af77 Privacy Policy

The Data Controller responsible for the personal data described in this Privacy Policy is the operator of the af77 Platform — a PAGCOR-licensed gaming entity registered under the laws of the Republic of the Philippines, with principal offices located in Pasay City, Metro Manila, Philippines.

af77 has designated a Data Protection Officer (DPO) in compliance with Section 21 of Republic Act No. 10173. The DPO is responsible for overseeing af77's data protection program, ensuring compliance with the Data Privacy Act and its Implementing Rules and Regulations, and serving as the point of contact for the National Privacy Commission (NPC) and Data Subject inquiries.

af77 collects and processes the following categories of personal data from registered Players and Platform visitors. Collection occurs only to the extent necessary for the purposes stated in Section 4 of this Policy.

af77 does not collect sensitive personal information (as defined under Section 3(l) of RA 10173) beyond what is strictly required for KYC compliance under PAGCOR regulations — specifically, government ID numbers for age and identity verification purposes.

af77 collects personal data through the following mechanisms:

• Direct Provision: Data you provide when creating an af77 Account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated Collection: Technical data collected automatically through cookies, web beacons, server logs, and similar technologies when you access the Platform. This includes IP address, session data, device identifiers, and browsing behavior within the af77 Platform.
• Third-Party Providers: Identity verification data returned by KYC service providers; payment confirmation data from GCash, Maya, and banking partners; geolocation data from IP intelligence services used for regulatory compliance.
• PAGCOR-Mandated Reporting: Certain transaction and account data is transmitted to PAGCOR's centralized monitoring systems as a regulatory requirement of af77's operating license.

af77 processes personal data for the following specific, legitimate purposes. Data collected for one purpose will not be repurposed for an incompatible use without your consent or a lawful basis under RA 10173.

• Account creation and management: Registering your af77 Account, authenticating your identity at login, and maintaining your account settings and preferences.
• KYC and age verification: Confirming that you meet the 21+ minimum age requirement and verifying your identity as required by PAGCOR and Philippine AML law.
• Payment processing: Processing deposits and withdrawals via your registered payment methods, including GCash, Maya, and linked bank accounts.
• Platform delivery and operation: Providing access to games, sports betting, and all other af77 Platform services, including personalizing your gaming experience.
• Regulatory compliance: Meeting af77's obligations under the PAGCOR license, the Anti-Money Laundering Act (RA 9160 as amended), and the Data Privacy Act (RA 10173).
• Responsible gaming: Administering deposit limits, self-exclusion, cooling-off periods, and session monitoring as part of the PAGCOR Responsible Gaming Framework.
• Fraud prevention and security: Detecting and preventing fraudulent activity, unauthorized account access, money laundering, and other prohibited conduct.
• Customer support: Responding to your inquiries, resolving disputes, and managing feedback.
• Marketing communications: Sending promotional offers and platform updates via SMS or email, where you have provided consent and not opted out. You may withdraw consent at any time.
• Analytics and improvement: Analyzing aggregated, anonymized usage data to improve Platform performance and user experience.

af77 processes personal data under one or more of the following legal bases as enumerated under Section 12 of the Data Privacy Act of 2012:

• Contract performance: Processing necessary to perform the af77 Player Account Agreement — including account management, payment processing, and game delivery.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AMLC reporting obligations, NPC regulations, and other applicable Philippine law.
• Legitimate interests: Processing for fraud prevention, platform security, and analytics, where af77's interests do not override your fundamental rights and freedoms.
• Consent: Processing for marketing communications and non-essential cookies, where your prior consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

af77 does not sell or commercially trade your personal data. We disclose personal data to the following categories of recipients only to the extent necessary for the purposes stated in Section 4:

• PAGCOR: As the regulatory authority issuing af77's operating license, PAGCOR has access to transaction data, player account data, and gaming records through the centralized monitoring system as required by the license conditions.
• Anti-Money Laundering Council (AMLC): Suspicious transaction reports and covered transaction reports as required under Republic Act No. 9160 (as amended by RA 10365 and RA 11521).
• National Privacy Commission (NPC): Reports and disclosures required under RA 10173, including data breach notifications and compliance submissions.
• Payment processors: GCash, Maya, GrabPay, BPI, BDO, Metrobank, and 7-Eleven CLiQQ — for the sole purpose of processing your deposits and withdrawal transactions.
• KYC service providers: Third-party identity verification services engaged by af77 to perform document and biometric verification for PAGCOR KYC compliance purposes.
• Game content providers: Certified game software providers may receive your player ID and session data to deliver licensed casino games. These providers are contractually bound to af77's data protection standards.
• Technology and infrastructure providers: Cloud hosting, security, and technical service providers bound by data processing agreements conforming to RA 10173 requirements.

af77 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device that allow af77 to recognize your browser session and improve your experience.

af77 uses the following categories of cookies:

• Strictly Necessary Cookies: Required for core Platform functionality — session authentication, wallet security, and PAGCOR-mandated session monitoring. These cannot be disabled without impairing Platform functionality.
• Performance Cookies: Collect anonymized data on page load times, error rates, and game performance to support Platform optimization. No personally identifiable data is included in performance cookie data.
• Functional Cookies: Remember your preferences — such as language settings and preferred game lobby view — to personalize your Platform experience.
• Analytics Cookies: Used to understand aggregate user behavior on the Platform, deployed via privacy-compliant analytics services. Analytics data is anonymized before processing.
• Marketing Cookies: Used only where you have provided consent to receive personalized promotional communications. You may withdraw consent and opt out of marketing cookies at any time through your account settings.

