vip1 Privacy Policy

vip1 is a PAGCOR-regulated online casino and sports betting platform operating at vip1.vu, designed and operated for Filipino players across the Philippines. The Company that operates vip1 is the Personal Information Controller (PIC) as defined under Republic Act 10173 (Data Privacy Act of 2012), and is responsible for the lawful, transparent, and secure processing of your personal data in connection with your use of the Platform.

vip1 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and all applicable Philippine data protection laws. Contact details for the DPO are provided in Section 14.

This Privacy Policy applies to all personal data collected by vip1 in connection with:

• Registration and use of a vip1 player account;
• Deposits, withdrawals, and financial transactions on the Platform;
• Participation in games, sports betting, bingo, and other wagering activities;
• Interactions with vip1 customer support;
• Visits to vip1.vu, including browsing activity and cookie data;
• Communications from vip1 including promotional and transactional emails or SMS.

This Policy does not apply to third-party websites, payment processors, or game providers whose own privacy policies govern their data practices. vip1 is not responsible for the privacy practices of third-party services accessed through the Platform.

vip1 collects personal data through registration, account use, KYC verification, financial transactions, customer support interactions, and automatic technical collection during Platform use. The categories of data collected include:

vip1 processes your personal data on one or more of the following lawful bases as recognized under the Data Privacy Act of 2012:

vip1 uses personal data collected from players for the following purposes:

• Account Management: To create, maintain, and manage your vip1 account, including authenticating your identity on login, managing your Wallet balance, and processing responsible gaming settings.
• KYC and Regulatory Compliance: To verify your identity and age (21+ as required by PAGCOR), screen against sanctions lists, comply with the Anti-Money Laundering Act (RA 9160), and fulfill PAGCOR reporting obligations.
• Payment Processing: To process deposits and withdrawals via GCash, Maya, Philippine banks, and other supported payment methods, and to maintain an accurate transaction history for your account.
• Game Services: To provide you with access to casino games, sports betting markets, bingo rooms, and other wagering features, and to record bet placement, settlement, and gaming history.
• Responsible Gaming: To monitor gaming activity for signs of problem gambling, enforce player-set limits, process self-exclusion requests, and comply with PAGCOR responsible gaming requirements.
• Security and Fraud Prevention: To detect, investigate, and prevent unauthorized account access, fraudulent transactions, money laundering, bonus abuse, and other prohibited conduct.
• Customer Support: To respond to your enquiries, process complaints, and maintain records of support interactions for quality and dispute resolution purposes.
• Marketing (with consent): To send promotional communications about vip1 offers, new games, and promotions where you have opted in. You may withdraw consent at any time via account settings.
• Platform Improvement: To analyse Platform usage patterns, diagnose technical issues, and improve the performance, security, and user experience of the vip1 platform.
• Legal Proceedings: To exercise or defend legal rights, comply with court orders, and cooperate with PAGCOR, NPC, law enforcement, or other Philippine government authorities.

vip1 does not use your personal data for automated decision-making that produces legal effects or similarly significant consequences, except for identity and age verification screening performed as a legal obligation under PAGCOR regulations. Such screening is subject to human review on request.

vip1 does not sell, rent, or commercially trade your personal data to any third party. Personal data is shared only in the following circumstances and with appropriate data processing agreements in place:

• Payment Processors: GCash, Maya, Philippine banks, and other payment service providers receive financial and identity data necessary to process your transactions. These entities are independently regulated by the Bangko Sentral ng Pilipinas (BSP).
• KYC Verification Services: Third-party identity verification providers accredited under Philippine regulations receive submitted ID documents and biometric data solely for the purpose of completing your KYC verification.
• Game Providers: vip1's game software providers (such as JILI, PG Soft, Pragmatic Play, and live casino operators) receive limited technical and gaming session data necessary to deliver game content. Game providers do not receive your full identity or financial data.
• Technology Service Providers: Cloud infrastructure providers, cybersecurity services, and platform analytics tools receive technical data necessary for Platform operation, subject to data processing agreements.
• PAGCOR: vip1 reports player activity, KYC records, and suspicious transaction data to PAGCOR as required by its operating license and Philippine gaming regulations.
• Law Enforcement and Regulatory Authorities: vip1 discloses personal data to the NPC, AMLC, court order, or Philippine law enforcement where legally obligated to do so. Where permitted by law, vip1 will notify affected players of such disclosures.
• Business Transfers: In the event of a merger, acquisition, or sale of vip1's business, player data may be transferred to the successor entity, subject to equivalent data protection commitments and prior notice to affected players.

vip1 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

• Account and identity data: Retained for a minimum of five (5) years after account closure, as required by PAGCOR licensing conditions and the Anti-Money Laundering Act.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with BSP and AMLC requirements.
• KYC documents: Retained for the duration of the account plus five (5) years, or longer where required by law or ongoing investigations.
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution and regulatory audit purposes.
• Customer support records: Retained for two (2) years from the date of the last interaction, unless related to an ongoing dispute or regulatory matter.
• Marketing preferences and consent records: Retained for the duration of the account, plus one (1) year following account closure or withdrawal of consent.
• Technical and log data: Retained for a maximum of twelve (12) months unless required for active security investigations.

