sg88 Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how sg88 ("sg88," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal data of individuals who use the sg88 online gaming platform at sg88.onl ("Platform"), including all services, features, promotions, and communications offered through the Platform.

sg88 is a PAGCOR-licensed online gaming operator committed to protecting the privacy and personal data of every Filipino player who trusts us with their information. This Policy is issued in compliance with Republic Act No. 10173 (Data Privacy Act of 2012, "DPA"), its Implementing Rules and Regulations, and applicable issuances by the National Privacy Commission ("NPC") of the Philippines.

By registering an account, logging in, or otherwise using the sg88 Platform, you acknowledge that you have read and understood this Policy. If you do not agree to the collection and use of your data as described herein, you should not use the sg88 Platform.

2 Who We Are — Data Controller

For the purposes of the Data Privacy Act of 2012, sg88 is the Personal Information Controller ("PIC") in respect of the personal data collected through the sg88 Platform. sg88 determines the purposes and means of processing your personal data in connection with the provision of online gaming services to Filipino players in the Philippines.

sg88 operates under a license granted by the Philippine Amusement and Gaming Corporation ("PAGCOR"), which also imposes independent data-related obligations on licensed operators, including mandatory reporting of certain player data and Anti-Money Laundering (AML) compliance obligations.

Our designated Data Protection Officer ("DPO") is responsible for overseeing sg88's compliance with this Policy and applicable data privacy law. You may contact our DPO at [email protected] — please mark your message "Data Privacy / DPO" for routing to the appropriate team.

3 Personal Data We Collect

sg88 collects the following categories of personal data in connection with the operation of the Platform and delivery of gaming services to Filipino players:

3.1 Identity & Registration Data

• Full legal name;
• Date of birth (for age verification — players must be 21+);
• Gender;
• Government-issued identification number(s) (e.g., Philippine passport number, SSS/UMID number, driver's licence number, PhilSys number);
• Nationality and country of residence;
• Residential address (including barangay, city, province, and ZIP code).

3.2 Contact Data

• Email address;
• Philippine mobile number;
• Optional: preferred communication language.

3.3 Financial & Transaction Data

• GCash account number and registered name (where GCash is used as a payment method);
• PayMaya / Maya account details (where PayMaya is used);
• Bank account name, account number, and bank name (BPI, BDO, Metrobank, or other Philippine banks where bank transfer is used);
• Deposit amounts, withdrawal amounts, transaction references, and timestamps;
• Source of funds declarations (where required by AML obligations).

3.4 KYC & Verification Data

• Copies of government-issued photo identification documents;
• Proof of address documents (e.g., utility bills, bank statements);
• Selfie photographs taken during identity verification;
• Liveness detection data (where applicable).

3.5 Gaming Activity Data

• Games played, bet amounts, win/loss records, session durations;
• Bonus redemptions and promotional participation;
• Responsible gaming tool usage (deposit limits, self-exclusion requests, cooling-off periods).

3.6 Technical & Device Data

• IP address;
• Device type, operating system, browser type and version;
• Cookie identifiers and session tokens;
• Geolocation data (country/region level, used to verify Philippines-based access).

3.7 Communications Data

• Records of your communications with sg88 Support, including emails, live chat transcripts, and support ticket history;
• Marketing preferences and subscription/unsubscription records.

4 How We Collect Your Data

sg88 collects your personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact sg88 Support, participate in promotions, or update your account settings.
• Automatically through Platform use: Through cookies, session tracking, server logs, and similar technologies when you access and use the sg88 website or mobile platform.
• From third-party service providers: From identity verification (KYC) service providers, payment processors (GCash, PayMaya, banks), fraud detection services, and analytics providers — all operating under data processing agreements with sg88.
• From regulatory authorities: sg88 may receive or be required to obtain additional data in connection with PAGCOR compliance reporting, AML obligations under Republic Act No. 9160 (AMLA), or court or government orders.

5 How We Use Your Personal Data

sg88 uses your personal data for the following purposes:

6 Legal Bases for Processing

Under the Data Privacy Act of 2012, sg88 processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and sg88 — i.e., operating your account, processing transactions, and delivering gaming services.
• Legal obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing conditions, the AMLA, and the DPA itself.
• Legitimate interests: Processing necessary for sg88's legitimate business interests — including fraud prevention, security, and Platform improvement — where such interests are not overridden by your rights and freedoms.
• Consent: For marketing communications and certain cookie-based processing, where your explicit consent is the appropriate legal basis. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7 Who We Share Your Data With

sg88 does not sell, rent, or trade your personal data. We share your data only in the following circumstances and with the following categories of recipients:

• PAGCOR and Philippine government authorities: Where required by our license, by law, or by valid legal process. This includes mandatory reporting of suspicious transactions to the Anti-Money Laundering Council (AMLC).
• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, and other Philippine payment processors strictly for the purpose of processing your deposits and withdrawals. These providers receive only the data necessary to complete the transaction.
• KYC and identity verification providers: Third-party service providers used to verify your identity and age during the KYC process. These providers operate under strict data processing agreements with sg88 and process your data solely on sg88's behalf.
• Fraud prevention and security providers: Service providers that help sg88 detect and prevent fraudulent activity, money laundering, and unauthorised account access.
• IT and platform infrastructure providers: Cloud hosting, data storage, and technology service providers that underpin the sg88 Platform infrastructure, operating under contractual data protection obligations.
• Legal and professional advisors: Lawyers, accountants, and auditors, where necessary for the conduct of sg88's business or the defence or prosecution of legal claims.

8 International Data Transfers

Some of sg88's technology and service providers — including cloud infrastructure providers and certain game studios — may process data in countries outside the Philippines. Where such international transfers occur, sg88 ensures that appropriate safeguards are in place in accordance with the Data Privacy Act of 2012 and NPC guidelines, including:

• Standard contractual clauses requiring overseas recipients to protect your data to at least the standard of the Philippine DPA;
• Transfers only to countries or entities that the NPC has recognised as providing adequate protection;
• Your explicit consent, where required.

sg88 will not transfer your personal data to a foreign country or foreign entity without implementing appropriate safeguards as required by Philippine law.

9 Data Retention

sg88 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, including compliance with applicable legal and regulatory retention obligations. Key retention periods applied by sg88 include:

At the end of the applicable retention period, sg88 will securely delete or anonymise your personal data in accordance with its data disposal procedures.

10 Cookies & Tracking Technologies

The sg88 Platform uses cookies, web beacons, pixel tags, and similar tracking technologies to operate effectively and deliver a personalised experience to Filipino players.

10.1 Types of Cookies Used

• Strictly necessary cookies: Required for the Platform to function. These include session cookies that maintain your login state, security tokens, and load balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Remember your preferences such as language setting and last-played games for a more convenient experience.
• Performance and analytics cookies: Collect anonymised data about how players navigate the sg88 Platform to help us identify and fix issues and improve game loading performance.
• Marketing and targeting cookies: Used with your consent to deliver relevant promotional content and track promotional campaign effectiveness.

10.2 Managing Cookies

You can manage or disable non-essential cookies through your browser settings at any time. Note that disabling certain cookies may impair your sg88 experience — for example, session cookies are essential for maintaining your login and cannot be disabled without logging you out.

11 Your Data Privacy Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights in relation to your personal data held by sg88. These rights may be subject to exceptions and limitations where sg88's legal obligations require otherwise.

12 Children's Privacy

The sg88 Platform is strictly for adults aged 21 years or older in compliance with PAGCOR regulations. sg88 does not knowingly collect personal data from individuals under the age of 21. The KYC process is designed to identify and reject underage applicants, and age verification is mandatory before withdrawals are processed.

13 Security Measures

sg88 implements technical, organisational, and physical security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and sg88 servers;
• Encrypted storage of sensitive personal data including KYC documents and financial information;
• Role-based access controls ensuring only authorised sg88 personnel can access personal data for legitimate business purposes;
• Regular security audits and penetration testing of the sg88 Platform infrastructure;
• Two-factor authentication (2FA) available for all player accounts to protect against unauthorised login;
• Automatic session timeouts that log out inactive accounts to prevent unauthorised access from shared or unattended devices;
• Incident response procedures for identifying, containing, and reporting personal data breaches in accordance with NPC requirements.

While sg88 takes reasonable and appropriate security measures, no data transmission over the internet or storage system can be guaranteed to be 100% secure. You also play an important role in protecting your account by using a strong, unique password and enabling 2FA.

14 Third-Party Links & Services

The sg88 Platform may contain references to third-party services (for example, payment processor interfaces for GCash or BPI). When you interact with a third-party service, you leave the sg88 environment and your activity is governed by that third party's own privacy policy and terms. sg88 has no control over, and is not responsible for, the privacy practices of third-party services.

sg88 recommends that you review the privacy policies of any third-party payment providers you use in connection with your sg88 account — particularly GCash (operated by Globe Telecom) and PayMaya (operated by Voyager Innovations/Maya Bank) — to understand how they handle your financial data.

15 Changes to This Privacy Policy

sg88 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or the services we offer. The revised Policy will be published at sg88.onl/privacy-policy with an updated effective date.

Where changes are material — meaning they significantly affect your rights or how your data is processed — sg88 will provide advance notice through one or more of the following: a notification on the Platform upon your next login, an email to your registered address, or a banner notice on the sg88 homepage.

Your continued use of the sg88 Platform after the effective date of any revised Policy constitutes your acknowledgement of the changes. If you do not agree to the revised Policy, you should stop using the Platform and contact sg88 to request account closure.

16 Contact Us & Filing Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by sg88, please contact us using the details below. All data privacy communications should be in writing.

Filing a Complaint with the National Privacy Commission

If you believe that sg88 has not adequately addressed your data privacy concern after raising it with us directly, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines — the independent regulatory authority responsible for enforcing the Data Privacy Act of 2012. Information on filing NPC complaints is available on the NPC's official website.

sg88 cooperates fully with the NPC and PAGCOR in all data privacy matters and takes all player data rights requests seriously. We encourage Filipino players to contact us first so we can resolve concerns promptly and directly.