betsoo Privacy Policy — How We Handle Your Personal Data

1.1  betsoo operates as the personal information controller in respect of all personal data collected through the betsoo platform. As the controller, betsoo determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission of the Philippines.

1.2  betsoo holds a valid gaming licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR). In addition to its obligations under the DPA, betsoo is subject to the data-related requirements imposed by PAGCOR and the Anti-Money Laundering Council (AMLC), which may require betsoo to collect, retain, and disclose certain player data for regulatory compliance purposes.

1.3  Questions, requests, or complaints relating to the processing of your personal data by betsoo should be directed to the betsoo Data Protection Officer at [email protected] with the subject line "Privacy Enquiry."

2.1  betsoo collects the following categories of personal data from players:

2.2  betsoo does not collect sensitive personal information — as defined under Section 3(l) of the DPA — unless specifically required for identity verification or regulatory compliance purposes, in which case such collection will be limited to what is strictly necessary and handled with enhanced security measures.

3.1  betsoo collects personal data through the following means:

• Direct submission by you: when you complete the betsoo registration form, submit KYC documents, make deposit or withdrawal requests, contact customer support, or complete any other form or submission on the platform
• Automated technical collection: through cookies, server logs, and similar tracking technologies when you access the betsoo platform — this includes your IP address, device identifiers, session data, and browsing behaviour on the betsoo site
• Third-party payment providers: when you make a deposit or withdrawal via GCash, PayMaya, or a Philippine bank, betsoo receives transaction confirmation data from the relevant payment provider including your registered account name and transaction reference
• Identity verification services: betsoo may use PAGCOR-approved third-party KYC verification services to validate the identity documents you submit during the verification process
• Gaming providers: betsoo's integrated game providers transmit bet, win/loss, and session data to betsoo's back-end systems in real time as part of normal game operation

4.1  betsoo processes your personal data on the following legal bases and for the following purposes:

4.2  betsoo does not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent, except where required by PAGCOR regulations or AMLC obligations.

5.1  betsoo shares your personal data only with the following categories of third parties, and only to the extent necessary for the stated purposes:

• Payment processors: GCash (Mynt), PayMaya, BPI, BDO, Metrobank, and cryptocurrency processors — for the purpose of processing your deposits and withdrawal requests
• Game providers: JILI Gaming, Evolution Gaming, Pragmatic Play, PG Soft, and other integrated providers — for the purpose of operating and recording your game sessions
• KYC and identity verification services: PAGCOR-approved third parties engaged to verify your identity documents and assess fraud risk
• Cloud infrastructure and IT service providers: third-party providers of hosting, database, analytics, and security services engaged by betsoo under data processing agreements that require them to maintain the same standard of data protection as betsoo
• Regulatory authorities: PAGCOR, AMLC, the Bureau of Internal Revenue, the National Privacy Commission, and Philippine law enforcement agencies — where betsoo is legally required to disclose data by applicable law, court order, or regulatory directive
• Professional advisers: lawyers, auditors, and compliance consultants engaged by betsoo, who are bound by confidentiality obligations

5.2  betsoo does not sell, rent, or transfer your personal data to third-party advertisers, data brokers, or unaffiliated marketing companies. All third parties with whom betsoo shares personal data are required to maintain appropriate technical and organisational security measures and to process the data only for the specific purposes for which it was shared.

6.1  Some of betsoo's game providers, cloud infrastructure providers, and service partners operate servers or personnel outside the Philippines. Where betsoo transfers personal data outside the Philippines, betsoo ensures that appropriate safeguards are in place in accordance with Section 21 of the DPA and applicable NPC regulations, including:

• Binding contractual obligations requiring the recipient to maintain equivalent data protection standards
• NPC-approved standard contractual clauses or equivalent transfer mechanisms
• Transfer to countries recognised by the NPC as providing adequate protection for personal data

6.2  You may obtain information about the specific safeguards in place for international transfers of your personal data by contacting the betsoo Data Protection Officer.

7.1  betsoo implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, and destruction:

• Encryption: all data in transit is protected by TLS/SSL encryption with a minimum 256-bit key. Sensitive data at rest — including KYC documents, financial records, and passwords — is encrypted using industry-standard symmetric and asymmetric encryption algorithms
• Password security: betsoo does not store player passwords in readable form. Passwords are hashed using a strong cryptographic hashing function with per-account salting
• Access controls: betsoo's systems implement role-based access controls ensuring that only personnel with a specific operational need can access personal data categories relevant to their role
• Two-factor authentication: betsoo supports and encourages two-factor authentication for all player accounts, and requires it for all betsoo staff who have access to personal data systems
• Penetration testing: betsoo's platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities
• Incident response: betsoo maintains a documented data breach incident response procedure, including notification protocols for the NPC and affected players in line with DPA requirements

7.2  While betsoo maintains robust security measures, no internet-based system can be guaranteed to be completely secure. You are responsible for maintaining the security of your betsoo account credentials and for reporting any suspected breach to betsoo support immediately.

8.1  betsoo uses cookies and similar tracking technologies on the betsoo platform. Cookies are small data files placed on your device that help betsoo operate the platform correctly, remember your session and preferences, and analyse platform usage.

8.2  betsoo uses the following categories of cookies:

• Strictly necessary cookies: essential for the platform to function. These include session authentication cookies, security tokens, and cookies that maintain your login state. These cannot be disabled without breaking platform functionality
• Functional cookies: remember your language preferences, display settings, and responsible gaming tool configurations. Disabling these may affect your betsoo experience
• Analytics cookies: collect aggregated, anonymised data about how players use the betsoo platform — pages visited, session duration, error events — to help betsoo improve the platform. betsoo uses its own analytics infrastructure and does not share this data with third-party analytics providers
• Security and fraud detection cookies: used by betsoo's fraud detection and anti-bot systems to identify suspicious access patterns and protect the platform and its players

8.3  You may control or disable non-essential cookies through your browser settings. Note that disabling cookies may affect some platform features. betsoo does not use advertising tracking cookies or third-party marketing pixels.

9.1  betsoo retains personal data for the periods specified below, after which data is securely deleted or anonymised:

• Active account data: retained for the full duration your betsoo account is active
• Account and transaction records following closure: retained for a minimum of five (5) years from the date of account closure, in accordance with PAGCOR requirements and Philippine tax law
• AML-related records: retained for a minimum of five (5) years in accordance with the Anti-Money Laundering Act and AMLC regulations, or longer if required by an active investigation
• KYC identity documents: retained for the duration of the account plus five (5) years post-closure
• Customer support communications: retained for three (3) years from the date of the last interaction
• Marketing consent records: retained for as long as marketing communications are sent and for three (3) years thereafter as evidence of consent

9.2  Following the expiry of applicable retention periods, betsoo will securely delete or irreversibly anonymise personal data so that it can no longer be attributed to any individual player.

10.1  The betsoo platform is strictly restricted to individuals aged 21 years and above in accordance with PAGCOR regulations and Philippine law. betsoo does not knowingly collect personal data from individuals under the age of 21.

10.2  All registration attempts are subject to age verification checks. betsoo's KYC process requires submission of government-issued identity documents that confirm date of birth. Any account where the player is found to be under 21 years of age will be immediately suspended and the account's data reviewed in accordance with betsoo's underage access procedures.

10.3  If you believe that betsoo has inadvertently collected personal data from a minor, please contact the betsoo Data Protection Officer immediately at [email protected] so that appropriate steps can be taken to delete the data and close the account.

11.1  With your consent, betsoo may send you marketing communications about new games, promotions, bonuses, sports betting markets, and platform updates via email, SMS, and in-platform notifications. Marketing communications are sent only to players who have opted in at registration or subsequently updated their preferences to include marketing.

11.2  You may withdraw your consent to marketing communications at any time by:

• Updating your communication preferences in your betsoo account settings
• Clicking the unsubscribe link present in any betsoo marketing email
• Contacting betsoo support at [email protected] and requesting removal from marketing lists

11.3  Withdrawing marketing consent does not affect your ability to receive transactional communications from betsoo that are necessary for the operation of your account — such as deposit confirmations, withdrawal notifications, account security alerts, and mandatory responsible gaming notifications. These transactional messages are sent on the basis of contract performance and cannot be opted out of while your betsoo account is active.

12.1  To exercise any of your rights under the Data Privacy Act — including your rights to access, rectification, erasure, objection, portability, or blocking — submit a written request to the betsoo Data Protection Officer at [email protected] with the subject line "Data Rights Request." Your request should include your full name, your betsoo username or registered email address, and a description of the right you wish to exercise.

12.2  betsoo will respond to all data rights requests within fifteen (15) working days of receipt. Where a request is complex or involves a high volume of data, betsoo may extend this period by a further fifteen (15) working days and will notify you of the extension and the reason for it.

12.3  betsoo will verify your identity before processing any data rights request to ensure that personal data is not disclosed or altered based on a fraudulent request. Verification may require you to confirm your registered email address, mobile number, or provide additional identity confirmation.

12.4  If you are not satisfied with betsoo's response to a data rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

13.1  In accordance with the Data Privacy Act of 2012 and NPC regulations, betsoo has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy, handling data rights requests, and acting as the point of contact for the National Privacy Commission.

13.2  The DPO operates independently within the betsoo organisation and reports to senior management. The DPO's contact details are registered with the National Privacy Commission in accordance with NPC requirements.

14.1  betsoo may update this Privacy Policy from time to time to reflect changes in applicable law, NPC guidance, betsoo's data processing activities, or the structure of the betsoo platform. When material changes are made, betsoo will notify registered players by email and post a prominent notice on the platform.

14.2  The date at the top of this Privacy Policy indicates when it was last updated. The current version of this Policy is always available at betsoo.co/privacy-policy. Continued use of the betsoo platform following the effective date of any updated Policy constitutes your acknowledgement of the changes.

14.3  If any change to this Policy materially affects how betsoo processes data for which you previously provided consent, betsoo will seek fresh consent from you before processing your data under the revised terms.