Upon expiration of applicable retention periods, personal data is securely deleted or anonymized in accordance with vip1's data destruction procedures. Anonymized data (which cannot be used to identify you) may be retained indefinitely for aggregated analytics and platform improvement purposes.

vip1 implements technical and organizational measures proportionate to the sensitivity of the personal data it processes. Security controls include:

• Transport Encryption: All data transmission between your device and vip1's servers is encrypted using TLS 1.3 — the same standard used by Philippine banks and government e-services.
• Data at Rest Encryption: Sensitive data, including KYC documents and financial records, is encrypted at rest using AES-256 or equivalent cryptographic standards.
• Access Controls: Personal data is accessible only to vip1 staff and authorized service providers who require it for their specific function, subject to role-based access controls and audit logging.
• Two-Factor Authentication: vip1 supports and encourages SMS OTP-based 2FA for all player accounts. Internally, staff access to systems containing personal data requires multi-factor authentication.
• Penetration Testing: vip1's Platform and data systems undergo regular security assessments and penetration testing by qualified cybersecurity professionals.
• Incident Response: vip1 maintains a data breach response plan. In the event of a personal data breach that poses a risk to player rights, vip1 will notify the NPC within 72 hours and affected players as required under RA 10173.

While vip1 takes all reasonable steps to protect your data, no online system is 100% impenetrable. Players are advised to use strong, unique passwords, enable 2FA, and report any suspected unauthorized account activity to [email protected] immediately.

vip1 uses cookies and similar technologies on vip1.vu to ensure the Platform functions correctly, maintain session security, and understand how players use the Platform. The following cookie categories are used:

vip1 does not use cookies for cross-site behavioral advertising or sell cookie data to third-party advertising networks. You may manage non-essential cookie preferences through the Cookie Settings panel accessible on the Platform. Disabling essential cookies will affect Platform functionality.

vip1 strictly prohibits the use of its Platform by any person under 21 years of age, as required by PAGCOR regulations and Philippine law. vip1 does not knowingly collect personal data from minors. KYC identity verification — which includes submission of a valid Philippine government-issued ID — is mandatory before real-money access is granted, specifically to enforce this age restriction.

If vip1 discovers or is notified that personal data has been collected from a person under 21 without verifiable parental consent, the affected account will be immediately closed and all data collected will be deleted or anonymized, except where retention is required to comply with legal obligations relating to the detection of underage gambling.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by vip1:

• Right to be Informed: The right to know what personal data vip1 collects, why it is collected, and how it is used — as described in this Policy.
• Right of Access: The right to request a copy of the personal data vip1 holds about you. Requests will be processed within 20 working days. A copy will be provided in a readable format via your registered email address.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You can update most account information directly through your vip1 account settings. Changes to KYC-verified data require resubmission of identity documents.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where consent has been withdrawn, or where processing is unlawful — subject to vip1's retention obligations under PAGCOR regulations and Philippine AML law, which may require data to be retained for a minimum of five years.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another service provider where technically feasible.
• Right to Object: The right to object to processing of your personal data for direct marketing purposes at any time. You can unsubscribe from marketing communications via account settings or by emailing [email protected].
• Right to Lodge a Complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe vip1 has violated your data privacy rights. The NPC's complaint mechanism is available through their official channels.

To exercise any of the above rights, submit a written request to vip1's Data Protection Officer at the contact details in Section 14. Requests will be acknowledged within 5 working days and processed within 20 working days, subject to identity verification. In some circumstances, legal or regulatory obligations may limit vip1's ability to fully comply with a request, in which case vip1 will explain the reason.

vip1's primary data infrastructure is located within or connected to the Philippines. Certain technical service providers — including cloud infrastructure, cybersecurity, and game content delivery networks — may process some categories of data outside the Philippines. Where such international transfers occur, vip1 ensures they are conducted:

• Under data processing agreements that require the recipient to apply data protection standards at least equivalent to those required under Philippine law;
• To countries or jurisdictions that have been assessed to provide an adequate level of data protection, or with appropriate contractual safeguards in place;
• In compliance with the cross-border data flow requirements established by the NPC under RA 10173 and its implementing rules.

vip1 does not transfer your KYC documents, financial transaction records, or Philippine government ID data outside of the Philippines except where strictly required by PAGCOR reporting obligations or applicable law, and only to parties bound by equivalent data protection commitments.

vip1 may update this Privacy Policy from time to time to reflect changes in our data practices, Philippine regulatory requirements, or the features of the Platform. When changes are material — meaning they affect how we process your personal data in ways that may impact your rights — vip1 will notify registered players via email or in-platform notification at least 14 days before the updated Policy takes effect.

Minor updates — such as clarifications, corrections of typographical errors, or administrative changes that do not affect your rights — may be made without advance notice. The effective date displayed at the top of this document will be updated to reflect the date of the most recent revision.

The current version of this Privacy Policy is always accessible at vip1.vu/privacy-policy. Your continued use of the vip1 Platform following the effective date of any revised Policy constitutes your acknowledgment of the updated terms.

For all data privacy enquiries, data subject rights requests, or complaints relating to the processing of your personal data by vip1, please contact the vip1 Data Protection Officer (DPO):

If your concern is not satisfactorily resolved by vip1's DPO, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines, which is the competent regulatory authority for data protection matters under RA 10173.