yyy7 Privacy Policy

This Policy applies to all personal data processed by yyy7 in connection with the operation of our online casino and sports betting platform, including data collected through the website yyy7.one, any future mobile application, and all related customer service and support channels. It applies to all registered Players, prospective Players who have initiated registration, and visitors to the yyy7 website.

This Policy does not apply to third-party websites, services, or platforms that may be linked to or from the yyy7 platform. yyy7 has no control over and accepts no responsibility for the privacy practices of such third parties.

For the purposes of the Philippine Data Privacy Act, yyy7 is the Personal Information Controller (PIC) in respect of personal data collected and processed via the yyy7 platform. As PIC, yyy7 determines the purposes and means of processing your personal information and is responsible for ensuring that such processing is lawful, fair, and transparent.

yyy7 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the DPA and this Policy. The DPO's contact details are provided in Section 15 of this Policy.

yyy7 collects and processes the following categories of personal data:

yyy7 does not collect sensitive personal information beyond what is strictly required for KYC compliance (i.e., government ID data). We do not collect biometric data, health information, religious affiliation, or political views.

yyy7 collects personal data through the following channels:

4.1 Direct Collection

• Registration: When you create a yyy7 account, you provide identity and contact data directly through the registration form.
• KYC Submission: When you submit government ID documents and selfie photographs for identity verification.
• Payment Transactions: When you make a deposit or request a withdrawal, your payment method details are collected and processed.
• Customer Support: When you contact yyy7 via live chat, email, or other support channels, we collect the content of those communications.
• Responsible Gaming Forms: When you set deposit limits, request self-exclusion, or use other responsible gaming tools within your account settings.

4.2 Automated Collection

• Cookies and Tracking Technologies: As described in Section 8, yyy7 uses cookies and similar technologies to collect technical and usage data automatically when you visit the platform.
• Platform Activity Logging: All login events, game sessions, transactions, and account changes are automatically logged for security, audit, and compliance purposes.

4.3 Third-Party Sources

• Payment Processors: Transaction confirmation data received from GCash, PayMaya, and banking partners when processing your deposits and withdrawals.
• Identity Verification Services: Supplementary verification data from PAGCOR-approved identity verification providers used in the KYC process.
• Fraud Prevention Services: Risk signals from fraud detection partners used to protect the platform and its Players.

Under the Philippine Data Privacy Act, yyy7 processes your personal data on one or more of the following lawful bases:

• Performance of a Contract: Processing necessary to provide the yyy7 platform services you have contracted for, including account management, game provision, and payment processing.
• Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR's licensing requirements, the Anti-Money Laundering Act (Republic Act No. 9160), and the Data Privacy Act itself.
• Legitimate Interests: Processing for fraud prevention, security monitoring, platform improvement, and responsible gaming monitoring, where such interests are not overridden by your rights and freedoms.
• Consent: Where yyy7 relies on your consent (for example, for direct marketing communications), you may withdraw that consent at any time by updating your account preferences or contacting the DPO.

yyy7 uses the personal data we collect for the following specific purposes:

• Creating, verifying, and maintaining your yyy7 account and associated Player profile.
• Conducting Know Your Customer (KYC) and age verification processes as required by PAGCOR.
• Processing deposits, withdrawals, and all financial transactions on the platform, including GCash and PayMaya integrations.
• Providing and improving our casino games, sports betting markets, live dealer services, bingo rooms, and e-sports betting products.
• Detecting, preventing, and investigating fraud, money laundering, cheating, and other prohibited conduct.
• Monitoring gaming behaviour for responsible gaming purposes, including identifying patterns that may indicate problem gambling, in accordance with PAGCOR's responsible gaming framework.
• Communicating with you regarding account updates, transaction confirmations, security alerts, and service announcements.
• Sending promotional offers and marketing communications where you have provided consent or where permitted under applicable law.
• Fulfilling yyy7's reporting obligations to PAGCOR and other competent Philippine regulatory authorities.
• Resolving disputes, handling complaints, and conducting internal audits.
• Analysing platform usage patterns to improve user experience and develop new features.

yyy7 does not sell, rent, or trade your personal data to third parties for their own independent commercial use. We share your personal data only in the following circumstances:

7.1 Service Providers

We engage trusted third-party service providers acting as Personal Information Processors (PIPs) on yyy7's behalf for the following purposes: payment processing (GCash, PayMaya, bank partners), identity verification services, cloud hosting and data storage, cybersecurity services, and customer support tools. All PIPs are contractually required to process personal data only on yyy7's documented instructions and to implement appropriate security measures.

7.2 Regulatory and Legal Authorities

yyy7 will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), law enforcement agencies, and courts where required to do so by applicable Philippine law, a valid court order, or pursuant to yyy7's obligations under its PAGCOR license. yyy7 will notify the affected Player of such disclosure where legally permitted to do so.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of substantially all of yyy7's assets, your personal data may be transferred to the acquiring entity as part of the transaction, subject to the same data protection obligations contained in this Policy. yyy7 will notify registered Players of any such transfer in advance where practicable.

yyy7 uses cookies and similar tracking technologies (including local storage and session tokens) to operate and improve the platform. Cookies are small data files stored on your device when you visit a website.