You may configure your browser to refuse all non-essential cookies. Note that disabling strictly necessary cookies will prevent you from using core af77 account and payment features.

af77 implements technical and organizational security measures proportionate to the sensitivity of the personal data processed and the risks posed by unauthorized access, alteration, disclosure, or destruction.

Our security measures include:

• TLS 1.3 encryption for all data in transit between your device and af77 servers.
• AES-256 encryption for sensitive data at rest, including KYC documents and financial transaction records.
• Role-based access control (RBAC) — access to personal data is restricted to authorized personnel with a documented operational need.
• Access logging and audit trails for all personnel access to personal data systems.
• Multi-factor authentication requirements for af77 staff accessing data processing systems.
• Regular third-party penetration testing and vulnerability assessments of the Platform's security posture.
• Data pseudonymization and anonymization applied to analytics and reporting datasets where full identifiability is not required.

af77 retains personal data for the period necessary to fulfill the stated processing purposes, after which data is securely deleted or anonymized. Minimum mandatory retention periods are governed by PAGCOR license conditions and Philippine law:

• KYC and identity verification records: Minimum five (5) years from account closure, as required by AMLC regulations.
• Transaction and financial records: Minimum five (5) years from the date of each transaction, per AMLC and Bureau of Internal Revenue requirements.
• Gaming and betting records: Minimum three (3) years from the date of each transaction, per PAGCOR monitoring requirements.
• Support communications: Two (2) years from the date of the last communication, retained for dispute resolution purposes.
• Self-exclusion records: For the duration of the exclusion period plus five (5) years, to prevent circumvention of exclusion through re-registration.
• Marketing consent records: For the period of consent plus three (3) years after withdrawal, to demonstrate lawful basis for historical communications.

Upon expiry of the applicable retention period, personal data is securely deleted from af77's systems using data sanitization methods conforming to NIST SP 800-88 or equivalent standards.

As a Data Subject under Republic Act No. 10173, you have the following rights with respect to your personal data processed by af77. Requests to exercise any of these rights should be submitted to [email protected] with the subject line "Data Rights Request — [Right Type]."

• Right to be Informed: The right to be notified of how your personal data is being collected and processed — fulfilled by this Privacy Policy.
• Right of Access: The right to obtain a copy of your personal data held by af77 and information about how it is being processed. Requests will be fulfilled within 15 business days.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. Identity verification may be required before corrections are applied to KYC-linked data.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the processing purposes or where you have withdrawn consent — subject to af77's legal retention obligations under PAGCOR, AMLC, and NPC regulations, which may require retention notwithstanding an erasure request.
• Right to Object: The right to object to processing based on af77's legitimate interests, including profiling for marketing purposes. af77 will cease such processing unless there are compelling legitimate grounds that override your interests.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format for data provided directly by you and processed by automated means.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe af77 has not complied with RA 10173 in its handling of your personal data.

The af77 Platform is strictly intended for adults aged 21 years and above in compliance with PAGCOR minimum gambling age requirements. af77 does not knowingly collect personal data from individuals below the age of 21.

The af77 registration process includes date-of-birth collection and mandatory KYC age verification specifically to enforce this restriction. Any account discovered to belong to a person under 21 will be immediately suspended, all balances will be frozen pending compliance review, and the matter will be reported to PAGCOR as required by license conditions.

If you believe that a minor has registered or gained access to an af77 Account, please contact af77 support immediately via live chat or at [email protected]. af77 will investigate and take immediate action upon receiving credible reports of underage access.

af77 is a Philippines-based operator and endeavors to process personal data within the Philippines wherever operationally feasible. Where game content providers or technology partners are located outside the Philippines, limited personal data (typically player session identifiers and game history records) may be transferred outside Philippine borders.

All cross-border data transfers by af77 are subject to the following safeguards:

• Data Processing Agreements (DPAs) with all third-party recipients, incorporating data protection standards at minimum equivalent to RA 10173 requirements.
• Limitation of transferred data to the minimum necessary for the specific service purpose.
• Contractual prohibition on the recipient's use of transferred data for any purpose other than the contracted service.
• Mandatory notification to af77 of any breach involving transferred personal data within 24 hours of the recipient becoming aware.

af77 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, af77's data processing practices, or Platform features. The current version of this Policy, together with its effective date, is always available at https://af77.lat/privacy-policy.

Where an amendment materially changes the rights of Data Subjects or the manner in which personal data is processed, af77 will notify registered Players via their registered email address or in-app notification at least seven (7) days before the amendment takes effect.

Continued use of the af77 Platform following the effective date of any Privacy Policy amendment constitutes your acknowledgment of the updated Policy. If you do not accept a material amendment, you may close your af77 Account before the effective date by contacting support.

For all privacy-related inquiries, data subject rights requests, or concerns regarding af77's handling of your personal data, please contact:

• Data Protection Officer (DPO): [email protected] — Subject line: "DPO — [Nature of Inquiry]"
• General Support (including account-level data queries): Live Chat available 24/7 on the af77 Platform, or via email at [email protected]
• Languages: English, Tagalog, and Bisaya support available
• Response Time: DPO inquiries acknowledged within 3 business days; substantive response within the NPC-prescribed period (not exceeding 30 days for routine requests)

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you are not satisfied with af77's response to a data subject rights request or believe your RA 10173 rights have been violated.