pisotaya Privacy Policy

1 Introduction

pisotaya operates pisotaya.vip as an online gaming platform offering slot games, live casino, sports betting, bingo, fishing games, and e-sabong primarily to players based in the Philippines. In the course of providing these services, pisotaya necessarily processes personal data about its registered players and, to a limited extent, visitors to its website.

This Policy is intended to be transparent about every aspect of that data processing. pisotaya believes that informed players are empowered players — and understanding how your information is handled is part of what it means to play with a platform you can trust. We have drafted this Policy in plain, accessible English that Filipino players can read without needing a legal background, while still meeting the standards required under Philippine data privacy law.

This Policy applies to all data processing activities carried out by pisotaya in connection with the pisotaya.vip platform. It does not apply to the data practices of third-party game providers, payment processors, or other service providers who operate their own privacy policies — though we describe our relationships with those parties in Section 8 below.

2 Data Controller

For the purposes of the Republic of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, pisotaya is the data controller responsible for your personal data collected and processed through the pisotaya.vip platform.

Our designated Data Protection Officer (DPO) is responsible for overseeing compliance with data privacy obligations and is the first point of contact for any data privacy enquiry or complaint from players. Contact details for our DPO are provided in Section 17 of this Policy.

3 Personal Data We Collect

Depending on how you use pisotaya, we may collect the following categories of personal data:

3.1 Identity and Contact Data

• Full legal name as it appears on your government-issued Philippine ID.
• Date of birth (used for 21+ age verification in accordance with PAGCOR's responsible gaming requirements).
• Philippine mobile number and/or email address used for registration and communications.
• Residential address (may be requested during enhanced KYC verification).
• Government-issued identification document type, number, and image (e.g. Philippine passport, driver's licence, UMID, SSS card, voter's ID).
• Selfie or live photograph submitted for biometric identity verification.

3.2 Financial and Transaction Data

• GCash account number or PayMaya account number associated with deposit and withdrawal transactions.
• Bank account details for BPI, BDO, or Metrobank transactions, where applicable.
• Deposit amounts, dates, and transaction reference numbers.
• Withdrawal requests, amounts, and processing status records.
• Full account transaction history, including all gaming-related credits and debits.

3.3 Gaming Activity Data

• Game session records including game titles played, session start and end times, wager amounts, and outcomes.
• Sports betting selections, stake amounts, and settlement results.
• Bonus claims, wagering progress, and bonus expiry records.
• Account balance history and wallet transaction logs.

3.4 Technical and Device Data

• IP address at the time of registration and at each subsequent login.
• Device type, operating system, browser type and version.
• Mobile network provider and device identifier (where permissible).
• Login timestamps and session duration records.
• Geolocation data derived from IP address (used for fraud prevention and compliance purposes).

3.5 Communications Data

• Records of live chat conversations with pisotaya support staff.
• Email and SMS correspondence history.
• Feedback, complaints, and dispute records.
• Marketing preference records and opt-in/opt-out status.

4 How We Collect Your Data

pisotaya collects personal data through the following channels and mechanisms:

• Direct submission: Data you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or responding to surveys.
• Automated collection: Data collected automatically when you access and use the pisotaya platform, including technical and device data described in Section 3.4, and data collected via cookies and similar technologies as described in Section 7.
• Third-party providers: Identity verification data returned by our KYC verification service provider following document and biometric checks. Transaction data returned by GCash, PayMaya, and banking payment processors. Fraud screening data returned by our fraud prevention service providers.
• Publicly available sources: In limited cases, publicly available information may be consulted to verify account information or conduct due diligence in compliance with anti-money laundering obligations.

5 Legal Basis for Processing

Under the Data Privacy Act of 2012, pisotaya processes your personal data on the following legal grounds:

6 How We Use Your Personal Data

pisotaya uses the personal data we collect for the following specific purposes:

• Account Services: Creating and maintaining your pisotaya account, verifying your identity, processing login authentication, and managing your account settings and preferences.
• Financial Transactions: Processing your deposit requests, crediting winnings to your account wallet, processing withdrawal requests, and maintaining accurate financial records.
• Gaming Services: Delivering game access, recording game results, applying bonus credits, tracking wagering progress, and maintaining your gaming history.
• Compliance and Anti-Money Laundering: Fulfilling our obligations under Philippine anti-money laundering law, including customer due diligence, transaction monitoring, and mandatory reporting requirements.
• Responsible Gaming: Monitoring gaming patterns for signs of problem gambling, applying player-requested limits and restrictions, enforcing self-exclusion requests, and verifying the 21+ age requirement.
• Security and Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, multi-account abuse, bonus abuse, unauthorised account access, and other prohibited conduct as defined in our Terms & Conditions.
• Customer Support: Responding to your enquiries, resolving disputes, processing complaints, and maintaining records of communications for quality assurance.
• Marketing (with consent): Sending promotional offers, bonus announcements, game recommendations, and event notifications via SMS or email, where you have opted in to receive such communications.
• Platform Improvement: Analysing aggregated, anonymised usage data to understand how players use pisotaya, identify performance issues, and develop new features and improvements.

7 Cookies and Tracking Technologies

pisotaya uses cookies and similar tracking technologies on the pisotaya.vip website to enable core platform functionality, maintain your session when logged in, and collect analytical data about how the Platform is used.

7.1 Types of Cookies Used

• Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your login state and security cookies that help prevent cross-site request forgery attacks. These cookies cannot be disabled without breaking core functionality.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and game lobby filters. These improve your experience but are not essential.
• Analytics Cookies: Collect aggregated information about how players navigate the Platform — pages visited, session duration, error pages encountered. This data is used to improve platform performance and is not linked to your personal identity.
• Security Cookies: Support fraud detection and prevention systems by identifying device fingerprints associated with known fraudulent activity patterns.

7.2 Managing Cookies

You may manage or delete cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent login and core platform functionality from working correctly. Disabling functional or analytics cookies will not prevent you from using pisotaya, but may limit your experience on the platform.

8 Data Sharing and Disclosure

pisotaya shares personal data with third parties only to the extent necessary for the following purposes:

• Payment Processors (GCash, PayMaya, BPI, BDO, Metrobank, Visa, Mastercard, crypto processors): Transaction data required to process deposits and withdrawals is shared with the relevant payment processor for each transaction. These processors operate under their own privacy policies and are bound by applicable Philippine financial data protection regulations.
• KYC Identity Verification Providers: Identity document images and biometric data submitted for KYC verification are processed by our accredited third-party verification service provider. This provider operates under strict data processing agreements and Philippine data privacy law.
• Game Providers (JILI, Pragmatic Play, Evolution Gaming, and others): A limited set of session and account data (typically a pseudonymised player ID and balance information) is shared with game providers to enable game access and record game outcomes. These providers do not receive your full personal identity data.
• Fraud Prevention and Security Services: Technical data including IP addresses, device identifiers, and transaction patterns may be shared with fraud prevention service providers to identify and prevent fraudulent activity.
• Regulatory and Law Enforcement Authorities: pisotaya will disclose personal data to the Philippine Anti-Money Laundering Council (AMLC), PAGCOR, the National Privacy Commission (NPC), law enforcement agencies, or courts of competent jurisdiction where required to do so by applicable Philippine law, court order, or regulatory directive.
• Professional Advisors: Legal counsel, auditors, and other professional advisors may access personal data on a confidential, need-to-know basis in connection with the provision of professional services to pisotaya.

9 International Data Transfers

Some of pisotaya's third-party service providers — including certain game providers and platform infrastructure providers — may process personal data in locations outside the Philippines. Where such international transfers occur, pisotaya takes reasonable steps to ensure that appropriate safeguards are in place to protect your personal data in accordance with the requirements of the Data Privacy Act of 2012 and the standards set by the National Privacy Commission.

These safeguards may include contractual data processing agreements with standard data protection clauses, transfer to countries with substantially similar data protection frameworks, or transfer subject to your explicit consent where required.

10 Data Retention

pisotaya retains personal data only for as long as is necessary for the purposes described in this Policy, and in compliance with applicable legal retention obligations. The following indicative retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised in accordance with pisotaya's data destruction procedures.

11 Data Security

pisotaya implements technical and organisational security measures appropriate to the sensitivity of the personal data we process. These measures include:

• Encryption in Transit: All data transmitted between your device and pisotaya.vip is encrypted using 256-bit SSL/TLS encryption. Unencrypted HTTP connections are automatically redirected to HTTPS.
• Encryption at Rest: Sensitive personal data and financial data stored in pisotaya's databases is encrypted at rest using industry-standard encryption algorithms.
• Password Security: Account passwords are stored as salted cryptographic hashes. pisotaya staff cannot access your password in plain text, and pisotaya will never ask you for your password.
• Access Controls: Access to personal data within pisotaya's systems is restricted on a need-to-know basis, with role-based access controls, multi-factor authentication for staff accounts, and comprehensive access audit logging.
• Vulnerability Management: pisotaya conducts regular security assessments, penetration testing, and vulnerability scanning of its platform infrastructure.
• Incident Response: pisotaya maintains a documented data breach response procedure. In the event of a personal data breach that creates a risk to your rights, we will notify the National Privacy Commission within 72 hours and will inform affected players without undue delay, in accordance with the Data Privacy Act of 2012.

