sugalplay Privacy Policy

sugalplay ("we," "us," or "our") operates the online gaming platform accessible at sugalplay.asia (the "Platform"). We are committed to protecting the privacy and personal data of every individual who visits, registers on, or interacts with our Platform. This Privacy Policy describes our practices regarding the collection, use, storage, disclosure, and protection of your personal information.

This Privacy Policy is issued in compliance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. By accessing or using the sugalplay Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

For the purposes of the Philippine Data Privacy Act of 2012, sugalplay is the Personal Information Controller (PIC) in respect of the personal data you provide when using the Platform. As the PIC, sugalplay determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is carried out lawfully, fairly, and transparently.

sugalplay has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with the DPA and this Privacy Policy. You may contact our DPO for any privacy-related concerns by writing to [email protected] with the subject line "Data Protection Officer — Privacy Inquiry."

sugalplay collects the following categories of personal data from users of the Platform:

sugalplay collects personal data through the following means:

• Direct Collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically when you access the Platform, including through cookies, web beacons, pixel tags, and server logs.
• Third-Party Sources: Identity verification data from KYC service providers; fraud detection signals from anti-fraud partners; payment confirmation data from GCash, PayMaya, and banking partners. sugalplay only receives data from third parties that are authorized to share it and that operate under appropriate data protection agreements.

sugalplay uses your personal data for the following purposes:

• Account Management: To create, maintain, and manage your sugalplay account, including verifying your identity and age (21+) as required by Philippine gaming regulations.
• Service Delivery: To provide access to all games, betting markets, and platform features available on sugalplay, and to process your deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard.
• KYC & Compliance: To fulfill our Know Your Customer (KYC) obligations, verify the source of funds where required, and comply with Philippine anti-money laundering laws and gaming regulations.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, unauthorized account access, and other illegal or prohibited conduct on the Platform.
• Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance through our 24/7 Filipino and English support channels.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling, enforce self-exclusion and deposit limit settings, and provide responsible gaming interventions where appropriate.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates — but only where you have provided your consent to receive such communications. You may opt out at any time.
• Platform Improvement: To analyze usage patterns, conduct A/B testing, and improve the features, performance, and user experience of the sugalplay Platform.
• Legal Obligations: To comply with applicable Philippine laws, respond to lawful requests from regulatory authorities, and enforce our Terms & Conditions.

Under the Philippine Data Privacy Act of 2012, sugalplay processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — i.e., to operate your account, process transactions, and deliver gaming services.
• Legal Obligation: Processing required to comply with Philippine laws, including the Anti-Money Laundering Act, gaming regulations, and NPC issuances.
• Legitimate Interests: Processing necessary for sugalplay's legitimate business interests, including fraud prevention, platform security, and service improvement, where these interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and non-essential cookies. You may withdraw your consent at any time without affecting the lawfulness of prior processing.

sugalplay does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection agreements:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard — to process your deposits and withdrawals.
• KYC & Identity Verification Providers: Third-party services that assist in verifying your identity and age as required by Philippine gaming regulations.
• Fraud Prevention & Security Partners: Service providers that help us detect and prevent fraudulent activity, unauthorized access, and money laundering.
• IT & Infrastructure Providers: Cloud hosting, database, and cybersecurity service providers that support the operation of the sugalplay Platform under strict confidentiality obligations.
• Regulatory & Law Enforcement Authorities: Philippine government agencies, including the NPC, AMLC, and law enforcement bodies, where disclosure is required by law or a valid legal order.
• Professional Advisors: Lawyers, auditors, and accountants who provide professional services to sugalplay, subject to professional confidentiality obligations.

sugalplay uses cookies and similar tracking technologies to enhance your experience on the Platform. The following types of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language settings, game display options, and responsible gaming configurations.
• Analytics Cookies: Help us understand how players use the Platform — which pages are visited most, where users drop off, and how features perform. This data is aggregated and anonymized.
• Security & Fraud Detection Cookies: Used to identify suspicious activity, detect bot traffic, and protect the integrity of the Platform.

You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling certain cookies may affect the functionality of the sugalplay Platform. sugalplay does not use third-party advertising or retargeting cookies.

sugalplay retains your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account Data: Retained for the duration of your account and for a period of five (5) years following account closure, in compliance with Philippine anti-money laundering record-keeping requirements.
• Transaction & Financial Records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act of the Philippines.
• KYC Documents: Retained for a minimum of five (5) years following the end of the business relationship.
• Customer Support Records: Retained for two (2) years from the date of the last interaction, unless a longer period is required for dispute resolution.
• Technical & Usage Logs: Retained for up to twelve (12) months for security and fraud detection purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with sugalplay's data disposal procedures.

sugalplay implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the sugalplay Platform is encrypted in transit.
• Encryption at Rest: Sensitive personal and financial data stored in our systems is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data is restricted to authorized sugalplay personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication.
• Regular Security Audits: sugalplay conducts regular internal and third-party security assessments, penetration testing, and vulnerability scans to identify and remediate security risks.
• Incident Response: sugalplay maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the NPC and affected individuals in accordance with the timelines prescribed by the DPA.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by sugalplay:

• Right to Be Informed: The right to be informed of how your personal data is being collected and processed — which this Privacy Policy fulfills.
• Right of Access: The right to request a copy of the personal data sugalplay holds about you, along with information about how it is being processed.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure or Blocking: The right to request deletion or blocking of your personal data where it is no longer necessary for the purpose it was collected, or where processing is unlawful — subject to our legal retention obligations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

To exercise any of these rights, please submit a written request to [email protected] with the subject line "Data Subject Rights Request." sugalplay will respond to all verified requests within fifteen (15) business days. We may require you to verify your identity before processing your request.

The sugalplay Platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine gaming regulations. sugalplay does not knowingly collect personal data from individuals under the age of 21.

If sugalplay discovers or is notified that personal data has been collected from an individual under 21 years of age, we will immediately close the associated account, delete all personal data collected from that individual, and forfeit any balance in accordance with our Terms & Conditions and applicable regulations.

The sugalplay Platform may contain references to third-party services such as payment processors (GCash, PayMaya, BPI, BDO, Metrobank). When you interact with these third-party services, you are subject to their own privacy policies and terms of service. sugalplay is not responsible for the privacy practices or content of any third-party services.

We encourage you to review the privacy policies of any third-party services you use in connection with your sugalplay account, particularly your chosen payment provider, before sharing your personal data with them.

sugalplay reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. When material changes are made, we will notify registered users via email or a prominent notice on the Platform at least seven (7) days before the changes take effect, where practicable.

The most current version of this Privacy Policy will always be available at sugalplay.asia/privacy-policy, with the effective date clearly indicated at the top of the page. Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way sugalplay handles your personal data, please reach out to us through the following channels:

• Email: [email protected] (plain text — not a clickable link)
• Subject Line for DPO Inquiries: "Data Protection Officer — Privacy Inquiry"
• Subject Line for Data Subject Requests: "Data Subject Rights Request"
• Live Chat: Available 24/7 on the sugalplay Platform in Filipino and English
• Response Time: Within 24 hours for general inquiries; within 15 business days for formal data subject requests