Privacy Policy – pisotaya Online Casino

1. Introduction

pisotaya ("we," "us," "our," or "pisotaya") is the operator of the online gaming platform accessible at pisotaya.org. We are committed to safeguarding the privacy of all individuals who interact with our Platform, including registered players, prospective players, and visitors to our website.

This Privacy Policy ("Policy") describes how pisotaya collects, uses, stores, shares, and protects personal data in connection with the operation of the Platform and associated services. It has been prepared in compliance with the Philippine Data Privacy Act of 2012 (R.A. 10173), its Implementing Rules and Regulations (IRR), and the applicable issuances of the National Privacy Commission (NPC).

By registering a pisotaya account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, please discontinue use of the Platform.

2. Data Controller

For the purposes of the Philippine Data Privacy Act, pisotaya is the Personal Information Controller (PIC) in respect of personal data collected through the Platform. Our Data Protection Officer (DPO) can be contacted at the details provided in Section 15 of this Policy.

pisotaya operates under the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR). Certain data processing activities are conducted in furtherance of PAGCOR's regulatory requirements, in which case PAGCOR may also be considered a relevant authority for data governance purposes.

3. Personal Data We Collect

3.1 Registration & Identity Data

When you create a pisotaya account, we collect the following categories of personal data:

• Full legal name (as it appears on your government-issued ID);
• Date of birth and age verification information;
• Philippine residential address;
• Valid Philippine mobile number;
• Email address;
• Government-issued ID number (e.g., PhilSys, UMID, passport, driver's license);
• Username and encrypted password;
• Profile photo (optional).

3.2 Financial & Transaction Data

In connection with deposits, withdrawals, and gaming activity, pisotaya collects:

• Payment method identifiers (e.g., GCash mobile number, Maya account reference, BPI/BDO account details);
• Transaction amounts, dates, and references;
• Account balance history;
• Bonus and promotion redemption records;
• Source of funds documentation (where required for KYC/AML compliance).

3.3 Gaming & Behavioral Data

• Game participation records, bet amounts, and outcomes;
• Session duration and login timestamps;
• Game preferences and interaction patterns;
• Responsible gaming tool usage (deposit limits, session timers, self-exclusion).

3.4 Technical & Device Data

• IP address and approximate geolocation;
• Device type, operating system, and browser;
• Cookie identifiers and session tokens;
• Access logs and Platform navigation data.

3.5 Communications Data

• Records of customer support interactions (live chat, email, SMS);
• Feedback and survey responses;
• Records of any complaints or dispute correspondence.

4. How We Collect Personal Data

pisotaya collects personal data through the following methods:

• Directly from you: Information you provide during registration, KYC verification, deposit and withdrawal transactions, customer support contacts, and survey participation;
• Automatically via the Platform: Technical data collected through cookies, session logs, and analytics tools as you navigate and use pisotaya;
• From third-party payment providers: Transaction confirmation data from GCash, Maya, BPI, BDO, and other integrated payment services;
• From identity verification services: Results of government ID verification checks conducted in compliance with PAGCOR's KYC requirements;
• From PAGCOR and law enforcement: Where required by regulatory mandate or court order.

5. Purposes of Processing

pisotaya processes your personal data for the following purposes:

6. Legal Bases for Processing

pisotaya processes personal data on the following legal bases under R.A. 10173:

• Contractual necessity: Processing required to provide the gaming services you have contracted for by registering a pisotaya account;
• Legal obligation: Processing required to comply with PAGCOR regulations, AMLA (R.A. 9160), PDPA (R.A. 10173), and other applicable Philippine laws;
• Legitimate interests: Processing for fraud prevention, security monitoring, and Platform improvement where such interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications and optional profile features, where you have given explicit consent that you may withdraw at any time.

7. Data Sharing & Disclosure

7.1 Service Providers

pisotaya shares personal data with carefully selected third-party service providers who process data on our behalf under data processing agreements that require them to maintain appropriate security measures. These include: payment processors (GCash/Maya/banks), KYC verification providers, game software suppliers, cloud infrastructure providers, and customer support platform providers.

7.2 Regulatory Authorities

pisotaya is required to share certain player data with PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine regulatory or law enforcement bodies where required by law or regulatory directive.

7.3 Business Transfers

In the event of a merger, acquisition, or asset sale involving pisotaya, personal data held by pisotaya may be transferred to the relevant successor entity, subject to appropriate data protection undertakings.

8. International Data Transfers

Some of pisotaya's service providers (including game software suppliers and cloud infrastructure providers) may be located outside the Philippines. Where personal data is transferred to recipients in jurisdictions outside the Philippines, pisotaya ensures that appropriate safeguards are in place, including contractual clauses approved by the NPC or equivalent data protection standards required by the recipient jurisdiction.

pisotaya will not transfer your personal data to any jurisdiction that does not provide an adequate level of protection for personal data without first obtaining your consent or ensuring appropriate contractual protections are in place.

9. Data Retention

pisotaya retains personal data for the following periods:

• Active account data: For the duration of your pisotaya account plus five (5) years after account closure, as required by PAGCOR regulations and AMLA;
• Transaction records: Minimum of five (5) years from the date of the transaction, per AMLA requirements;
• KYC documentation: Minimum of five (5) years from the end of the business relationship;
• Support correspondence: Three (3) years from the date of the last communication;
• Marketing consent records: Until withdrawn plus one (1) year for proof of consent.

At the end of applicable retention periods, personal data is securely deleted or anonymized in accordance with NPC guidelines.

10. Security Measures

pisotaya implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

• AES-256 encryption for data at rest; TLS 1.3 for data in transit;
• Multi-factor authentication for Platform access and administrative systems;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular security audits and penetration testing by independent security professionals;
• 24/7 security monitoring and intrusion detection systems;
• Incident response procedures compliant with NPC breach notification requirements (72-hour notification obligation).

11. Cookies & Tracking Technologies

pisotaya uses cookies and similar tracking technologies to operate the Platform and enhance your experience. The categories of cookies used are:

• Essential cookies: Required for Platform functionality, authentication, and session security. These cannot be disabled without impairing Platform operation.
• Functional cookies: Remember your preferences (e.g., language, last-played game category) to personalize your pisotaya experience.
• Analytics cookies: Collect aggregated, anonymized data about how players use the Platform to help us improve performance and game selection.
• Security cookies: Help detect and prevent fraud, bot activity, and unauthorized account access.

You may manage non-essential cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality.

12. Your Rights Under R.A. 10173

As a data subject under the Philippine Data Privacy Act, you have the following rights in respect of your personal data held by pisotaya:

To exercise any of the above rights, please contact pisotaya's Data Protection Officer using the contact details in Section 15. pisotaya will respond to all data subject requests within fifteen (15) business days of receipt.

13. Children's Privacy

The pisotaya Platform is strictly intended for individuals aged twenty-one (21) years and above. pisotaya does not knowingly collect personal data from persons under the age of 21. Age verification is a mandatory component of the pisotaya registration process.

If pisotaya discovers that personal data has been collected from a person under 21, the relevant account will be immediately closed, all personal data will be securely deleted, and any deposited funds will be returned to the payment source. If you have reason to believe a minor has accessed the pisotaya Platform, please notify our Data Protection Officer immediately.

14. Changes to This Privacy Policy

pisotaya reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or PAGCOR requirements. Where material changes are made, pisotaya will notify registered players via in-platform notification or email at least fourteen (14) days before the changes take effect.

The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of the pisotaya Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. We encourage you to review this Policy periodically.

15. Contact & Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or pisotaya's data processing practices, please contact our Data Protection Officer: