aaaaopen Casino Privacy Policy

For the purposes of the Data Privacy Act of 2012 and its implementing rules, the data controller responsible for your personal information processed in connection with the aaaaopen Platform is the legal entity operating aaaaopen, accessible at https://aaaaopen.app (hereinafter referred to as "aaaaopen," "we," "us," or "the Company").

aaaaopen has appointed a Data Protection Officer (DPO) as required under RA 10173 and the applicable NPC issuances. The DPO is responsible for overseeing aaaaopen's data protection compliance programme, serving as the primary point of contact for data subject rights inquiries, and liaising with the National Privacy Commission on privacy-related matters. The DPO can be contacted through the details provided in Section 15 of this Privacy Policy.

aaaaopen collects personal data through multiple channels including direct submission during registration, automatic collection during Platform use, and third-party sources where applicable. The categories of personal data we collect and their sources are set out below.

When you create an aaaaopen account, we collect: full legal name; Philippine mobile number; date of birth; username; and the password you set (stored in hashed, irreversible form — we do not store plaintext passwords). This is the minimum data necessary to create and identify your Account.

To comply with PAGCOR regulations and anti-money laundering obligations, aaaaopen is required to verify the identity of all Players who request withdrawals. KYC data may include: scanned or photographed copies of valid Philippine government-issued identification documents (e.g., Philippine Passport, UMID, PhilSys National ID, Driver's Licence, PRC Professional ID, SSS ID, GSIS eCard, Voter's ID); selfie photographs for face-matching verification; and proof of address documents such as utility bills or bank statements in your name.

aaaaopen processes the following financial data in connection with deposits and withdrawals: GCash mobile number used for transactions; bank account numbers and bank name where bank transfers are used; transaction reference numbers; deposit and withdrawal amounts and timestamps; and account balance history. aaaaopen does not store full credit card or debit card numbers. Payment card data, where applicable, is handled entirely by our PCI DSS-compliant payment processor and is not accessible to aaaaopen in unmasked form.

aaaaopen automatically records all gaming activity conducted through your Account, including: games played and game session durations; wager amounts, game outcomes, and win/loss records; bonus activations and wagering progress; and sports betting markets and bet details. This data is used for account management, fair gaming verification, regulatory reporting, and responsible gaming monitoring.

When you access the aaaaopen Platform, we automatically collect: IP address; device type, model, and operating system; browser type and version; mobile network provider; session timestamps and duration; pages visited within the Platform; and referring URL. This data is used for security monitoring, fraud prevention, and Platform performance optimisation.

aaaaopen retains records of communications between you and our customer support team, including live chat transcripts, email correspondence, and SMS exchanges. These records are retained for quality assurance, dispute resolution, regulatory compliance, and staff training purposes.

Where you have provided consent to receive marketing communications, aaaaopen records your communication preferences, promotion opt-in/opt-out status, and interactions with marketing messages (e.g., SMS opens or link clicks). This data is used solely for the purpose of tailoring promotional offers to your stated preferences and ensuring you receive only communications you have agreed to receive.

Under RA 10173 and its Implementing Rules, personal data processing requires a lawful basis. aaaaopen processes your personal data under the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing that is necessary to create and manage your aaaaopen Account, process deposits and withdrawals, verify game outcomes, and deliver the services you have contracted for under our Terms & Conditions.
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR regulatory requirements, Anti-Money Laundering Act (AMLA) obligations, tax reporting requirements, and NPC data governance obligations.
• Legitimate Interest: Processing for fraud prevention, platform security monitoring, responsible gaming risk detection, and internal analytics for service improvement, where such interests are not overridden by your privacy rights.
• Consent: Processing for optional activities such as marketing communications, optional profiling for personalised game recommendations, and the use of non-essential cookies. You may withdraw consent to any consent-based processing at any time without affecting the lawfulness of prior processing or the continuation of your Account.

aaaaopen uses your personal data for the following specific purposes, each of which is grounded in one of the legal bases set out in Section 3:

• Account Registration and Management: Creating your aaaaopen account, maintaining accurate account records, authenticating your identity at login, managing your PHP wallet balance, and delivering account-related notifications via SMS to your registered Philippine mobile number.
• Payment Processing: Facilitating GCash, PayMaya, BDO, BPI, Metrobank, and other payment method transactions, processing withdrawal requests, and reconciling transaction records.
• Identity Verification and KYC: Verifying your identity in compliance with PAGCOR licensing conditions and AMLA obligations before processing your first withdrawal or at any point where regulatory verification is required.
• Regulatory and Legal Compliance: Maintaining records required by applicable Philippine law and gaming regulations, responding to lawful requests from PAGCOR, law enforcement agencies, and the NPC, and fulfilling anti-money laundering monitoring obligations.
• Fraud Prevention and Platform Security: Detecting and preventing fraudulent activity, unauthorised account access, bonus abuse, money laundering, and other prohibited conduct through automated and manual review of account and transaction data.
• Responsible Gaming Monitoring: Analysing gaming activity patterns to identify indicators of problem gambling and, where such indicators are present, applying protective measures as described in our Terms & Conditions and Responsible Gaming Policy.
• Customer Support: Responding to your inquiries, resolving disputes, and maintaining records of support interactions for quality assurance and training.
• Platform Improvement and Analytics: Analysing aggregated, anonymised usage data to understand how players interact with the aaaaopen Platform and to guide product development decisions.
• Marketing Communications (Consent-based): Sending promotional offers, bonus notifications, and new game announcements via SMS or in-platform messaging where you have explicitly opted in to receive such communications.

