aaaph Privacy Policy

1Introduction

aaaph ("we," "us," "our," or "the Company") operates the online casino and sports betting platform accessible at aaaph.bio ("the Platform"). As a personal information controller under the Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "DPA") and its Implementing Rules and Regulations ("IRR"), aaaph is committed to protecting the privacy and personal data of all individuals who interact with our Platform.

This Privacy Policy ("Policy") describes in detail how aaaph collects, processes, stores, shares, and protects personal data obtained from registered players, prospective players, and visitors to the aaaph website and mobile application. It also explains your rights as a data subject under Philippine law and how you may exercise those rights.

This Policy applies to all personal data processing activities conducted by aaaph in connection with the operation of the Platform, whether data is collected online, through mobile applications, or via interaction with aaaph customer support teams. This Policy should be read alongside the aaaph Terms and Conditions and the aaaph Responsible Gaming Policy.

2Data Controller Information

aaaph acts as the personal information controller for all personal data collected through the Platform. As the controller, aaaph determines the purposes and means of processing personal data submitted by players and users of aaaph.bio.

aaaph has designated a Data Protection Officer (DPO) responsible for overseeing the Company's compliance with the Data Privacy Act of 2012, the National Privacy Commission's issuances, and this Privacy Policy. The aaaph DPO may be contacted through the details provided in Section 15 of this Policy.

3Personal Data We Collect

aaaph collects personal data across several categories, depending on how you interact with the Platform. The data collected and the method of collection are set out in the table below:

aaaph does not collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act (such as race, ethnicity, health records, sexual life, or political affiliations) except where strictly required for regulatory compliance (e.g., recording of a responsible gaming self-exclusion on the basis of a disclosed gambling-related health concern).

4Purposes of Personal Data Processing

aaaph processes your personal data for the following purposes:

4.1 Account Management and Service Delivery

• Creating, verifying, maintaining, and closing your aaaph account;
• Processing deposits and withdrawals in Philippine Pesos via GCash, Maya, and Philippine bank channels;
• Delivering access to all game categories available on the Platform;
• Administering bonuses, promotions, and loyalty program rewards.

4.2 Regulatory Compliance

• Verifying your identity and age (21+) in compliance with PAGCOR regulations;
• Fulfilling anti-money laundering (AML) and counter-terrorism financing (CTF) obligations under Republic Act No. 9160 (Anti-Money Laundering Act), as amended;
• Reporting to the Anti-Money Laundering Council (AMLC) as required by law;
• Responding to lawful requests from PAGCOR, NPC, AMLC, and other competent Philippine authorities.

4.3 Responsible Gaming

• Monitoring gaming patterns to identify potential problem gambling behavior;
• Administering self-exclusion requests and deposit/loss limit controls;
• Communicating responsible gaming information and resources to players.

4.4 Security and Fraud Prevention

• Detecting, investigating, and preventing fraudulent activity, cheating, and unauthorized account access;
• Maintaining the integrity of games and the fairness of the Platform;
• Protecting aaaph and its players from cybersecurity threats.

4.5 Platform Improvement and Analytics

• Analyzing aggregated, anonymized gameplay and usage data to improve Platform features and performance;
• Personalizing the game lobby and promotional offers based on your demonstrated preferences;
• Conducting internal research and development to enhance the aaaph player experience.

4.6 Marketing Communications

Where you have provided explicit consent, aaaph may use your contact details to send promotional communications about new games, bonuses, and offers relevant to your interests as an aaaph player. You may withdraw consent for marketing communications at any time by updating your notification preferences in your account settings or by contacting the aaaph support team.

