aaph Privacy Policy

aaph ("aaph," "we," "us," or "our") is committed to protecting the privacy and security of the personal data entrusted to us by our players ("you," "your," or "Data Subject"). This Privacy Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data in connection with the aaph Platform.

We operate as a Philippine-focused online gaming platform serving players across the country — from Metro Manila and Cebu to Davao, Cagayan de Oro, Iloilo, and beyond. The personal data we process is handled in accordance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and the relevant issuances of the National Privacy Commission of the Philippines ("NPC").

This Policy should be read together with the aaph Terms & Conditions, which govern the overall relationship between you and aaph. Where this Policy addresses a matter covered in the Terms & Conditions, the specific provisions of this Policy control with respect to data privacy matters.

For the purposes of the Philippine Data Privacy Act of 2012, aaph acts as the Personal Information Controller ("PIC") with respect to the personal data of its registered players and website visitors. As PIC, aaph determines the purposes and means of processing your personal data and bears the obligations set out in the DPA and its implementing regulations.

aaph has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with data privacy obligations. You may contact the DPO using the contact details provided in Section 15 of this Policy. All data privacy inquiries, access requests, correction requests, erasure requests, and objection notices should be directed to the DPO.

aaph collects different categories of personal data depending on your relationship with the Platform and the services you use. The following table summarises the categories of personal data we collect and the general purposes for which each category is used:

aaph does not collect sensitive personal information — such as biometric data, health information, religious beliefs, or political affiliations — except where required for specific regulatory compliance purposes with your explicit consent and appropriate safeguards in place.

aaph collects personal data through the following means:

• Direct Collection: Information you voluntarily provide when registering an aaph account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or responding to a survey or promotion;
• Automated Collection: Technical data collected automatically through cookies, pixel tags, session tracking, and server logs when you access the aaph Platform;
• Third-Party Sources: Identity and verification data received from licensed KYC verification service providers; payment and transaction data received from GCash, Maya, BPI, BDO, and other payment processors; fraud and risk data from anti-money laundering screening services;
• Regulatory Sources: Data received from PAGCOR or other regulatory bodies in connection with our licensing and compliance obligations.

aaph processes your personal data only where a lawful basis for doing so exists under the Philippine Data Privacy Act of 2012. The following table sets out the primary processing purposes and the corresponding legal basis for each:

aaph does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly for the purposes described and with appropriate contractual or regulatory safeguards in place:

• Payment Processors: GCash, Maya/PayMaya, BPI, BDO, Metrobank, 7-Eleven CLiQQ, and other licensed Philippine payment service providers, for the purpose of processing your deposits and withdrawals. Data shared is limited to that necessary to execute the specific transaction;
• KYC and Identity Verification Providers: Licensed third-party identity verification services used to fulfil mandatory know-your-customer obligations;
• Game Providers and Software Partners: Licensed game studios and technology providers whose games are hosted on the aaph Platform, where data sharing is necessary to render the service or resolve technical disputes;
• Regulatory and Government Authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council ("AMLC"), the Bureau of Internal Revenue ("BIR"), and other Philippine government bodies where disclosure is required or permitted by law;
• Law Enforcement: Philippine National Police, National Bureau of Investigation, or other competent authorities where required by law, court order, or in connection with the investigation of a suspected crime;
• Professional Advisors: Legal counsel, external auditors, and compliance consultants bound by confidentiality obligations, where access to data is necessary for the provision of professional services to aaph;
• Business Successors: In the event of a merger, acquisition, or restructuring of aaph, personal data may be transferred to the successor entity subject to equivalent data protection commitments.

Some of aaph's technology partners and game studio providers operate data infrastructure outside the Philippines. Where personal data is transferred to recipients located in countries other than the Philippines, aaph ensures that appropriate safeguards are in place to maintain a standard of data protection equivalent to that required under Philippine law.

Such safeguards may include: contractual clauses approved by the NPC; binding corporate rules; transfers to countries deemed to provide adequate protection by the NPC; or your explicit consent where no other safeguard is applicable.

aaph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or regulatory reporting requirements. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your aaph account plus a minimum of five (5) years following account closure, in compliance with PAGCOR regulatory requirements and the Anti-Money Laundering Act of 2001;
• Transaction and Financial Data: Retained for a minimum of five (5) years from the date of each transaction in compliance with applicable financial regulations;
• Gaming and Betting Records: Retained for a minimum of three (3) years from the date of each gaming session or bet, or longer if required for regulatory reporting or dispute resolution;
• KYC Documents: Retained for the duration of the account relationship plus five (5) years following account closure;
• Support Communications: Retained for two (2) years from the date of the last interaction, or longer if related to an open dispute;
• Marketing Preferences: Retained until you withdraw consent or close your account, whichever is earlier.

