em77 Privacy Policy
How We Collect, Use & Protect Your Data

em77 ("we," "us," "our") operates the online gaming platform accessible at em77.one. em77 is the data controller responsible for the personal data of players and visitors who access the Platform. We operate within the PAGCOR licensing framework and are subject to the data protection obligations imposed by Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA 2012"), and its implementing rules and regulations.

This Privacy Policy applies to all personal data collected through the em77 website, mobile web application, progressive web app, customer support channels, and any other service offered under the em77 brand at em77.one.

em77 collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we collect include:

em77 does not intentionally collect sensitive personal information beyond what is required for identity verification and regulatory compliance. We do not collect biometric data, health information, or political affiliations.

em77 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated collection: Technical data collected automatically when you visit em77.one, including IP address, device identifiers, browser type, and session activity, via cookies and similar tracking technologies.
• Third-party sources: Identity verification data from licensed KYC providers; fraud screening data from anti-money laundering (AML) compliance partners; payment confirmation data from GCash, Maya, and banking partners.
• Regulatory sources: Information received from PAGCOR or other Philippine regulatory bodies in connection with licensing compliance obligations.

em77 uses your personal data only for the purposes listed below. We do not use your data for any purpose that is incompatible with the reason it was originally collected.

• Account creation and management: To register your account, verify your identity, and maintain your player profile on the em77 platform.
• Age and identity verification (KYC): To confirm that you are at least 21 years of age and to comply with PAGCOR's player verification requirements.
• Payment processing: To process deposits and withdrawals via GCash, Maya, bank transfer, and debit card, and to maintain accurate transaction records.
• Fraud prevention and AML compliance: To detect, investigate, and prevent fraudulent activity, money laundering, and other financial crimes, as required by Philippine law.
• Platform operation and improvement: To deliver, maintain, and improve the em77 gaming experience, including personalising game recommendations and resolving technical issues.
• Customer support: To respond to your queries, complaints, and requests through our support channels.
• Responsible gaming: To monitor gaming activity for signs of problem gambling and to administer self-exclusion, deposit limits, and other responsible gaming tools.
• Marketing communications: To send you promotional offers, bonus notifications, and platform updates — only where you have provided consent or where permitted by applicable law. You may opt out at any time.
• Legal and regulatory compliance: To comply with obligations under the DPA 2012, PAGCOR regulations, Anti-Money Laundering Act (AMLA), and other applicable Philippine laws.

Under the Data Privacy Act of 2012, em77 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform our obligations under the player account agreement, including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, the DPA 2012, and other applicable Philippine laws and regulations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your privacy rights.
• Consent: Processing for direct marketing communications and non-essential cookies, where your explicit consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of prior processing.

em77 does not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Payment processors: GCash (Mynt), Maya (Voyager Innovations), and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) — for processing deposits and withdrawals.
• KYC and identity verification providers: Licensed third-party providers that assist em77 in verifying player identity and age in compliance with PAGCOR requirements.
• AML compliance partners: Providers that assist em77 in screening transactions for money laundering and other financial crime indicators, as required under the Anti-Money Laundering Act.
• Game content providers: Licensed game studios and live dealer operators whose games are available on the em77 platform. These providers may receive anonymised session data for game performance purposes.
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government bodies, where disclosure is required by law or regulatory directive.
• IT and infrastructure providers: Cloud hosting, cybersecurity, and platform maintenance providers operating under strict data processing agreements that prohibit independent use of your data.

All third-party data processors engaged by em77 are contractually bound to process personal data only on em77's instructions, to implement appropriate security measures, and to comply with the DPA 2012.

em77 uses cookies and similar tracking technologies to operate the platform, enhance your experience, and analyse usage patterns. The types of cookies we use include:

• Strictly necessary cookies: Essential for platform operation, including session management, login authentication, and security functions. These cannot be disabled without affecting platform functionality.
• Functional cookies: Remember your preferences such as language settings, game display options, and responsible gaming tool configurations.
• Analytics cookies: Collect anonymised data about how players use the platform to help us improve performance, identify technical issues, and optimise the user experience.
• Marketing cookies: Used only with your consent to deliver relevant promotional content and measure the effectiveness of our marketing campaigns.