Cookies are small text files placed on your device when you visit a website. The aaaaopen Platform uses cookies and similar tracking technologies (including session tokens and local storage) to enable core Platform functionality, maintain your login session, and — where you have consented — to analyse your usage patterns and personalise your experience.

• Strictly Necessary Cookies: Essential for the Platform to function. These enable login session maintenance, shopping cart functionality within the deposit flow, and security features. These cookies cannot be disabled without breaking core Platform functionality.
• Performance and Analytics Cookies: Collect anonymised information about how visitors use the Platform — which pages are visited most, how long sessions last, and where errors occur. Used to improve Platform performance. Deployed only where you have consented.
• Functional Cookies: Remember your language preferences and Platform settings between sessions. These improve your user experience but are not essential to basic functionality.
• Marketing and Retargeting Cookies: aaaaopen does not deploy third-party advertising or retargeting cookies. Any marketing communications from aaaaopen are delivered directly through the Platform's own channels.

You can manage non-essential cookies through your browser settings, which allow you to block or delete cookies at any time. Note that disabling strictly necessary cookies may impair your ability to log in to and use the aaaaopen Platform. Your cookie preferences for non-essential cookies are stored and respected on subsequent visits.

aaaaopen shares personal data with third parties only where strictly necessary for the delivery of Platform services or where required by law. The categories of recipients and the basis for sharing are as follows:

• Payment Service Providers: GCash (G-Xchange, Inc.), PayMaya (PayMongo Philippines, Inc.), and Philippine bank payment partners receive the minimum personal and financial data required to process your deposit or withdrawal transactions. All payment processors are contractually bound to handle your data solely for payment processing purposes.
• Identity Verification Providers: Third-party KYC technology providers may process your government ID images and selfie photographs for the purpose of automated identity verification. These providers operate under data processing agreements that restrict use of your data to verification purposes only.
• Game Software Providers: JILI Technology and other game content licensors may receive anonymised session data required to deliver and maintain game functionality. Personal identifiers are not shared with game providers beyond what is necessary for game session authentication.
• Cloud Infrastructure Providers: aaaaopen's Platform and data are hosted on cloud infrastructure operated by reputable providers. Hosting providers are contractually prohibited from accessing or using aaaaopen's data for any purpose other than infrastructure service delivery.
• Regulatory and Law Enforcement Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, the Bureau of Internal Revenue (BIR), and law enforcement agencies may receive personal data where aaaaopen is legally obligated to disclose or where disclosure is necessary to prevent or investigate criminal activity.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by aaaaopen may access personal data on a need-to-know basis, subject to professional secrecy obligations.

All third-party data sharing arrangements are governed by written data processing agreements or equivalent contractual protections that require recipients to maintain appropriate security standards and limit processing to the specified purpose.

aaaaopen's primary data storage and processing infrastructure is located within or managed in alignment with Philippine data protection standards. Where it is necessary to transfer personal data to recipients in countries outside the Philippines — for example, to cloud infrastructure nodes or game software providers with operations in other jurisdictions — aaaaopen ensures that such transfers are lawful by implementing one or more of the following safeguards:

• Verification that the recipient country provides an adequate level of data protection as recognised by the NPC;
• Execution of data transfer agreements incorporating standard contractual clauses approved by the NPC or equivalent contractual protections;
• Binding corporate rules where transfers are made within a corporate group;
• Your explicit consent, where required under applicable NPC guidance.

You may request details of the safeguards applied to any specific international transfer by contacting the aaaaopen Data Protection Officer at the contact details in Section 15.

aaaaopen retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply:

Upon expiry of the applicable retention period, aaaaopen will securely delete or irreversibly anonymise your personal data. Where data cannot be immediately deleted due to backup cycle constraints, it will be isolated from active systems and deleted in the next scheduled purge cycle.

Under the Data Privacy Act of 2012, you have the following rights as a data subject with respect to your personal information held by aaaaopen. These rights are real, enforceable, and aaaaopen is committed to facilitating their exercise promptly and without unnecessary friction.

To exercise any of the above rights, submit a written request to the aaaaopen Data Protection Officer using the contact details in Section 15. Include your full name, registered Account mobile number, and a description of the right you wish to exercise. aaaaopen will acknowledge your request within five (5) business days and provide a substantive response within fifteen (15) business days, or such other timeframe as required under applicable NPC guidance.

