ma77 Casino Privacy Policy — How We Collect, Use, and Protect Your Personal Data

ma77 is committed to protecting the privacy and personal data of all users of the ma77.asia platform, including registered players, prospective players who browse the site without registering, and any other individuals whose data is processed in connection with the operation of the Platform. This Policy sets out what personal data we collect, why we collect it, how we use it, and the rights you have in relation to that data.

This Policy applies to all personal data processing activities conducted by ma77 in connection with the Platform, regardless of the device or technology used to access it. It covers data collected through the website at ma77.asia, through communications with our customer support team, and through our payment processing integrations — including GCash, Maya, and Philippine bank transfer channels.

This Policy is governed by Republic Act No. 10173, the Philippine Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the relevant issuances of the National Privacy Commission ("NPC"). As an online gaming platform regulated by PAGCOR, ma77 is also subject to PAGCOR's data handling and player protection requirements, which are consistent with and supplementary to DPA obligations.

For the purposes of the Philippine Data Privacy Act of 2012, the data controller responsible for your personal data in connection with the ma77 platform is the operating entity of ma77.asia. As data controller, ma77 determines the purposes for which and the manner in which personal data is processed. Questions regarding data controller identity, processing activities, or the exercise of data subject rights may be directed to our Data Protection Officer using the contact details in Section 14 of this Policy.

ma77 collects only the personal data necessary for the stated purposes described in this Policy. The categories of personal data we collect include:

• Full legal name as it appears on your Philippine government-issued ID;
• Date of birth (used to verify the 21+ age requirement);
• Philippine mobile number (primary account identifier and communication channel);
• Username chosen during registration;
• Account password (stored in encrypted, hashed form — never in plain text).

• Copies of Philippine government-issued identification documents (PhilSys, UMID, driver's license, passport, SSS ID, GSIS ID, PRC ID);
• Selfie or live photograph for identity document matching, where required;
• Proof of address documentation, where required for enhanced due diligence.

• GCash mobile number and account reference information used for deposit and withdrawal processing;
• Maya account reference information, where applicable;
• Philippine bank account details (bank name, account number suffix) for bank transfer transactions;
• Deposit and withdrawal transaction history, amounts, timestamps, and payment method used;
• Account wallet balance at any given time.

• Game session histories, bet amounts, game outcomes, and win/loss records;
• Sports betting selections and results;
• Bonus and promotion claims and wagering activity;
• Login timestamps, session durations, and logout records.

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser information;
• Cookies and similar tracking technologies (see Section 7);
• Platform access logs and error reports.

• Records of live chat interactions with ma77 customer support;
• Email correspondence with ma77 support;
• Records of responsible gaming tool activations, self-exclusion requests, and related support interactions.

ma77 collects personal data through the following means:

• Directly from you — when you register an account, complete identity verification, make deposits or withdrawals, contact support, or interact with the Platform in any way that requires you to provide information;
• Automatically — through cookies, web server logs, and similar technologies that record technical information about your device and how you interact with the Platform;
• From payment providers — GCash, Maya, and Philippine banks may provide transaction confirmation data to ma77 as part of payment processing;
• From identity verification services — third-party KYC and identity verification service providers may supply verification results in connection with your identity document submissions;
• From regulatory bodies — PAGCOR and other Philippine regulatory or law enforcement authorities may provide information relevant to compliance obligations.

ma77 processes your personal data for the following purposes, each supported by a lawful basis under the Philippine Data Privacy Act:

ma77 does not sell, rent, or trade your personal data to any third party for their own marketing purposes. We share personal data only in the circumstances described below and only to the extent necessary for the stated purpose:

• Payment service providers — GCash (G-Xchange Inc.), Maya (PayMaya Philippines Inc.), and Philippine banks, to the extent necessary to process your deposits and withdrawals;
• Identity verification providers — third-party KYC service providers engaged to assist with identity document verification, subject to data processing agreements;
• Game software providers — providers such as JILI Games, Pragmatic Play, and Evolution Gaming receive session data necessary to operate their games on the Platform, under contractual data protection terms;
• PAGCOR — as required by our operating authorization, including player identity, transaction, and gaming activity data as specified by PAGCOR's reporting requirements;
• Philippine law enforcement and courts — where required by a valid court order, law enforcement request, or other legally compelled disclosure under Philippine law;
• Anti-money laundering authorities — the Anti-Money Laundering Council (AMLC) and related bodies, where reportable transactions or suspicious activity reporting obligations apply;
• Professional advisors — lawyers, auditors, and accountants, subject to confidentiality obligations, where necessary for legal or financial compliance purposes.

ma77 uses cookies and similar technologies on the ma77.asia platform to enable core functionality, maintain your login session, prevent fraud, and understand how the Platform is used. The categories of cookies used are:

• Strictly necessary cookies — required for the Platform to function, including session authentication cookies that keep you logged in during a visit. These cannot be disabled.
• Functional cookies — remember your preferences (such as language and display settings) to improve your experience across sessions.
• Security cookies — used to detect and prevent fraudulent activity, identify suspicious device patterns, and protect account integrity.
• Analytics cookies — collect aggregated, anonymised data about how visitors use the Platform, allowing us to improve navigation and game lobby design. No personally identifiable information is contained in analytics data.

You may manage non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. Continued use of the Platform after being informed of our cookie use constitutes consent to the use of cookies as described in this Policy.

ma77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. Specific retention periods include:

• Account and identity data is retained for the duration of your active account plus a minimum of five (5) years after account closure, in compliance with PAGCOR and AMLA record-keeping requirements;
• Transaction and financial data is retained for a minimum of five (5) years in accordance with AMLA and PAGCOR reporting obligations;
• Game session and betting history data is retained for a minimum of three (3) years;
• Customer support communications are retained for two (2) years;
• Technical and device data (logs) is retained for up to twelve (12) months.

Data subject to longer mandatory retention obligations under Philippine law will be retained for the applicable statutory period. After retention periods expire, data is securely deleted or anonymised in accordance with our data disposal procedures.

ma77 implements technical and organisational security measures appropriate to the nature and sensitivity of the personal data we process. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the ma77.asia platform;
• Encrypted storage of passwords using industry-standard hashing algorithms — passwords are never stored in plain text;
• Access controls limiting internal access to personal data to authorised personnel with a legitimate need to process it;
• Regular security assessments and penetration testing of platform infrastructure;
• Segregation of player funds in accounts separate from company operational funds;
• Data breach response procedures aligned with the NPC's mandatory breach notification requirements under the DPA.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data processed by ma77:

• Right to be Informed — the right to know what personal data we collect and how it is used, as described in this Policy;
• Right of Access — the right to request a copy of your personal data held by ma77;
• Right to Rectification — the right to have inaccurate or incomplete personal data corrected;
• Right to Erasure ("Right to be Forgotten") — the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to overriding legal retention obligations;
• Right to Object — the right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interest;
• Right to Data Portability — the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format;
• Right to Withdraw Consent — where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal;
• Right to Lodge a Complaint — the right to file a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

To exercise any of the above rights, contact ma77's Data Protection Officer using the details in Section 14. We will respond to all verifiable data subject requests within fifteen (15) business days. Some requests may be subject to identity verification before processing.

The ma77 platform is strictly intended for adults aged 21 years and above in accordance with PAGCOR's minimum age requirements for online gambling in the Philippines. ma77 does not knowingly collect personal data from individuals under 21 years of age. Any account found to have been registered by a person under 21 will be immediately suspended and any personal data associated with that account will be handled in accordance with PAGCOR's underage account protocols.

If you are a parent or guardian and believe that a minor has registered a ma77 account or provided personal data to the Platform without your consent, please contact ma77 support immediately via live chat or email at [email protected] so that we can investigate and take appropriate action.

In the course of operating the ma77 platform, personal data may be transferred to or accessed from locations outside the Philippines — for example, in connection with cloud infrastructure providers, game software providers with data centres outside the Philippines, or fraud detection systems. Any such cross-border transfers of personal data are conducted in compliance with Section 21 of the Philippine Data Privacy Act, which requires that the recipient country or organisation provides a comparable level of protection to that afforded under Philippine law, or that appropriate safeguards (such as standard contractual clauses) are in place.

ma77 ensures that all data processing agreements with third-party international service providers include appropriate data protection obligations consistent with the DPA and NPC requirements. Players who have questions about specific cross-border transfers may contact our Data Protection Officer.

ma77 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will provide notice through a prominent announcement on the ma77.asia platform and, where practicable, by notification to your registered mobile number. The effective date of the current version of this Policy is stated in the page header.

Your continued use of the ma77 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated Policy. If you do not agree with the revised Policy, you must discontinue use of the Platform and may request account closure by contacting ma77 support.

For all privacy-related queries, data subject rights requests, or concerns about this Policy, please contact the ma77 Data Protection Officer:

Complaints that cannot be resolved directly with ma77 may be escalated to the National Privacy Commission (NPC) of the Philippines through their official complaint procedures.