You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the em77 platform. Strictly necessary cookies cannot be disabled as they are required for the platform to function.

em77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. Our standard retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with PAGCOR licensing requirements and the Anti-Money Laundering Act.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction, as required by the AMLA and PAGCOR regulations.
• KYC documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant transaction.
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution and regulatory audit purposes.
• Customer support communications: Retained for two (2) years from the date of the last interaction.
• Marketing consent records: Retained for the duration of your consent and for one (1) year following withdrawal of consent.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with em77's data disposal procedures.

em77 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data in transit between your device and our servers.
• Access controls: Role-based access controls ensuring that only authorised em77 personnel with a legitimate need can access personal data.
• Multi-factor authentication: Required for all em77 staff accessing systems that process personal data.
• Regular security audits: Periodic penetration testing and vulnerability assessments conducted by independent cybersecurity specialists.
• Incident response: A documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights, em77 will notify the National Privacy Commission (NPC) within 72 hours and affected players without undue delay, as required by the DPA 2012.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by em77:

• Right to be informed: The right to know what personal data em77 collects about you and how it is used — as set out in this Privacy Policy.
• Right of access: The right to request a copy of the personal data em77 holds about you, along with information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data. You may update most account information directly through your em77 account settings.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to em77's legal retention obligations under PAGCOR regulations and the AMLA.
• Right to object: The right to object to the processing of your personal data for direct marketing purposes. You may opt out of marketing communications at any time via the unsubscribe link in any marketing email or by contacting support.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format where technically feasible.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe em77 has processed your personal data in violation of the DPA 2012.

To exercise any of the above rights, please contact our Data Protection Officer at the details provided in Section 14 of this Policy. em77 will respond to all valid data subject requests within fifteen (15) calendar days of receipt, as required by the DPA 2012.

The em77 platform is strictly intended for individuals who are at least 21 years of age, in accordance with Philippine law governing casino-style gambling. em77 does not knowingly collect personal data from persons under the age of 21.

If em77 becomes aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the personal data in question, and report the matter to the relevant authorities where required.

If you are a parent or guardian and believe that a minor has registered an account on em77 using your details or otherwise, please contact our support team immediately so that we can take appropriate action.

em77 primarily processes and stores personal data within the Philippines. Where it is necessary to transfer personal data to service providers or infrastructure partners located outside the Philippines — for example, cloud hosting or cybersecurity services — em77 ensures that such transfers are conducted in compliance with the DPA 2012 and its implementing rules.

Specifically, em77 ensures that cross-border data transfers are protected by one or more of the following safeguards:

• Contractual clauses approved by the National Privacy Commission (NPC) that impose data protection obligations on the recipient equivalent to those under the DPA 2012.
• Transfer to countries or organisations that the NPC has determined provide an adequate level of data protection.
• Your explicit consent to the transfer, where required.

em77 does not transfer personal data to jurisdictions that do not provide adequate data protection safeguards without implementing appropriate contractual or technical measures.

em77 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page indicates when the most recent revision was made.

Where changes are material — for example, where we introduce a new purpose for processing your personal data — em77 will notify you by email or via an in-platform notification prior to the changes taking effect, and will seek your consent where required by the DPA 2012.

Your continued use of the em77 platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the changes. If you do not agree with any update to this Policy, you may request account closure by contacting our support team.

We encourage you to review this Privacy Policy periodically to stay informed about how em77 protects your personal data.

If you have any questions, concerns, or requests relating to this Privacy Policy or em77's data processing practices, please contact our Data Protection Officer (DPO). Our DPO is responsible for overseeing em77's compliance with the DPA 2012 and is your primary point of contact for all data privacy matters.

Data Protection Officer — em77

Email: privacy at em77.one

General Support: support at em77.one

em77's support team is available 24 hours a day, 7 days a week via live chat on the platform. For formal data subject requests, please contact the DPO by email and include your registered account username and a clear description of your request.