spinoy Privacy Policy

1 Who We Are

spinoy operates an online casino and sports betting platform available at spinoy.app, serving Filipino players across the Philippines — from Manila, Makati, and Quezon City to Cebu, Davao, and beyond. spinoy is regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and is committed to operating in full compliance with Philippine law, including the Data Privacy Act of 2012 (Republic Act No. 10173).

For the purposes of this Privacy Policy, spinoy acts as the Personal Information Controller with respect to the personal data of registered players and website visitors. This means spinoy determines the purposes and means by which your personal data is processed.

2 Data We Collect

spinoy collects only the personal data that is necessary to deliver our services, comply with regulatory obligations, and maintain the security and integrity of the Platform. The categories of personal data we collect are as follows:

2.1 Registration Data

When you create a spinoy account, we collect the information you provide during the registration process, including your full legal name, date of birth, nationality, residential address in the Philippines, email address, and mobile number.

2.2 Identity Verification (KYC) Data

To comply with PAGCOR regulations and Philippine Anti-Money Laundering Act (AMLA) obligations, spinoy collects identity verification documents including government-issued photo IDs (e.g., Philippine passport, SSS ID, UMID, PhilHealth ID, driver's licence, Voter's ID), proof of address documents, and selfie photographs where required. This data is processed as part of our Know Your Customer (KYC) verification process.

2.3 Financial Data

spinoy collects information relating to your deposit and withdrawal transactions, including the payment method used (e.g., GCash account reference, PayMaya reference, BPI, BDO, Metrobank, or UnionBank account details), transaction amounts in Philippine Peso (₱), transaction timestamps, and transaction history on the Platform. spinoy does not store full payment card numbers or full bank account numbers on its servers.

2.4 Gameplay Data

spinoy collects records of your gaming activity on the Platform, including game sessions played, bet amounts, wins and losses, game types accessed (slots, bingo, esports betting, live dealer, etc.), and session durations. This data is used for Platform operation, regulatory compliance, responsible gaming monitoring, and service improvement.

2.5 Technical & Device Data

When you access the spinoy Platform, we automatically collect certain technical data including your IP address, browser type and version, operating system, device type, screen resolution, referring URLs, and session timestamps. This data is collected via cookies and server logs.

2.6 Communications Data

If you contact spinoy's customer support team, participate in promotions, or respond to surveys, we collect the content of your communications and any personal data you choose to include in those communications.

Data Category	Examples	Primary Purpose
Registration Data	Name, DOB, email, mobile, address	Account creation & management
KYC / Identity Data	Government ID, proof of address, selfie	Regulatory compliance (PAGCOR / AMLA)
Financial Data	GCash reference, transaction history	Payment processing & fraud prevention
Gameplay Data	Bets, sessions, game types, win/loss	Service delivery & responsible gaming
Technical Data	IP address, device type, browser	Security, analytics & fraud detection
Communications Data	Support tickets, chat transcripts	Customer support & dispute resolution

3 How We Collect Data

spinoy collects your personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make deposits or withdrawals, contact customer support, participate in promotions, or respond to surveys.
• Automatically — through cookies, web beacons, server logs, and similar tracking technologies when you visit or use the spinoy Platform. See Section 8 (Cookies & Tracking) for more detail.
• From third parties — from identity verification service providers engaged to assist with KYC processes, from payment processors (including GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank) in connection with deposit and withdrawal transactions, and from fraud detection and anti-money laundering screening services.

4 How We Use Your Data

spinoy uses your personal data for the following purposes:

• Account management: To create and administer your spinoy account, verify your identity, process your registration, and maintain accurate account records.
• Service delivery: To provide access to all Platform features including casino games, live dealer tables, bingo, slots, esports betting, and the spinoy Casino experience — all in Philippine Peso.
• Payment processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, UnionBank, and other supported payment methods.
• Regulatory compliance: To meet our obligations under PAGCOR licensing conditions, the Philippine Anti-Money Laundering Act (AMLA), the Data Privacy Act of 2012, and other applicable Philippine laws and regulations, including KYC verification and suspicious transaction reporting.
• Responsible gaming: To monitor gameplay patterns and identify potential indicators of problem gambling behaviour, enabling spinoy to proactively offer responsible gaming tools or apply account controls where appropriate.
• Fraud prevention and security: To detect and prevent fraudulent activity, unauthorised account access, money laundering, bonus abuse, and other illegal or prohibited conduct on the Platform.
• Customer support: To respond to your support enquiries, resolve disputes, process complaints, and maintain records of your communications with spinoy.
• Marketing communications: To send you promotional offers, bonus updates, game announcements, and other marketing communications — but only where you have provided your prior consent to receive such communications. You may withdraw consent at any time.
• Platform improvement: To analyse Platform usage patterns, measure the effectiveness of content and promotions, conduct research, and improve the overall spinoy user experience for Filipino players.