5Legal Basis for Processing

aaaph processes personal data on one or more of the following legal bases as recognized under the Data Privacy Act of 2012 and its IRR:

• Contractual Necessity: Processing necessary to perform the contract between you and aaaph — including account management, payment processing, and delivery of gaming services — under Section 12(b) of the DPA.
• Legal Obligation: Processing required for compliance with a legal obligation, including PAGCOR licensing conditions, AML legislation, and NPC regulations — under Section 12(c) of the DPA.
• Legitimate Interest: Processing necessary for the legitimate interests of aaaph, including fraud prevention, Platform security, and analytics, where such interests are not overridden by your fundamental rights — under Section 12(f) of the DPA.
• Consent: For marketing communications and certain non-essential data processing activities, aaaph relies on your freely given, specific, and informed consent — under Section 12(a) of the DPA. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6Data Sharing and Third-Party Disclosure

aaaph does not sell, rent, or trade your personal data to third parties for their own commercial purposes. Personal data is shared only in the circumstances described below:

6.1 Service Providers (Personal Information Processors)

aaaph engages third-party service providers who process personal data on aaaph's behalf as personal information processors under the DPA. These include: payment processing providers (GCash/GXI, Maya/Voyager Innovations, BancNet), KYC verification service providers, game content providers (JILI Games, PG Soft, Pragmatic Play), cloud hosting and IT infrastructure providers, and fraud detection and cybersecurity service providers.

All third-party processors engaged by aaaph are bound by data processing agreements that require them to process personal data only on aaaph's documented instructions, maintain appropriate security measures, and comply with the Data Privacy Act of 2012.

6.2 Regulatory and Law Enforcement Disclosure

aaaph will disclose personal data to competent Philippine authorities — including PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and law enforcement agencies — where required to do so by applicable law, valid legal process, or lawful regulatory demand.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a substantial part of aaaph's assets, your personal data may be transferred to the successor entity, subject to the same level of privacy protection required under this Policy and the DPA.

7Data Retention

aaaph retains personal data for as long as necessary to fulfill the specific purpose for which it was collected, subject to the following minimum retention periods required by applicable Philippine law:

Upon expiry of the applicable retention period, aaaph will securely delete or anonymize personal data in a manner that prevents reconstruction of the individual's identity. Data may be retained beyond the standard period only where retention is necessary for pending legal proceedings, dispute resolution, or a formal regulatory investigation.

8Security Measures

aaaph implements organizational, technical, and physical security measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser/device and aaaph servers is encrypted using TLS 1.3 with 256-bit AES encryption;
• Encryption at Rest: Personal data stored in aaaph systems is encrypted at rest using industry-standard algorithms;
• Access Controls: Access to personal data is restricted to aaaph personnel who have a legitimate need to access it in the performance of their duties, and is governed by role-based access control policies;
• Two-Factor Authentication: Internal access to systems containing personal data requires multi-factor authentication;
• Security Audits: aaaph conducts regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure;
• Incident Response: aaaph maintains a data breach incident response plan. In the event of a personal data breach that poses a real risk to your rights, aaaph will notify the National Privacy Commission within 72 hours of discovery, and will notify affected individuals in accordance with NPC requirements.

9Cookies and Tracking Technologies

aaaph uses cookies and similar tracking technologies on the Platform to enhance functionality, analyze usage, and deliver a personalized experience. The types of cookies used by aaaph are:

9.1 Strictly Necessary Cookies

These cookies are essential for the operation of the aaaph Platform. They enable core functionality such as account login session management, security features, and navigation. These cookies cannot be disabled without significantly impairing your ability to use the Platform.

9.2 Performance and Analytics Cookies

These cookies collect anonymized information about how users interact with the Platform — which pages are visited most frequently, where errors occur, and how users navigate between sections. This data is used solely to improve Platform performance and user experience.

9.3 Functional Cookies

Functional cookies remember your preferences — such as your preferred game lobby view, language settings, and notification preferences — to provide a more personalized experience during your sessions.

9.4 Managing Cookie Preferences

You can control non-essential cookies through the cookie preference settings accessible on the aaaph Platform. Most web browsers also allow you to refuse cookies through browser settings. Note that disabling certain cookies may affect the functionality of the Platform and your gaming experience.

10Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to personal data held by aaaph:

• Right to Be Informed: You have the right to be informed about the collection and processing of your personal data, including the purposes, scope, and methods of processing — as described in this Policy.
• Right to Access: You have the right to request a copy of all personal data aaaph holds about you, together with information about how that data has been processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data aaaph holds about you.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to aaaph's obligations to retain data under Philippine law.
• Right to Object: You have the right to object to the processing of your personal data on grounds of legitimate interest or for direct marketing purposes.
• Right to Data Portability: You have the right to request that aaaph provide your personal data in a structured, commonly used, and machine-readable format.
• Right to Lodge a Complaint: If you believe your data rights have been violated, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please submit a request to the aaaph Data Protection Officer using the contact details in Section 15. aaaph will respond to data subject rights requests within thirty (30) calendar days of receipt of a verified request.

11Minors and Age Restriction

Consistent with PAGCOR regulations and aaaph's Terms and Conditions, all account registrations require mandatory age verification. If aaaph becomes aware that personal data has been collected from or provided by an individual under 21 years of age, that account will be immediately suspended, access to gaming services will be revoked, any deposits will be returned to the source payment method, and any collected personal data will be deleted in accordance with applicable data protection requirements.

If you are a parent or guardian and believe that a minor has accessed or registered on the aaaph Platform, please contact the aaaph Data Protection Officer immediately using the contact details in Section 15.

12Cross-Border Data Transfers

Some of aaaph's third-party service providers — including game content providers and cloud infrastructure partners — may process personal data in jurisdictions outside the Philippines. Where such cross-border transfers occur, aaaph ensures that appropriate safeguards are in place to protect your personal data, including:

• Contractual clauses requiring the recipient to maintain standards of data protection at least equivalent to those required by Philippine law;
• Verification that the recipient country or organization provides an adequate level of protection for personal data, as recognized by the National Privacy Commission.

aaaph will not transfer personal data to jurisdictions that do not provide adequate protection without your explicit consent or a legally recognized transfer mechanism, in compliance with Section 21 of the Data Privacy Act of 2012.

13Anti-Money Laundering and Regulatory Disclosure

As a PAGCOR-regulated online gaming platform, aaaph is subject to the requirements of the Anti-Money Laundering Act of 2001 (RA 9160), as amended by RA 10365 and RA 11521, and the regulations of the Anti-Money Laundering Council (AMLC). These obligations require aaaph to:

• Verify the identity of all customers (KYC obligations);
• Monitor transactions for suspicious activity indicators;
• File Covered Transaction Reports (CTRs) with the AMLC for transactions meeting the prescribed threshold;
• File Suspicious Transaction Reports (STRs) with the AMLC where there are reasonable grounds to suspect money laundering or terrorism financing;
• Maintain records of all KYC documentation and transaction records for a minimum of five (5) years as required by the AMLA.

Compliance with AML obligations may require aaaph to process and retain your personal data beyond what would otherwise be necessary for service delivery. aaaph is legally prohibited from notifying you if a STR has been filed with the AMLC in connection with your account, in accordance with the tipping-off provisions of Philippine AML legislation.

14Changes to This Privacy Policy

aaaph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. Material changes to this Policy will be communicated to registered players via email to the address on file and/or through a prominent notice on the Platform, with a minimum of fourteen (14) days' advance notice before the updated Policy takes effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how aaaph protects your personal data. Your continued use of the Platform after the effective date of any amendment constitutes acceptance of the updated Policy.

15Contact the Data Protection Officer

For all privacy-related inquiries, data subject rights requests, or complaints regarding aaaph's personal data processing practices, please contact the aaaph Data Protection Officer:

aaaph will acknowledge all privacy-related inquiries within five (5) business days and provide a substantive response within thirty (30) calendar days. For complex requests, aaaph may extend the response period by an additional thirty (30) days, with notification to you of the extension and the reasons for it.

If you are unsatisfied with aaaph's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC). For more information on how to contact the NPC, please visit the NPC's official website or contact their helpdesk.