8.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication tokens that keep you logged in to your yyy7 account during a gaming session. These cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your preferences, such as language settings and responsible gaming limit configurations.
• Analytics Cookies: Collect anonymised usage data to help us understand how Players interact with the platform, which features are used most, and where technical issues occur.
• Security Cookies: Used to detect and prevent fraud, bot activity, and unauthorised account access attempts.

8.2 Managing Cookies

You may control non-essential cookies through your browser settings. Disabling strictly necessary cookies will prevent the yyy7 platform from functioning correctly. Disabling analytics cookies will not affect your ability to use the platform but will limit yyy7's ability to improve its services based on aggregated usage data.

yyy7 implements technical and organisational security measures appropriate to the sensitivity of the personal data we process. These measures include:

• Encryption: All data transmitted between your browser and yyy7's servers is encrypted using TLS 1.2 or higher (256-bit SSL). All sensitive data stored in our systems, including KYC documents, financial records, and account credentials, is encrypted at rest using AES-256 or equivalent.
• Access Controls: Personal data is accessible only to yyy7 personnel and authorised PIPs who require it for their specific job functions. All access is logged and subject to regular audit.
• Password Security: Account passwords are stored using irreversible cryptographic hashing. yyy7 never stores passwords in plaintext and cannot retrieve your password — only reset it.
• Two-Factor Authentication: Players may enable OTP-based two-factor authentication on their yyy7 accounts for an additional layer of access security.
• Penetration Testing: yyy7's infrastructure undergoes regular security assessments and penetration testing by qualified cybersecurity professionals.
• Incident Response: yyy7 maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the National Privacy Commission and affected Players within the timeframes prescribed by the DPA.

yyy7 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with National Privacy Commission guidelines on data disposal.

To exercise any of the rights described in the feature cards above — access, rectification, erasure, objection, portability, or complaint — please submit a written request to yyy7's Data Protection Officer using the contact details in Section 15.

All data rights requests must include: your full name as registered on your yyy7 account, your registered mobile number, a description of the right you are exercising and the specific data concerned, and a copy of a valid government ID for verification purposes.

yyy7 will acknowledge your request within 5 business days and respond substantively within 10 business days. Where a request is complex or involves a large volume of data, we may extend this period by up to an additional 15 business days, notifying you of the extension in advance.

Some rights are subject to limitations under the DPA. For example, we cannot erase data that we are legally required to retain under PAGCOR or AMLC regulations. Where we are unable to fulfil a request in full, we will explain the applicable legal basis for the limitation.

The yyy7 platform is strictly for individuals aged 21 years and above, as required by PAGCOR's licensing conditions. yyy7 does not knowingly collect personal data from any person under 21 years of age. The mandatory KYC verification process is designed to detect and prevent underage registration.

If yyy7 becomes aware that personal data has been collected from a person under 21 years of age, the Account will be immediately suspended, all collected data will be deleted in accordance with the DPA's provisions on personal data of minors, and the matter will be reported to PAGCOR. If you are a parent or guardian and believe your child has registered on yyy7, please contact our DPO immediately using the details in Section 15.

Some of yyy7's service providers and technology partners may be located outside the Philippines. Where personal data is transferred to a third country, yyy7 ensures that appropriate safeguards are in place as required under Section 21 of the Philippine Data Privacy Act, including:

• Contractual clauses that require the recipient to protect personal data to standards equivalent to those required under Philippine law.
• Transfers only to jurisdictions assessed by the NPC as providing adequate data protection, or where the recipient has implemented binding corporate rules approved by the NPC.
• Your explicit consent to the transfer, where no other adequate safeguard applies.

Data transferred cross-border by yyy7 is limited to technical and operational data necessary for platform hosting, payment processing, and fraud prevention. KYC documents and sensitive financial data are, where possible, stored on servers located within the Philippines.

yyy7 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or PAGCOR regulatory guidance. When we make material changes, we will notify registered Players via a prominent notice on the platform and by email to the registered Account address, at least 7 days before the changes take effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically. Your continued use of the yyy7 platform after the effective date of any revised Policy constitutes your acceptance of the updated terms.

If you have any questions, concerns, or requests relating to this Privacy Policy, the personal data yyy7 holds about you, or the exercise of your rights under the Philippine Data Privacy Act, please contact our Data Protection Officer:

Data Protection Officer — yyy7
Email: support at yyy7.one (plain text — not a clickable link)
Subject line: "DPO Request — [Your Registered Username]"
Available: Monday to Friday, 9:00 AM to 6:00 PM Philippine Standard Time (PST)
General support: 24/7 Live Chat available on the yyy7 platform

If you believe yyy7 has violated your data privacy rights and our internal resolution process has not adequately addressed your concern, you have the right to file a complaint with the National Privacy Commission of the Philippines.