zzcc Casino Privacy Policy

1. Introduction

zzcc ("we," "us," "our," "the Platform") operates as an online casino and sports betting platform serving Filipino players under applicable PAGCOR regulations. As a regulated gaming operator, zzcc processes personal data as a necessary part of delivering gaming services, meeting regulatory and legal obligations, and maintaining the security and integrity of the Platform.

This Privacy Policy has been prepared in accordance with the Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA) of the Philippines, its Implementing Rules and Regulations (IRR), and applicable regulations issued by the National Privacy Commission (NPC). Where applicable, international data protection standards inform our practices.

zzcc is the personal information controller ("PIC") in respect of your personal data for the purposes of the Data Privacy Act. Our designated Data Protection Officer ("DPO") can be contacted as described in Section 13 of this Policy.

2. Personal Data We Collect

2.1 Data You Provide Directly

When you register and use your zzcc account, we collect:

• Identity Data: Full legal name, date of birth, gender, nationality
• Contact Data: Philippine mobile number, email address, residential address
• Identity Verification Documents: Government-issued photo ID (passport, UMID, SSS, PhilHealth, or Driver's License), selfie for liveness verification
• Financial Data: GCash account details, PayMaya account details, bank account information (BPI, BDO, Metrobank) as provided for deposit and withdrawal purposes
• Account Credentials: Username and encrypted password (passwords are stored in hashed form only and are never visible to zzcc staff)
• Communications: Records of your interactions with zzcc customer support, including live chat transcripts, emails, and support tickets

2.2 Data We Collect Automatically

When you access the zzcc Platform, we automatically collect:

• IP address, device type, operating system, and browser version
• Session data including login timestamps, pages visited, and session duration
• Game activity records: games played, wagers placed, outcomes, and transaction history
• Geolocation data (city-level, derived from IP address) to support responsible gaming and fraud prevention
• Cookie identifiers and similar tracking technologies (see Section 6)

2.3 Data From Third Parties

zzcc may receive data about you from third-party payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification service providers, fraud prevention services, and PAGCOR or other regulatory bodies as required by law.

3. How We Use Your Personal Data

zzcc does not use your personal data for automated decision-making that produces significant legal effects on you without human review, except where required by law or our PAGCOR-mandated AML obligations.

4. Legal Basis for Processing

Under the Data Privacy Act of 2012, zzcc processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to create and manage your zzcc account, process transactions, and deliver the gaming services you have signed up for.
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, AML obligations under Republic Act No. 9160, KYC requirements, NPC regulations, and other applicable Philippine laws.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics — where these interests do not override your fundamental rights.
• Consent: Processing for optional marketing communications and personalised promotions, where you have provided explicit consent. You may withdraw consent at any time through your account settings or by contacting support.

For sensitive personal information (such as identity documents), zzcc processes such data only to the extent required by law (specifically, KYC obligations under PAGCOR and AML regulations) or with your explicit consent.

5. Data Sharing & Disclosure

5.1 Third-Party Service Providers

zzcc shares personal data with trusted third-party processors who assist in delivering the Platform's services, including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification providers, cloud hosting infrastructure providers, game software providers, and customer support platform vendors. All third-party processors are contractually bound to process your data solely on zzcc's instructions, maintain appropriate security standards, and not retain or use your data beyond the purposes for which it was shared.

5.2 Regulatory and Law Enforcement Disclosure

zzcc is required by law to disclose certain personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), Philippine law enforcement agencies, and other competent authorities when required by lawful directive, court order, or applicable regulation. zzcc will not notify you of such disclosures where prohibited by law from doing so.

5.3 No Sale of Personal Data

zzcc does not sell, rent, trade, or otherwise transfer your personal data to any third party for their own independent marketing or commercial purposes. Personal data shared with third parties is limited to what is necessary for service delivery or legal compliance only.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of zzcc's business, your personal data may be transferred to the successor entity. In such circumstances, zzcc will provide notice to affected players and ensure that the successor entity is bound by privacy obligations at least equivalent to those in this Policy.

6. Cookies & Tracking Technologies

zzcc uses cookies and similar tracking technologies to operate and improve the Platform. The types of cookies used include:

• Strictly Necessary Cookies: Essential for the Platform to function, including session management, authentication, and security. These cannot be disabled.
• Performance Cookies: Collect anonymised data about how players use the Platform to help us identify and fix issues and improve performance. No personally identifiable information is collected.
• Functional Cookies: Remember your preferences (such as language settings and last-visited sections) to provide a more personalised experience on zzcc.
• Analytics Cookies: Used for aggregated internal analytics to understand player behaviour patterns at a platform level. Data is anonymised and not used for profiling individual players.

zzcc does not use third-party advertising or retargeting cookies. You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will affect your ability to log in and use the Platform.