While pisotaya takes extensive measures to protect your data, no digital platform can guarantee absolute security. You are also responsible for maintaining the security of your own Account credentials — see Section 5 of our Terms & Conditions for your obligations in this regard.

12 Your Data Privacy Rights

As a data subject under Philippine law, you have the following rights with respect to your personal data processed by pisotaya:

• Right to Be Informed: The right to know that your personal data is being collected, processed, and used — which this Policy fulfils.
• Right to Access: The right to obtain confirmation of whether pisotaya holds personal data about you, and to receive a copy of that data in a readily accessible format. Requests will be fulfilled within thirty (30) days.
• Right to Rectification: The right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: The right to request deletion of your personal data, subject to pisotaya's legal retention obligations (as described in Section 10) and ongoing fraud prevention or anti-money laundering obligations.
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to other forms of processing based on legitimate interests, subject to pisotaya's overriding legitimate grounds.
• Right to Data Portability: The right to receive personal data you have provided to pisotaya in a structured, machine-readable format, where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent (such as direct marketing), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe pisotaya has violated your data privacy rights under the Data Privacy Act of 2012.

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 17. pisotaya will not charge a fee for handling data rights requests, unless the request is manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

13 Children's Privacy

If you are the parent or guardian of a minor and believe your child may have accessed or registered on pisotaya, please contact our support team or Data Protection Officer immediately. We will investigate and take appropriate action without delay.

pisotaya's 21+ age verification controls are designed to prevent underage access at the point of registration. We continuously review and strengthen these controls in line with PAGCOR's responsible gaming framework and industry best practices.

14 Marketing Communications

pisotaya sends marketing communications — including bonus offers, game promotions, seasonal Philippine event promotions, and platform announcements — only to players who have explicitly opted in to receive such communications during registration or subsequently through Account Settings.

You may unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email from pisotaya.
• Updating your communication preferences in Account Settings under the Marketing Preferences section.
• Contacting pisotaya support and requesting removal from all marketing communications.

Please note that unsubscribing from marketing communications does not prevent pisotaya from sending transactional communications that are necessary for the operation of your account, such as withdrawal confirmation messages, OTP codes, security alerts, and responsible gaming notifications.

15 Third-Party Links and Services

The pisotaya Platform may contain references or links to third-party services — including game providers' own information pages and payment processor websites. pisotaya is not responsible for the privacy practices of these third-party services, and this Policy does not apply to them. We encourage you to review the privacy policies of any third-party service you access in connection with your use of pisotaya.

Similarly, game content delivered by third-party providers within the pisotaya game lobby is subject to those providers' own data practices for game session delivery purposes. pisotaya's data processing agreements with game providers require them to handle player session data in a manner consistent with applicable data protection obligations.

16 Changes to This Privacy Policy

pisotaya reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, changes in applicable law, or operational developments. When material changes are made — meaning changes that substantively affect how we collect, use, or share your personal data — pisotaya will provide advance notice by posting a prominent notice on the Platform and, where feasible, notifying registered players via the contact information on file.

The effective date at the top of this Policy indicates when the current version took effect. Your continued use of pisotaya following the effective date of any revised Policy constitutes your acknowledgement of the revised terms. If you do not accept the revised Policy, you should cease using pisotaya and may close your account by contacting support.

Prior versions of this Privacy Policy are available on request from our Data Protection Officer.

17 Contact and Complaints

For any enquiry, request, or complaint relating to this Privacy Policy or pisotaya's handling of your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 within the pisotaya Platform. Ask to speak with a representative regarding a data privacy matter.
• Data Protection Officer — Email: [email protected] — this is a plain text address and is not a clickable link.
• General Support — Email: [email protected] — this is a plain text address and is not a clickable link.

pisotaya will acknowledge data rights requests and privacy complaints within five (5) business days and endeavour to resolve them within thirty (30) calendar days. For complex matters, we will provide a status update within thirty days and a final resolution within sixty (60) calendar days.

If you are not satisfied with pisotaya's handling of your data privacy complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines (NPC). Information about filing a complaint with the NPC is publicly available on the NPC's official website.

This Privacy Policy was last reviewed and updated on January 1, 2026. pisotaya reserves the right to update this Policy in accordance with Section 16.