5 Legal Bases for Processing

Under the Philippine Data Privacy Act of 2012, spinoy processes your personal data on the following legal bases:

• Contract performance: Processing is necessary to perform the contract between you and spinoy — i.e., to deliver the gaming services you have registered for and to process your financial transactions on the Platform.
• Legal obligation: Processing is necessary for spinoy to comply with its legal obligations under PAGCOR regulations, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable Philippine laws.
• Legitimate interests: Processing is necessary for spinoy's legitimate interests in operating a secure, fair, and commercially viable gaming platform — including fraud prevention, security monitoring, and Platform analytics — provided those interests are not overridden by your rights and interests.
• Consent: For marketing communications and non-essential cookies, spinoy relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6 Sharing Your Data

spinoy does not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

6.1 Service Providers

spinoy engages carefully selected third-party service providers who assist us in operating the Platform. These include payment processors (GCash, PayMaya, BPI, BDO, Metrobank, UnionBank), KYC and identity verification partners, game content providers and studios, cloud hosting and infrastructure providers, customer support platform providers, and fraud detection and analytics services. All service providers are bound by data processing agreements that require them to handle your data securely and only for the purposes specified by spinoy.

6.2 Regulatory and Legal Authorities

spinoy is required to share certain player data with PAGCOR and other Philippine government authorities — including the Anti-Money Laundering Council (AMLC) — as part of our regulatory and legal compliance obligations. We may also disclose data where required by a valid court order, subpoena, or other legal process under Philippine law.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of spinoy's business or assets, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer in advance and given the opportunity to object where required by applicable law.

6.4 With Your Consent

spinoy may share your data with third parties for purposes not described above where we have obtained your prior explicit consent to do so.

7 Data Retention

spinoy retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following general retention periods apply:

• Account and registration data: Retained for the duration of your account, and for a minimum of five (5) years following account closure, in compliance with PAGCOR and AMLA requirements.
• KYC and identity documents: Retained for a minimum of five (5) years following account closure or the date of the relevant transaction, as required by the Anti-Money Laundering Act.
• Financial and transaction records: Retained for a minimum of five (5) years following each transaction, in line with AMLA and PAGCOR record-keeping requirements.
• Gameplay records: Retained for a minimum of three (3) years following the relevant game session, for regulatory audit purposes.
• Technical and device data: Retained for up to twelve (12) months, after which it is anonymised or deleted.
• Customer support communications: Retained for three (3) years from the date of the communication.
• Marketing consent records: Retained until consent is withdrawn and for one (1) year thereafter as evidence of your consent.

Where data is no longer required for any lawful purpose, spinoy will securely delete or anonymise it in accordance with our internal data retention and disposal procedures.

8 Cookies & Tracking Technologies

spinoy uses cookies and similar tracking technologies — including web beacons, pixel tags, and local storage — to operate the Platform effectively and to improve your experience. The following types of cookies are used:

Cookie Type	Purpose	Can Be Disabled?
Essential / Strictly Necessary	Required for Platform operation — login sessions, security tokens, load balancing	No — Platform cannot function without these
Functional / Preference	Remember your language preferences, display settings, and game lobby filters	Yes — disabling may affect user experience
Analytics / Performance	Measure page views, session durations, and game engagement to improve Platform performance	Yes
Marketing / Targeting	Deliver relevant promotional content and measure campaign effectiveness — only with your consent	Yes — requires withdrawal of marketing consent

You can manage your cookie preferences through the cookie settings panel available on the spinoy Platform. Please note that disabling certain cookies may affect the functionality and performance of the Platform. Your browser settings may also allow you to block or delete cookies; however, doing so may prevent certain Platform features from working correctly.