7. Data Retention

zzcc retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Specific retention periods include:

• Account and KYC Records: Retained for the duration of the active account relationship plus a minimum of five (5) years after account closure, as required by PAGCOR licensing conditions and AML regulations.
• Transaction Records: Retained for a minimum of five (5) years following the transaction date in accordance with AML reporting obligations.
• Communication Records: Customer support communications are retained for three (3) years for dispute resolution purposes.
• Marketing Data: Retained until you withdraw consent, after which it is deleted within 30 days of withdrawal.

Upon expiry of the applicable retention period, personal data is securely destroyed or irreversibly anonymised in accordance with NPC guidelines.

8. Data Security

zzcc implements technical and organisational security measures appropriate to the sensitivity of the data processed and the risks involved. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the zzcc Platform
• Encryption at rest for sensitive data stored in zzcc's systems, including identity documents and financial data
• Password hashing using industry-standard algorithms — zzcc staff cannot view your password in plain text
• Role-based access controls limiting internal access to personal data on a strict need-to-know basis
• Regular security audits, vulnerability assessments, and penetration testing
• Two-factor authentication (2FA) available to all players and mandatory for zzcc staff accounts
• Incident response procedures for detecting, containing, and reporting personal data breaches

9. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by zzcc:

• Right to be Informed: The right to know whether zzcc holds personal data about you and to receive clear information about how it is used — which this Policy provides.
• Right of Access: The right to request a copy of the personal data zzcc holds about you, along with information about how it is processed.
• Right to Rectification: The right to have inaccurate or incomplete personal data corrected. You may update most information directly through your zzcc account settings.
• Right to Erasure: The right to request deletion of your personal data where it is no longer necessary, where consent has been withdrawn, or where processing was unlawful — subject to zzcc's legal retention obligations.
• Right to Object: The right to object to processing based on legitimate interests, including direct marketing. You may opt out of marketing communications at any time via your account settings.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format for transfer to another controller, where technically feasible.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, contact zzcc's Data Protection Officer as described in Section 13. zzcc will respond to all valid data subject requests within thirty (30) days. Complex requests may require additional time, of which you will be notified.

10. Children's Privacy and the 21+ Requirement

The zzcc Platform is strictly restricted to individuals aged 21 years or older in accordance with Philippine gaming law and PAGCOR regulations. zzcc does not knowingly collect or process personal data from individuals under the age of 21. Age is verified at account registration through documentary KYC procedures.

If zzcc becomes aware that personal data has been collected from an individual under the legal gaming age, the account will be immediately suspended, all associated data will be securely deleted, and any deposits will be returned through the original payment method. If you have reason to believe that a minor has accessed or registered on zzcc, please contact our DPO immediately at the contact details in Section 13.

11. International Data Transfers

Where zzcc uses third-party service providers (such as cloud infrastructure providers or identity verification services) whose servers may be located outside the Philippines, personal data may be transferred internationally. In all such cases, zzcc ensures that:

• Transfers are made only to countries or organisations that provide adequate levels of data protection, or
• Appropriate contractual safeguards are in place (such as standard contractual clauses or data processing agreements) that bind the recipient to obligations equivalent to those under the Data Privacy Act of 2012, and
• The transfer is permitted under the DPA's cross-border transfer provisions and is not prohibited by applicable NPC regulations.

zzcc's primary data processing infrastructure is located within the Philippines and Southeast Asia, and international transfers are minimised where technically and commercially feasible.

12. Changes to This Privacy Policy

zzcc reserves the right to amend this Privacy Policy at any time to reflect changes in our practices, the services we offer, applicable law, or regulatory requirements. When material changes are made, zzcc will provide advance notice to registered players via email or in-account notification, at least fourteen (14) days before the updated Policy takes effect, unless a shorter notice period is required by law.

The "Last Updated" date at the top of the Table of Contents will always reflect the date of the most recent revision. Your continued use of the zzcc Platform after the effective date of an amended Policy constitutes acceptance of the revised terms. If you do not accept the changes, you must cease using the Platform and may request account closure in accordance with our Terms & Conditions.

13. Contact & Data Protection Officer

For all data privacy-related enquiries, requests to exercise your data subject rights, concerns about this Policy, or to report a suspected data breach, you may contact zzcc's Data Protection Officer through the following channels:

• Email: [email protected] — please include "Data Privacy Request" in the subject line
• Live Chat: Available 24/7 on the zzcc platform — request to be connected to the data privacy team
• Support Languages: English and Filipino

zzcc is committed to responding to all privacy-related requests within thirty (30) calendar days of receipt. For complaints not resolved to your satisfaction, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.