Privacy Policy of tayawin8

01 Introduction

This Privacy Policy ("Policy") describes how tayawin8 ("tayawin8," "we," "us," "the Company") collects, uses, stores, discloses, and protects the personal information of individuals ("you," "Player," "User") who access or use the tayawin8 online gaming platform at tayawin8.co and any associated sub-domains, mobile versions, or applications (collectively, "the Platform").

tayawin8 is a Philippine-focused online casino and sports betting platform offering live casino games, slots, bingo, fishing arcade titles, and sports wagering. The Platform is operated in compliance with the regulatory framework of the Philippine Amusement and Gaming Corporation ("PAGCOR") and in accordance with Republic Act 10173, the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations ("IRR"), and applicable issuances of the National Privacy Commission ("NPC").

02 Who We Are — Data Controller

For the purposes of the Philippine Data Privacy Act of 2012, tayawin8 is the Personal Information Controller ("PIC") in respect of the personal data you provide when registering and using the Platform. As PIC, tayawin8 is responsible for determining the purposes for which, and the means by which, your personal data is processed.

tayawin8 has designated a Data Protection Officer ("DPO") in accordance with NPC requirements. The DPO oversees the Company's data privacy compliance program, handles data subject rights requests, and serves as the primary contact for all privacy-related inquiries. Contact details for the DPO are provided in Section 15 of this Policy.

03 Personal Data We Collect

tayawin8 collects the following categories of personal data, grouped by collection context:

tayawin8 does not collect full credit card numbers, CVV codes, or full bank account numbers. Financial credentials are handled exclusively by our licensed payment processing partners.

04 How We Collect Your Data

tayawin8 collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, initiate financial transactions, contact customer support, or update your account settings.
• Automatically via the Platform — through cookies, session tokens, device fingerprinting technologies, and server logs generated when you access and interact with the Platform. See Section 10 for full cookie details.
• From third-party service providers — payment processors (GCash, Maya, BPI, BDO, Metrobank, and others) may share transaction reference data necessary to match deposits and withdrawals to your account. Identity verification providers may return match/no-match signals from government ID database checks where lawfully permitted.
• From PAGCOR and regulatory bodies — where we are required to cross-reference data for AML compliance, self-exclusion register checks, or other regulatory purposes.

05 Legal Basis for Processing

tayawin8 processes your personal data under the following legal bases as defined in the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing of registration data, financial data, and gaming activity data is necessary to provide the services you have contracted for by accepting our Terms & Conditions. Without this processing, tayawin8 cannot operate your account.
• Legal Obligation: KYC identity verification, AML transaction monitoring, PAGCOR compliance reporting, and data retention are required by Philippine law, including Republic Act 9160 (Anti-Money Laundering Act), PAGCOR regulatory directives, and the DPA itself.
• Legitimate Interests: Technical and security data processing — including fraud detection, abuse prevention, platform security monitoring, and aggregate analytics — is conducted on the basis of tayawin8's legitimate interest in maintaining a safe and functional platform, balanced against your privacy rights.
• Consent: Where tayawin8 processes data for purposes not covered by the above bases — such as optional marketing communications — we rely on your explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal.

06 How We Use Your Personal Data

tayawin8 uses personal data for the following specific purposes:

• To create, manage, and maintain your tayawin8 account, including authentication, session management, and account security.
• To process deposits and withdrawals through your nominated payment methods, and to reconcile transaction records.
• To verify your identity and age (21+) in compliance with PAGCOR licensing requirements and KYC obligations under Philippine AML law.
• To monitor transactions for suspicious activity, investigate potential fraud or money laundering, and file Suspicious Transaction Reports with the Anti-Money Laundering Council (AMLC) where required by law.
• To provide responsible gaming services, including administering deposit limits, cooling-off periods, and self-exclusion requests, and to cross-reference against PAGCOR's self-exclusion register.
• To deliver and improve the Platform, including diagnosing technical issues, optimizing game loading performance, and conducting A/B testing for UI improvements.
• To communicate with you regarding account activity, promotional offers (where consented), policy updates, and security alerts.
• To comply with PAGCOR reporting obligations, NPC data breach notification requirements, and court orders or law enforcement requests that are lawfully issued.
• To enforce the tayawin8 Terms & Conditions, including investigating prohibited conduct, voiding fraudulent wagers, and closing accounts in breach of our policies.

07 Data Sharing & Disclosure

7.1 Third-Party Service Providers

tayawin8 engages the following categories of third-party Personal Information Processors ("PIPs") to assist in delivering Platform services. All PIPs are contractually bound to process your data only on tayawin8's instructions and to maintain security and confidentiality standards equivalent to those required under the Philippine DPA:

• Payment processors — GCash (GXI), Maya (Voyager Innovations), Bancnet, and other licensed Philippine payment service providers, for the purpose of processing deposits and withdrawals.
• KYC and identity verification providers — licensed identity verification service providers that match government ID data against authoritative databases to confirm player identity and age.
• Game software providers — licensed studios including Evolution Gaming, Pragmatic Play, PG Soft, JILI, NetEnt, and others. These providers may receive pseudonymized player identifiers and session data necessary to deliver game services. They do not receive your full name, mobile number, or financial account details.
• Cloud infrastructure and hosting providers — data center and cloud service providers located in the Philippines and in countries with adequate data protection frameworks who host Platform infrastructure under strict data processing agreements.
• Customer support platforms — live chat and ticketing system providers that process support communications.

7.2 Regulatory and Law Enforcement Disclosure

tayawin8 will disclose personal data to government authorities, regulatory bodies, and law enforcement agencies where required or permitted by law, including to PAGCOR for licensing compliance audits, to the AMLC for AML obligations, to the NPC for data breach investigations, and to competent courts in response to valid legal process. Such disclosures are made only to the extent required and in compliance with the DPA.

