• Analytics cookies: Used to collect anonymized data about how players navigate and use the Platform, helping spin7 identify technical issues and improve the user experience;
• Security cookies: Used to detect and prevent fraudulent activity, unauthorized login attempts, and bot traffic.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent the Platform from functioning correctly. spin7 does not use third-party advertising or behavioral targeting cookies.

7Data Retention

spin7 retains your personal information for the following periods:

• Active account data: For the duration of your account's active status plus a minimum of five (5) years following account closure, as required by PAGCOR regulations and AMLA record-keeping requirements;
• Transaction records: A minimum of five (5) years from the date of the transaction, in compliance with AMLA and PAGCOR requirements;
• KYC documentation: For the period of account activity and five (5) years following account closure or the completion of any related regulatory inquiry;
• Support communications: For two (2) years following resolution of the relevant inquiry or complaint;
• Marketing consent records: Until withdrawn, plus two (2) years to demonstrate compliance with consent requirements.

Following the applicable retention period, personal data is securely deleted or anonymized. Anonymized data (which cannot be used to identify any individual) may be retained indefinitely for statistical and platform improvement purposes.

8Data Security

spin7 implements appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and spin7.biz;
• Encryption of sensitive data at rest, including identity documents and financial records;
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis;
• Multi-factor authentication for spin7 staff accessing production systems;
• Regular security audits and vulnerability assessments of the spin7 Platform;
• Incident response procedures meeting the notification requirements of the National Privacy Commission.

While spin7 applies industry-standard security measures, no system is entirely immune to security breaches. In the event of a personal data breach that poses a risk to your rights and freedoms, spin7 will notify the National Privacy Commission within 72 hours of discovery and will notify affected players without undue delay, in accordance with NPC Circular No. 16-03.

9Your Rights Under the Data Privacy Act

As a data subject under Republic Act No. 10173 (Data Privacy Act of 2012) of the Philippines, you have the following rights in respect of your personal information held by spin7:

• Right to be informed: The right to know that your personal information is being collected, the purposes for which it is processed, and the identity of the Personal Information Controller;
• Right of access: The right to obtain a copy of the personal information spin7 holds about you, together with information about how it is processed;
• Right to rectification: The right to request correction of inaccurate, incomplete, or outdated personal information;
• Right to erasure or blocking: The right to request deletion or suspension of processing of your personal information in circumstances where the data is no longer necessary, consent has been withdrawn, or processing is unlawful — subject to spin7's legal record-keeping obligations;
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to damages: The right to seek compensation for damages sustained as a result of inaccurate, incomplete, outdated, false, or unlawfully processed personal information.

To exercise any of the above rights, contact spin7's Data Protection Officer via live chat or at [email protected] with the subject line "Data Privacy Request." spin7 will respond to verifiable requests within fifteen (15) business days. Some requests may be subject to identity verification before processing.

10Children and Minors

spin7 verifies the age and identity of all players as part of the mandatory KYC process. Any account that is found to belong to a person under 21 years of age will be immediately and permanently closed. Any funds in such an account will be returned to the payment method from which they were deposited, less any applicable processing fees, following a compliance review.

If you believe that a minor has registered an account or is using the spin7 Platform, please contact spin7 support immediately via live chat so that appropriate action can be taken.

11Changes to This Privacy Policy

spin7 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. Material changes to this Policy will be communicated to registered players via SMS or in-platform notification, with a minimum of seven (7) days' notice prior to the effective date of the change.

The "Last updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically. Your continued use of the spin7 Platform following notification of a Policy update constitutes your acknowledgment of the updated Privacy Policy.

12Complaints and Disputes

If you have any concerns about how spin7 handles your personal information, please contact our Data Protection Officer in the first instance. We will investigate all privacy complaints thoroughly and aim to provide a substantive written response within fifteen (15) business days.

If you remain unsatisfied after spin7's internal resolution process, you have the right to file a complaint with the National Privacy Commission of the Philippines. The NPC oversees compliance with the Data Privacy Act and has authority to investigate complaints and impose sanctions on Personal Information Controllers found to be in breach of the Act.