Upon the expiry of the applicable retention period, aaph will securely delete or anonymise your personal data in accordance with its data disposal procedures.

aaph uses cookies and similar tracking technologies on the Platform to enhance functionality, analyse usage patterns, support security systems, and personalise content where you have consented to such personalisation. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the Platform to function correctly, including session management, login authentication, and security verification. These cookies cannot be disabled without impairing Platform functionality;
• Analytical Cookies: Used to understand how players navigate and use the Platform, enabling aaph to identify areas for improvement. Data collected is aggregated and does not identify individuals;
• Functional Cookies: Remember your preferences such as language settings and responsible gaming tool configurations to improve your experience across sessions;
• Marketing Cookies: Used only with your explicit consent to measure the effectiveness of promotional campaigns directed to you. You may withdraw consent for marketing cookies at any time through your browser settings or account preferences.

You may configure your browser to reject all or certain cookies. Please note that disabling strictly necessary cookies will impair your ability to use the aaph Platform. aaph does not currently respond to "Do Not Track" signals from browsers, as no uniform standard for such signals has been adopted under Philippine law.

aaph implements technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, destruction, or accidental loss. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and aaph's servers;
• Encryption of sensitive data at rest using industry-standard cryptographic protocols;
• Two-factor authentication available to all players and mandatory for account actions involving financial transactions;
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis;
• Regular penetration testing and vulnerability assessments conducted by independent security specialists;
• Continuous monitoring of Platform infrastructure for anomalous activity, intrusion attempts, and data exfiltration;
• Staff training on data protection obligations and phishing awareness as part of mandatory onboarding and annual refresher programmes.

In the event of a personal data breach that poses a real risk to your rights and freedoms, aaph will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required under the DPA.

The aaph Platform is strictly intended for persons aged twenty-one (21) years and above. aaph does not knowingly collect personal data from anyone under the age of 21. Age verification is a mandatory step in the aaph account registration process and is enforced through documentary KYC procedures.

If aaph becomes aware that personal data has been collected from a person under the age of 21, we will take immediate steps to delete that data and close the associated account. If you have reason to believe that a person under 21 has registered with aaph, please notify us immediately through the contact details in Section 15.

To exercise any of the rights described in this Policy — including access, correction, erasure, data portability, objection, or withdrawal of consent — please submit a written request to the aaph Data Protection Officer using the contact details provided in Section 15. Your request should include the following information:

• Your full name and registered email address or mobile number;
• A clear description of the right you wish to exercise and the specific data concerned;
• Sufficient information for aaph to verify your identity (to prevent unauthorised access to another person's data).

aaph will acknowledge your request within five (5) business days and will aim to fulfil it within thirty (30) calendar days. Where a request is complex or requires more time to process, we will notify you of the extended timeline and the reasons for the delay. Where aaph is unable to fulfil a request — for example, because retention is required by law — we will explain the reason in writing.

You may also file a complaint directly with the National Privacy Commission of the Philippines if you believe that your rights under the DPA have been violated and aaph has not adequately addressed your concern.

Where you have opted in to marketing communications during registration or through your account settings, aaph may send you promotional content about new games, bonuses, and platform features via SMS to your registered Philippine mobile number and email to your registered address.

You may opt out of marketing communications at any time by:

• Updating your notification preferences in the aaph account settings;
• Replying STOP to any marketing SMS received from aaph; or
• Contacting aaph customer support via live chat with your opt-out request.

Opting out of marketing communications does not affect the delivery of transactional communications — such as deposit confirmations, withdrawal notifications, security alerts, and account notices — which aaph is required to send for the proper operation of your account.

aaph may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable laws, regulatory guidance, or Platform functionality. The updated Policy will be published on this page with an updated "Last Updated" date prominently displayed at the top of the document.

Where changes are material — meaning they significantly affect your rights or the manner in which we process your personal data — aaph will provide advance notice through your registered email address or a prominent notice within the Platform no less than fourteen (14) days before the changes take effect, except where immediate changes are necessitated by legal or regulatory requirements.

Your continued use of the aaph Platform after the effective date of any update constitutes your acknowledgment of the revised Policy. If you do not agree with the updated Policy, you may close your account by contacting aaph support.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by aaph, please contact the designated Data Protection Officer through the following channels:

• Email: [email protected] — mark your subject line "Data Privacy Request" for routing to the DPO;
• Live Chat: Available 24/7 through the aaph Platform after login — advise the support agent that your query concerns a data privacy matter.

If you are not satisfied with aaph's response to a data privacy concern, or if you believe that aaph has not complied with its obligations under the Philippine Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available on their official government website.