7.3 No Sale of Personal Data

tayawin8 does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. Personal data shared with third-party processors is used exclusively for the service delivery purposes described in this Policy.

08 Data Retention

tayawin8 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law, whichever is longer. The following retention periods apply:

• Account and registration data: Retained for the duration of the account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AML retention obligations under RA 9160.
• KYC and identity verification documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, as required by AML regulations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of transaction, consistent with AMLC and PAGCOR requirements.
• Gaming activity data: Retained for a minimum of three (3) years to support dispute resolution, responsible gaming program administration, and PAGCOR compliance reporting.
• Technical and log data: Retained for a maximum of twelve (12) months for security and fraud investigation purposes, after which it is anonymized or deleted.
• Support communications: Retained for two (2) years from the date of the last interaction in the relevant support thread.

Following the expiry of applicable retention periods, personal data is securely destroyed or permanently anonymized in accordance with NPC-compliant data disposal procedures.

09 Data Security

tayawin8 implements a comprehensive set of technical and organizational security measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• TLS 1.2/1.3 encryption for all data in transit between the Platform and user devices.
• AES-256 encryption for sensitive personal data and financial records stored in our databases.
• Role-based access controls ensuring that only personnel with a legitimate operational need can access personal data.
• Multi-factor authentication required for all tayawin8 staff access to production systems.
• Regular third-party penetration testing and vulnerability assessments of Platform infrastructure.
• Continuous automated monitoring for security anomalies and unauthorized access attempts.
• Payment card data isolation — tayawin8 does not store raw payment credentials; these are handled entirely within the PCI-DSS compliant environments of our licensed payment processors.

In the event of a personal data breach that poses a real risk of serious harm to affected data subjects, tayawin8 will notify the NPC within seventy-two (72) hours of discovery, and will notify affected individuals within a reasonable timeframe thereafter, in compliance with the DPA's breach notification requirements.

10 Cookies & Tracking Technologies

tayawin8 uses cookies, session tokens, and similar technologies to operate the Platform, maintain session continuity, prevent fraud, and analyze aggregate usage patterns. The following cookie categories are used:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication tokens, anti-CSRF tokens, and load balancer cookies. These cannot be disabled without breaking core Platform functionality.
• Performance Cookies: Anonymous analytics cookies that measure page load times, error rates, and feature usage to help us improve Platform performance. Data collected is aggregated and does not identify individual users.
• Functional Cookies: Cookies that remember your language preferences, display settings, and last-visited game category to improve your experience on return visits.
• Security Cookies: Device fingerprinting and risk-scoring cookies used to detect suspicious login patterns, multiple account attempts, and automated bot activity. These are a mandatory component of tayawin8's fraud prevention system.

tayawin8 does not use third-party advertising or retargeting cookies. Your gaming activity is not shared with advertising networks or used to serve behavioral advertising on other websites.

You may manage or delete cookies through your browser settings. Disabling strictly necessary cookies will prevent you from accessing authenticated areas of the Platform. Disabling other cookie categories may degrade certain features but will not prevent basic account access.

11 Your Data Subject Rights

As a data subject under the Philippine Data Privacy Act of 2012, you are entitled to exercise the following rights in respect of your personal data held by tayawin8. Requests to exercise these rights should be submitted to tayawin8's Data Protection Officer using the contact details in Section 15.

12 Children's Privacy — 21+ Only

The tayawin8 Platform is strictly intended for individuals aged twenty-one (21) years or older, consistent with PAGCOR regulations governing casino-style gambling in the Philippines. tayawin8 does not knowingly collect personal data from individuals under 21 years of age.

Any account found, through KYC verification or other means, to belong to an individual under 21 years of age will be immediately closed. Any personal data collected from an underage individual will be deleted as expeditiously as technically practicable, subject to any retention obligations that may arise from the AML review of associated transactions.

If you are a parent or guardian and believe that your child under 21 has registered on the Platform, please contact our Data Protection Officer immediately at the contact details provided in Section 15 so that the account can be identified and closed without delay.

13 Cross-Border Data Transfers

Certain third-party service providers engaged by tayawin8 — including game software providers and cloud infrastructure partners — may process personal data in jurisdictions outside the Philippines. All such cross-border transfers are governed by data processing agreements that require the receiving party to maintain data protection standards consistent with the Philippine Data Privacy Act.

tayawin8 conducts transfer impact assessments for cross-border data flows and ensures that appropriate safeguards are in place before transferring personal data internationally. Where required by the NPC, transfer mechanisms consistent with DPA Section 21 and applicable NPC circulars are implemented.

14 Changes to This Privacy Policy

tayawin8 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where changes are material, we will notify registered Players via SMS to their registered Philippine mobile number and/or via in-platform notification at least seven (7) days before the changes take effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the Platform after the effective date of any update constitutes your acknowledgment of the revised Policy. We encourage you to review this Policy periodically.

15 Contact & Data Protection Officer

For all data privacy inquiries, data subject rights requests, privacy complaints, or questions about this Policy, please contact tayawin8's Data Protection Officer:

• Data Protection Officer, tayawin8
• Email: support@tayawin8.co — Subject line: "Data Privacy Request"
• Live Chat: Available 24/7 on the Platform — select "Privacy / Data Rights" in the support topic menu
• Response Time: The DPO will acknowledge receipt of your request within five (5) business days and provide a substantive response within the timeframes specified in Section 11.

If you are not satisfied with tayawin8's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines through its official channels at privacy.gov.ph (typed as plain text — not a clickable link, as this is an external site).