sg88 Privacy
Policy

1. Scope & Data Controller

This Privacy Policy applies to all personal information collected by sg88 in connection with the sg88.biz platform, including through the website, mobile browser interface, customer support interactions, promotional communications, and any other channel through which you engage with sg88.

Data Controller: sg88 (operating as sg88.biz) is the personal information controller as defined under Republic Act No. 10173 (the Philippine Data Privacy Act of 2012) and its Implementing Rules and Regulations. sg88 determines the purposes and means of processing personal data collected through the platform.

This Privacy Policy does not extend to third-party websites, services, or applications that may be accessible via links on the sg88 platform. sg88 is not responsible for the privacy practices of any third party.

2. Personal Data We Collect

sg88 collects the following categories of personal data, depending on your relationship with the platform:

2.1 Registration & Account Data

• Full legal name (as it appears on your government-issued ID)
• Date of birth
• Philippine mobile number (09xx format)
• Email address
• Username and encrypted password
• Residential address (required for enhanced due diligence)

2.2 Identity Verification (KYC) Data

• Government-issued photo ID (PhilSys National ID, passport, driver's licence, SSS/GSIS ID, UMID, or PRC ID)
• Selfie or live photograph taken during verification
• Proof of address documents where required
• ID number and issuing authority details

2.3 Financial Data

• GCash mobile number and transaction reference numbers
• PayMaya account identifiers and transaction reference numbers
• Bank account details (BPI, BDO, Metrobank, or other Philippine banks) for withdrawal processing
• Transaction history: deposit amounts, dates, withdrawal amounts, and processing status

2.4 Gaming Activity Data

• Bet history: games played, wager amounts, outcomes, and session durations
• Bonus and promotion redemption history
• Account balance history and transaction logs
• Self-imposed limits, cooling-off periods, and self-exclusion records

2.5 Technical & Device Data

• IP address at time of login and during active sessions
• Device type, operating system, and browser version
• Session timestamps and activity logs
• Geolocation data (general, at the city/region level) used for fraud prevention

2.6 Communications Data

• Records of live chat conversations with sg88 support agents
• Email correspondence sent to or received from sg88
• Complaint and dispute records

3. How We Collect Your Data

sg88 collects personal data through the following means:

• Directly from you during account registration, KYC submission, deposit and withdrawal requests, live chat interactions, and email correspondence.
• Automatically through the platform's technical infrastructure, including server logs, session management systems, and analytics tools that record device and connection information.
• Through cookies and similar tracking technologies as described in Section 9 of this Policy.
• From third-party identity verification providers engaged by sg88 to assist with KYC processing, where permitted by applicable law.
• From payment service providers including GCash, PayMaya, BPI, BDO, and Metrobank, in the form of transaction confirmation and reference data.
• From publicly available sources and fraud prevention databases used to verify identity and detect suspicious activity consistent with PAGCOR's AML compliance requirements.

4. Purposes of Processing

sg88 processes personal data for the following specific purposes:

5. Legal Bases for Processing

Under Republic Act No. 10173, sg88 relies on the following legal bases to process personal data:

• Contractual necessity: Processing required to fulfil sg88's obligations under the player account agreement, including account management, transaction processing, and customer support.
• Legal obligation: Processing required to comply with PAGCOR's licensing conditions, the Anti-Money Laundering Act (AMLA) as amended, tax obligations, and any court or regulatory order.
• Consent: Processing for marketing communications and optional personalisation features. Consent may be withdrawn at any time without affecting the legality of prior processing.
• Legitimate interest: Processing for platform security, fraud prevention, technical improvement, and aggregate analytics, where such interests are not overridden by the player's privacy rights.

6. Data Sharing & Disclosure

sg88 does not sell, rent, or trade personal data to third parties for commercial purposes. Personal data is shared only in the following circumstances:

6.1 Service Providers

sg88 engages third-party service providers who process personal data on sg88's behalf, under written data processing agreements that impose equivalent privacy and security obligations. These providers include: KYC verification platforms, payment processing intermediaries, fraud prevention and AML screening services, cloud hosting and infrastructure providers, customer support platform operators, and SMS gateway providers for authentication.

6.2 Regulatory Disclosure

sg88 is required to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission, and any other Philippine regulatory or law enforcement authority when required to do so by applicable law or a valid legal order. sg88 will notify the relevant player of any such disclosure unless expressly prohibited from doing so by the issuing authority.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of sg88's assets, personal data may be transferred to the acquiring entity. sg88 will notify affected players in advance of any such transfer and, where required by law, seek consent or provide opt-out mechanisms.

6.4 Fraud Prevention Networks

sg88 may share account identifiers, device fingerprints, and IP data with industry fraud prevention networks and shared gaming operator databases maintained under PAGCOR oversight, for the purpose of preventing underage gambling, self-excluded players from accessing multiple platforms, and detecting coordinated fraud.

7. Cross-Border Data Transfers

Some of sg88's third-party service providers, including cloud infrastructure and KYC verification platforms, may process personal data outside the Republic of the Philippines. Where such transfers occur, sg88 ensures that appropriate safeguards are in place as required under RA 10173, including:

• Data processing agreements incorporating the NPC's standard contractual clauses for cross-border transfers;
• Transfer only to jurisdictions that provide adequate levels of data protection as recognised by the NPC; or
• Player consent, where required and where no other lawful transfer mechanism applies.

Players who wish to obtain further information regarding the specific countries and safeguards applicable to cross-border transfers of their data may contact sg88's Data Protection Officer (DPO) using the contact details in Section 16.

8. Data Retention

sg88 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to mandatory retention obligations imposed by Philippine law. The following retention guidelines apply:

• Active account data: Retained for the duration of the account's existence plus five (5) years following account closure, consistent with PAGCOR's record-keeping requirements and the AMLA's five-year retention mandate.
• KYC documentation: Retained for a minimum of five (5) years from the date of submission or account closure, whichever is later, in compliance with AMLA requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC reporting requirements.
• Gaming activity logs: Retained for three (3) years from the date of each session for dispute resolution and responsible gaming purposes.
• Customer support communications: Retained for two (2) years from the date of the final communication in each support thread.
• Marketing consent records: Retained for the duration of consent plus one (1) year following withdrawal of consent.

Following expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents reconstruction of the original information.

9. Cookies & Tracking Technologies

sg88 uses cookies and similar tracking technologies on the platform. A cookie is a small text file placed on your device by the sg88 website when you access it. Cookies serve the following functions on sg88:

• Strictly necessary cookies: Required for platform functionality, including login session management, security token validation, and page-load optimisation. These cannot be disabled without impairing platform functionality.
• Functional cookies: Used to remember player preferences such as language settings, game lobby filters, and deposit method preferences.
• Analytical cookies: Used to collect aggregated, anonymised data on how players navigate the sg88 platform, which pages are visited most frequently, and where users encounter errors. This data is used to improve platform performance.
• Security cookies: Used to detect and prevent fraudulent login attempts, session hijacking, and other security threats.

sg88 does not use third-party advertising or behavioural tracking cookies that profile users for advertising purposes on external websites. Players may control cookie preferences via their browser settings. Disabling non-essential cookies may reduce functionality but will not prevent platform access.

10. Children's Privacy

The sg88 platform is strictly prohibited to persons under the age of twenty-one (21) years. sg88 does not knowingly collect personal data from individuals under 21. If sg88 discovers that it has inadvertently collected personal data from an underage individual, it will immediately delete all associated data, close the account, and report the matter to PAGCOR where required.

Parents or guardians who believe a minor has registered on sg88 are requested to contact sg88 immediately via the live chat channel or by email at [email protected] to initiate account closure and data deletion.

11. Security Measures

sg88 implements technical and organisational security measures proportionate to the risks associated with processing personal data in a real-money gaming environment. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between player devices and sg88's servers.
• AES-256 encryption at rest for stored personal data, including KYC documents and financial records.
• Password hashing using modern cryptographic algorithms; sg88 staff cannot view player passwords in plain text.
• Access controls and least-privilege principles ensuring that only authorised sg88 personnel with a specific operational need can access personal data.
• Two-factor authentication available to players and enforced for administrative access by sg88 staff.
• Regular security vulnerability assessments and penetration testing of the sg88 platform.
• Secure data centre environments with physical access controls, CCTV monitoring, and environmental protections.
• Employee privacy and security training conducted at onboarding and on a regular ongoing basis.

Notwithstanding these measures, no online platform can guarantee absolute security against all possible threats. sg88 encourages players to protect their accounts with strong, unique passwords and to enable two-factor authentication.

12. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, registered sg88 players who are Philippine data subjects have the following rights with respect to their personal data:

• Right to be informed: The right to know what personal data sg88 holds about you and how it is used.
• Right of access: The right to request a copy of the personal data sg88 holds about you.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data sg88 holds about you.
• Right to erasure: The right to request deletion of personal data that is no longer necessary for the purpose for which it was collected, subject to sg88's legal retention obligations.
• Right to restrict processing: The right to request that sg88 limits its processing of your personal data in certain circumstances.
• Right to data portability: The right to receive personal data you have provided to sg88 in a structured, commonly used, machine-readable format.
• Right to object: The right to object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the legality of prior processing.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe sg88 has processed your personal data in violation of RA 10173.

To exercise any of the above rights, contact sg88's Data Protection Officer using the details provided in Section 16. sg88 will respond to verified requests within thirty (30) days of receipt, or within the period prescribed by the NPC where different.

13. Marketing Communications

sg88 may send promotional communications to players who have consented to receive them, including information about bonuses, new games, seasonal promotions, and sg88 updates. Marketing communications are sent via SMS to registered Philippine mobile numbers and/or email to the registered email address.

Players may withdraw consent to marketing communications at any time by: contacting sg88 support via live chat, sending an email to sg88's DPO, or updating communication preferences in their account settings. Withdrawal of marketing consent takes effect within 48 hours and does not affect receipt of transactional communications (e.g., deposit confirmations, withdrawal notifications, KYC status updates) which are essential to account management.

sg88 will not send marketing communications to players who are subject to a self-exclusion or cooling-off period.

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected players, sg88 will comply with its notification obligations under RA 10173, including:

• Notifying the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, where the breach is notifiable under applicable NPC guidelines.
• Notifying affected players without undue delay where the breach is likely to result in a high risk to their rights — including risk of identity theft, financial loss, or unauthorised account access.
• Providing affected players with information about the nature of the breach, the categories of data affected, the likely consequences, and the measures sg88 has taken or proposes to take to address the breach.

sg88 maintains a data breach response plan that is reviewed and tested annually. All suspected data breaches are logged and investigated under the supervision of sg88's Data Protection Officer.

15. Amendments to This Policy

sg88 may update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulatory requirements, sg88's data processing practices, or the NPC's guidance. Material changes will be communicated to registered players via email or SMS to their registered contact details at least fourteen (14) days before the effective date, except where a shorter notice period is required to comply with a regulatory directive.

The current version of this Privacy Policy is always accessible at sg88.biz/privacy-policy. The effective date at the top of this document identifies the version currently in force.

16. Contact & Data Protection Officer

sg88 has appointed a Data Protection Officer (DPO) as required under RA 10173. The DPO is responsible for overseeing sg88's data privacy compliance programme and serves as the point of contact for player data rights requests and privacy concerns.

To exercise your data rights, raise a privacy concern, or submit a complaint, contact sg88's DPO:

• Email: [email protected] (please include "Data Privacy Request" in the subject line)
• Live Chat: Available 24/7 on the sg88 platform. For data rights requests, please identify yourself and state the nature of your request clearly.

sg88 will acknowledge all data rights requests within three (3) business days and provide a substantive response within thirty (30) calendar days. Where a request is complex or involves a large volume of data, sg88 may extend the response period by an additional thirty (30) days, with notification to the requester.

If you are not satisfied with sg88's response to your privacy concern, you may file a complaint with the National Privacy Commission of the Philippines.