9 Data Security

spinoy implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• SSL/TLS encryption: All data transmitted between your device and the spinoy Platform is encrypted using industry-standard SSL/TLS protocols.
• Secure data storage: Personal and financial data is stored on secure, access-controlled servers. spinoy does not store sensitive payment credentials such as full card numbers or full bank account numbers.
• Access controls: Access to personal data is restricted to spinoy personnel and service providers who need it to perform their specific functions, and is governed by role-based access control policies.
• Intrusion detection and monitoring: spinoy's infrastructure is monitored continuously for suspicious activity, unauthorised access attempts, and anomalous behaviour.
• Regular security reviews: spinoy conducts periodic security assessments and vulnerability testing to identify and address potential weaknesses in our data infrastructure.
• Staff training: All spinoy personnel who handle personal data receive regular training on data privacy obligations and security best practices.

While spinoy takes all reasonable steps to protect your personal data, no method of data transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, spinoy will notify the National Privacy Commission (NPC) and affected individuals in accordance with the requirements of the Data Privacy Act of 2012.

10 Your Rights Under the Data Privacy Act

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by spinoy:

• Right to be informed: You have the right to be informed whether spinoy holds personal data about you, and to receive clear information about how that data is being processed — which this Privacy Policy provides.
• Right of access: You have the right to request a copy of the personal data spinoy holds about you, along with information about the purposes of processing, categories of data held, and any recipients to whom data has been disclosed.
• Right to rectification: You have the right to request correction of any personal data held by spinoy that is inaccurate, incomplete, or outdated.
• Right to erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful — subject to spinoy's legal retention obligations under PAGCOR regulations and the AMLA.
• Right to object: You have the right to object to spinoy's processing of your personal data for direct marketing purposes and, in certain circumstances, to processing based on legitimate interests.
• Right to data portability: You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format, and to request that it be transmitted directly to another personal information controller where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that spinoy has handled your personal data in a manner that violates the Data Privacy Act of 2012.

To exercise any of these rights, please submit your request in writing to spinoy's Data Protection Officer at [email protected] with the subject line "Data Privacy Request". spinoy will acknowledge your request within three (3) business days and respond substantively within fifteen (15) business days, in accordance with NPC guidelines.

11 Children's Privacy

The spinoy Platform is strictly intended for individuals who are at least 21 years of age, in accordance with Philippine gambling laws. spinoy does not knowingly collect, process, or retain personal data from any person under the age of 21.

If spinoy becomes aware that it has inadvertently collected personal data from a person under 21 years of age, it will immediately close the associated account, delete the personal data in question (subject to any mandatory regulatory retention obligations), and — where required — report the matter to PAGCOR.

If you are a parent or guardian and believe that a person under 21 in your care has registered on the spinoy Platform, please contact us immediately at [email protected].

12 Cross-Border Data Transfers

spinoy primarily processes and stores personal data within the Philippines. However, some of our third-party service providers — including cloud infrastructure providers, game studios, and technical support partners — may be located outside the Philippines and may process your data in their respective jurisdictions.

Where personal data is transferred outside the Philippines, spinoy ensures that appropriate safeguards are in place to protect your data, in compliance with Section 21 of the Data Privacy Act of 2012 and applicable NPC regulations. These safeguards include:

• Data processing agreements with international service providers that incorporate data protection standards consistent with Philippine law.
• Transfers only to jurisdictions or entities that provide an adequate level of data protection as determined by the NPC, or where specific safeguards have been contractually agreed.
• Regular review of cross-border data transfer arrangements to ensure ongoing compliance.

13 Updates to This Privacy Policy

spinoy reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable laws, or regulatory requirements. When material changes are made, spinoy will notify registered players via the email address associated with their account or via a prominent notice on the spinoy Platform, at least seven (7) days before the changes take effect.

Non-material updates — such as typographical corrections, formatting improvements, or clarifications that do not substantively alter your rights — may be made without advance notice. The "Last Reviewed" date at the top of this policy will always reflect the date of the most recent revision.

Continued use of the spinoy Platform after any update to this Privacy Policy constitutes your acknowledgment of the revised policy. If you do not agree with the updated policy, you should cease using the Platform and contact support to request account closure.

14 Contact & Data Protection Officer

spinoy has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact:

• Data Protection Officer, spinoy
• Email: [email protected] — please use the subject line "Data Privacy Request" or "DPO Enquiry"
• Response Time: Acknowledgment within three (3) business days; substantive response within fifteen (15) business days
• Support Hours: 24 hours a day, 7 days a week
• Language: English

If you are not satisfied with spinoy's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, the independent regulatory body responsible for enforcing the Data Privacy Act of 2012.