The aaaaopen Platform is strictly restricted to persons who are 21 years of age or older in accordance with applicable Philippine gaming law. aaaaopen does not knowingly collect personal data from any person under the age of 21. The minimum age for gambling in the Philippines is set at 21 years, and aaaaopen enforces this through age declaration at registration and identity document verification for withdrawals.

If aaaaopen becomes aware that personal data has been collected from a person under 21 years of age — whether through self-disclosure, third-party report, or internal detection — the relevant Account will be immediately suspended, all associated transactions voided, and any balance handled in accordance with applicable law. The personal data of the underage individual will be securely deleted to the extent permitted under applicable legal hold and regulatory reporting obligations.

If you have reason to believe that a person under 21 years of age has registered on the aaaaopen Platform, please notify us immediately via the contact details in Section 15.

aaaaopen implements a multi-layered technical and organisational security programme designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures in place include:

• Encryption: All personal data is encrypted at rest using AES-256. Data in transit is protected by TLS 1.2 or higher. Password data is stored using one-way hashing algorithms with salt (bcrypt or equivalent).
• Access Controls: Access to personal data within aaaaopen's systems is governed by a role-based access control model. Only authorised personnel with a documented need-to-know basis may access player personal data. Access logs are maintained and reviewed regularly.
• Two-Factor Authentication: aaaaopen's internal systems require multi-factor authentication for staff accessing personal data systems. Players are strongly encouraged to enable 2FA on their accounts via SMS OTP.
• Penetration Testing and Vulnerability Management: aaaaopen conducts regular security assessments, including external penetration testing, to identify and remediate vulnerabilities in the Platform and its supporting infrastructure.
• Fraud and Anomaly Detection: Automated systems monitor account activity for signs of unauthorised access, unusual transaction patterns, and suspicious login behaviour. Alerts are reviewed by the security team on an ongoing basis.
• Employee Training: All aaaaopen staff who handle personal data undergo data privacy training upon onboarding and at regular intervals thereafter. Confidentiality obligations are written into all staff contracts.
• Vendor Security Assessment: Third-party processors and technology providers are assessed for security posture before onboarding and are contractually required to maintain security standards consistent with applicable law and aaaaopen's requirements.

While aaaaopen takes all reasonable measures to protect your personal data, no online platform can guarantee absolute security. Players are encouraged to use a strong, unique password for their aaaaopen account, enable 2FA, and promptly report any suspected unauthorised access to their Account.

In the event that aaaaopen becomes aware of a personal data breach — defined under RA 10173 as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored, or otherwise processed — the following response procedures apply:

1. Containment and Assessment: Upon discovery of a suspected breach, aaaaopen will immediately activate its Incident Response Plan, contain the breach to prevent further exposure, and conduct a preliminary risk assessment to determine the nature and scope of the incident.
2. NPC Notification: Where the breach is likely to give rise to a real risk of serious harm to affected data subjects, aaaaopen will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach, as required under NPC Circular 16-03.
3. Data Subject Notification: Affected players whose personal data was involved in the breach will be notified without undue delay where the breach is likely to result in harm. The notification will describe the nature of the breach, the categories of data involved, the likely consequences, and the measures taken or proposed to address the breach.
4. Remediation: aaaaopen will take all appropriate technical and organisational measures to remediate the breach, prevent recurrence, and document the incident in its internal breach register as required by the NPC.

The aaaaopen Platform does not contain links to third-party websites, applications, or services unrelated to the delivery of the aaaaopen gaming experience. aaaaopen does not operate affiliate advertising networks, display third-party banner advertisements, or embed third-party social media tracking pixels that would cause your personal data to be transmitted to external parties without your knowledge.

Where the Platform does interact with third-party services — such as the GCash payment interface or payment gateway redirect pages — those services are governed by the privacy policies of their respective operators. aaaaopen is not responsible for the privacy practices of third-party service providers, and players are encouraged to review the privacy policies of any third-party services they use in connection with their aaaaopen Account.

aaaaopen reserves the right to update or amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, Platform functionality, or internal data processing practices. The "Last Updated" date at the top of this Privacy Policy indicates when the most recent revision was made.

Material changes to this Privacy Policy — meaning changes that significantly affect your privacy rights or the way we process your personal data — will be communicated to you via: (a) a prominent notice on the Platform login screen or homepage for a minimum period of thirty (30) days; and/or (b) an SMS notification to your registered Philippine mobile number.

Your continued use of the aaaaopen Platform after the effective date of any amended Privacy Policy constitutes your acknowledgment of the changes. Where amended processing is based on consent, we will seek fresh consent before commencing that processing.

The current version of this Privacy Policy is always available at https://aaaaopen.app/privacy-policy. We encourage you to review it periodically. If you have questions about any amendment, contact the DPO using the details in Section 15 before continuing to use the Platform.

For any questions, concerns, or requests relating to this Privacy Policy or aaaaopen's data processing practices — including the exercise of your data subject rights under RA 10173 — please contact the aaaaopen Data Protection Officer or Customer Support Team through the following channels: