9piso Privacy Policy

1 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings assigned to them below:

• "Personal Information" / "Personal Data" — any information, whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual.
• "Sensitive Personal Information" — personal information about an individual's race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations, health, education, genetic or sexual life, any proceeding for any offence committed, as defined under RA 10173.
• "Processing" — any operation or set of operations performed on personal data, including collection, recording, organisation, storage, updating, modification, retrieval, use, disclosure, or destruction.
• "Data Controller" — the entity that controls the collection, holding, processing, or use of personal data. In this context, the Data Controller is 9piso.
• "Data Processor" — a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller.
• "NPC" — the National Privacy Commission of the Philippines, the regulatory body responsible for administering and enforcing RA 10173.
• "DPA" — the Philippine Data Privacy Act of 2012, Republic Act No. 10173.
• "Data Subject" — you, the individual whose personal information is being collected and processed by 9piso.
• "Consent" — any freely given, specific, informed indication of will by which you agree to the collection and processing of your personal information by 9piso.

2 Data Controller Identity

The Data Controller responsible for the personal information collected through the 9piso platform is the operator of 9piso.cam. Questions, requests, and complaints relating to the processing of personal data may be directed to our Data Protection Officer (DPO) using the contact details provided in Section 14 of this Policy.

9piso has registered its data processing activities with the National Privacy Commission in compliance with RA 10173 and its Implementing Rules and Regulations. Our internal data governance framework, including our Privacy Management Program, is maintained and reviewed on an annual basis or whenever significant changes to our processing activities occur.

3 Categories of Personal Data We Collect

9piso collects the following categories of personal information in the ordinary course of operating the platform:

3.1 Identity & Contact Data

• Full legal name as it appears on a government-issued identification document;
• Date of birth (for age verification purposes);
• Registered Philippine mobile number;
• Email address (if provided during registration or support interactions);
• Residential address (required for full KYC verification);
• Nationality and proof of Philippine residency.

3.2 Identity Verification Documents

• Government-issued photo identification (e.g., Philippine passport, SSS ID, UMID, PhilHealth ID, driver's licence, voter's ID, or other PAGCOR-accepted government ID);
• Proof of address documentation (e.g., utility bill, bank statement);
• Selfie photograph for facial verification purposes where required.

3.3 Financial Data

• GCash or Maya account details linked to your 9piso account;
• Bank account details where bank transfer is used as a payment method;
• Deposit and withdrawal transaction history;
• Account balance information.

3.4 Gaming Activity Data

• Game session records including games played, stakes placed, and outcomes;
• Bonus and promotional activity;
• Sports betting selections and outcomes;
• Gaming behaviour patterns (used for responsible gaming monitoring).

3.5 Technical & Usage Data

• IP address and geolocation data;
• Device type, operating system, and browser information;
• Session duration and navigation patterns on the platform;
• Login timestamps and authentication activity.

4 How We Collect Your Data

9piso collects personal information through the following channels:

• Direct registration: Information you provide when creating your 9piso account, including mobile number, password, and date of birth;
• KYC verification: Identity and address documentation submitted voluntarily or upon request to comply with regulatory verification requirements;
• Financial transactions: Payment data transmitted automatically through integrated payment gateways (GCash, Maya, BPI, BDO, Metrobank) when you deposit or withdraw;
• Platform activity: Gameplay records, session data, and behavioural information generated automatically as you interact with the 9piso platform;
• Support interactions: Information shared with 9piso customer support agents through live chat, email, or other communication channels;
• Automated technologies: Cookies, web beacons, and similar tracking technologies as described in Section 7 of this Policy;
• Third-party sources: Identity verification and fraud prevention agencies, payment processing partners, and, where required by law, government databases.

5 Purpose of Processing & Legal Basis

9piso processes your personal data for the following purposes, each of which is supported by a lawful basis under the Philippine Data Privacy Act:

6 Data Sharing & Disclosure

9piso does not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

6.1 Service Providers and Data Processors

9piso engages trusted third-party service providers who process personal data on our behalf under contractual agreements that impose data protection obligations consistent with the DPA. These include:

• Payment processors: GCash (Mynt), Maya Philippines, BPI, BDO, and Metrobank — for transaction processing;
• KYC and identity verification providers: Independent verification platforms used to confirm player identities and ages;
• Game software providers: Pragmatic Play, JILI, PG Soft, Evolution Gaming, and other licensed game studios — who receive only the minimum data necessary for game delivery and session logging;
• Fraud prevention and cybersecurity providers: Third-party security services used to detect and prevent unauthorised access and financial fraud;
• Cloud infrastructure providers: Data hosting and processing infrastructure located in secure facilities within the ASEAN region.

6.2 Regulatory and Law Enforcement Authorities

9piso will disclose personal information to competent government authorities, including PAGCOR, the NPC, the Anti-Money Laundering Council (AMLC), and Philippine law enforcement agencies, where required or permitted by law, in response to a lawful order, subpoena, or regulatory inquiry, or where disclosure is necessary to protect the rights or safety of any individual.

6.3 Corporate Transactions

In the event of a merger, acquisition, reorganisation, or sale of 9piso's business or assets, personal data held by 9piso may be transferred to the acquiring entity, subject to the acquiring entity assuming the same or equivalent data protection obligations under this Policy.

7 Cookies & Tracking Technologies

9piso uses cookies and similar tracking technologies on the platform to enhance user experience, maintain session security, and generate anonymised usage analytics. The following types of cookies are used:

• Strictly necessary cookies: Required for the platform to function correctly. These include session authentication cookies that keep you logged in to your 9piso account. These cannot be disabled without impairing core platform functionality;
• Functional cookies: Remember your preferences (such as language settings and game favourites) to personalise your experience;
• Analytics cookies: Collect anonymised data about how players navigate and use the 9piso platform. This data is used to identify usability issues and improve platform performance;
• Security cookies: Help detect and prevent fraudulent activity, including cross-site request forgery (CSRF) protection and suspicious login pattern detection.

9piso does not serve third-party advertising cookies or permit advertising networks to collect data through the platform for behavioural advertising purposes. You may manage cookie preferences through your browser settings; however, disabling necessary cookies may prevent you from accessing your 9piso account.

8 Data Retention

9piso retains personal information for the minimum period necessary to fulfil the purposes for which it was collected, subject to the following retention obligations:

• Active account records: Retained for the duration of the active membership plus five (5) years following account closure, in compliance with PAGCOR licensing requirements and anti-money laundering obligations under the AMLA;
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of account closure or the last transaction, whichever is later, as required by applicable AML regulations;
• Financial transaction records: Retained for five (5) years in compliance with AMLC reporting requirements;
• Gaming session logs: Retained for three (3) years for dispute resolution, regulatory audit, and responsible gaming monitoring purposes;
• Support interaction records: Retained for two (2) years from the date of the interaction;
• Marketing consent records: Retained for the duration of the membership and two (2) years following withdrawal of consent.

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised in accordance with 9piso's data disposal procedures.

9 Data Security Measures

9piso implements appropriate technical and organisational security measures designed to protect your personal information against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and 9piso's servers;
• AES-256 encryption for sensitive data stored at rest, including financial records and identity documents;
• Two-factor authentication (2FA) available to all members and mandatory for administrative access;
• Role-based access controls ensuring that staff members access only the personal data necessary for their job function;
• Regular penetration testing conducted by independent cybersecurity specialists;
• 24/7 intrusion detection and monitoring systems across all production infrastructure;
• Staff data protection training conducted at onboarding and on an annual basis;
• Incident response protocols that comply with the NPC's mandatory breach notification requirements under RA 10173.

10 Your Rights as a Data Subject

Under the Philippine Data Privacy Act, you have the following rights with respect to your personal information held by 9piso. All requests may be submitted to our Data Protection Officer using the contact details in Section 14:

9piso will respond to all verified data subject requests within fifteen (15) business days of receipt. In complex cases, this period may be extended by an additional fifteen (15) business days with written notification. If you are dissatisfied with 9piso's response to your request, you have the right to file a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.

11 Children's Privacy

The 9piso platform is strictly restricted to individuals aged 21 years and older in accordance with Philippine gaming regulations. 9piso does not knowingly collect personal information from individuals under the age of 21, and the platform employs age verification controls during registration to enforce this restriction.

If 9piso becomes aware that it has inadvertently collected personal information from an individual below the required age, it will immediately close the relevant account, delete all associated personal information, and return any deposited funds. If you have reason to believe that a minor has registered on 9piso, please contact our DPO immediately using the details in Section 14.

12 Cross-Border Data Transfers

Some of 9piso's third-party service providers — including game software studios, cloud infrastructure providers, and fraud prevention services — may be located outside the Philippines. Where personal data is transferred to recipients in other countries, 9piso ensures that appropriate safeguards are in place to protect your data, including:

• Contractual data processing agreements incorporating standard data protection clauses consistent with RA 10173 requirements;
• Transfer only to countries or organisations that provide an adequate level of data protection as assessed by 9piso's DPO;
• Where technically and operationally feasible, preference for data processors located within the Philippines or the ASEAN region.

Your consent to this Privacy Policy constitutes consent to the transfer of your personal data as described in this section, subject always to the safeguards described above.

13 Amendments to This Policy

9piso reserves the right to amend, update, or replace this Privacy Policy at any time in response to changes in applicable law, regulatory guidance from the NPC, or changes in our data processing activities. Where material changes are made, 9piso will notify registered members by email (where an email address is held on file), by in-platform notification, or by publishing a prominent notice on the 9piso website at least ten (10) days prior to the effective date of the changes.

Your continued use of the 9piso platform following the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. The date of the most recent revision is displayed at the top of this Policy. We encourage you to review this Policy periodically to stay informed of how we protect your information.

14 Contact Us & Data Protection Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information by 9piso, please contact our designated Data Protection Officer through any of the following channels:

• DPO Email: [email protected] (subject line: "Data Privacy Request")
• General Support Email: [email protected]
• Live Chat: Available 24/7 through the 9piso platform in English and Tagalog
• Website: 9piso.cam

We aim to acknowledge all privacy-related communications within one (1) business day and to resolve all requests within fifteen (15) business days. For escalations and complaints that remain unresolved, you may contact the National Privacy Commission of the Philippines directly through its official website.