868k8 Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings described below:

• "Data Subject" means any natural person whose personal information is collected, held, or processed by 868k8.
• "Personal Information" means any information from which the identity of an individual can be reasonably and directly ascertained, or when combined with other information, would directly and certainly identify an individual, as defined under RA 10173.
• "Sensitive Personal Information" means personal information about an individual's race, ethnic origin, marital status, age, color, religious, philosophical or political affiliations, health, education, genetic or sexual life, or proceedings for any offense committed or alleged to have been committed, as defined under RA 10173.
• "Processing" refers to any operation or set of operations performed on personal data, including collection, recording, storage, updating, retrieval, use, disclosure, erasure, or destruction.
• "Data Privacy Officer" or "DPO" means the individual designated by 868k8 to oversee data privacy compliance, whose contact details are set out in Section 16 of this Policy.
• "National Privacy Commission" or "NPC" means the independent body established under RA 10173 to administer and implement the provisions of the Data Privacy Act in the Philippines.
• "PAGCOR" means the Philippine Amusement and Gaming Corporation, the licensing and regulatory authority for 868k8.
• "Platform" means the 868k8 website at 868k8.org and all associated services, games, and interfaces.

2. Data Controller Identity

868k8 acts as the Personal Information Controller in respect of the personal information collected through the Platform. As the Personal Information Controller, 868k8 determines the purposes and means of processing personal information of its Players and Platform users.

868k8 is registered with the National Privacy Commission as required under RA 10173 and its Implementing Rules and Regulations. All personal data processing activities of 868k8 are recorded in our Data Processing Inventory maintained by the Data Privacy Officer.

Where 868k8 engages third-party service providers to process personal information on its behalf (for example, payment processors, KYC verification services, or cloud infrastructure providers), such parties are engaged as Personal Information Processors and are contractually bound to process personal information only in accordance with 868k8's documented instructions and the requirements of RA 10173.

3. Information We Collect

868k8 collects personal information in three principal ways: information you provide directly, information generated automatically through your use of the Platform, and information obtained from regulated third-party sources.

3.1 Information You Provide Directly

3.2 Information Generated Automatically

• Device information (device type, operating system, browser type and version, screen resolution);
• IP address and approximate geolocation data derived from IP address;
• Session data including login timestamps, session duration, and pages visited;
• Game activity logs including bet amounts, outcomes, game history, and session records, which are maintained for PAGCOR compliance;
• Transaction logs for all deposits and withdrawals;
• Cookie and tracking technology data as described in Section 7.

3.3 Information from Third Parties

• Identity verification results from our KYC service provider;
• Payment transaction confirmations from GCash, Maya, BDO, BPI, Metrobank, and other integrated payment processors;
• Fraud signals and risk scores from anti-fraud technology partners;
• Self-exclusion registry status from PAGCOR, where applicable.

4. Lawful Basis for Processing

Under RA 10173, 868k8 relies on the following lawful bases for processing your personal information:

• Contract Performance: Processing is necessary to perform the contract between you and 868k8 — including account management, game delivery, payment processing, and customer support;
• Legal Obligation: Processing is required to comply with legal obligations under Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act (RA 9160), National Internal Revenue Code reporting requirements, and data breach notification obligations under RA 10173;
• Legitimate Interests: Processing is necessary for 868k8's legitimate interests, including platform security, fraud prevention, responsible gaming monitoring, and improvement of our products and services, where such interests are not overridden by your fundamental rights;
• Consent: Where processing is not covered by the above bases — in particular, direct marketing communications — 868k8 relies on your freely given, specific, and informed consent, which you may withdraw at any time.

5. How We Use Your Information

868k8 uses the personal information it collects for the following purposes:

• Account Management: Creating and maintaining your 868k8 account, verifying your identity, processing transactions, and managing your account settings and preferences;
• Game & Service Delivery: Providing access to all 868k8 games including live sabong, sports betting, live casino, slots, bingo, and arcade titles; processing bets; and determining and paying out winnings;
• Regulatory Compliance: Fulfilling 868k8's obligations under PAGCOR's licensing conditions, verifying player eligibility, conducting AML transaction monitoring, maintaining game and financial records, and responding to lawful requests from PAGCOR, AMLC, BIR, and other Philippine authorities;
• Security & Fraud Prevention: Detecting, investigating, and preventing fraudulent activity, multiple account creation, bonus abuse, money laundering, and other prohibited conduct; monitoring for unauthorized access to your account;
• Customer Support: Responding to your inquiries, resolving disputes, and processing responsible gaming requests including self-exclusion;
• Responsible Gaming: Monitoring your gaming activity for indicators of problem gambling and enforcing deposit limits, session limits, and self-exclusion as requested or as required under PAGCOR's responsible gaming guidelines;
• Marketing: Sending promotional offers, bonus notifications, and platform updates where you have provided marketing consent. Marketing consent can be managed at any time in your account settings;
• Analytics & Improvement: Analyzing usage data to improve the Platform's performance, game selection, user experience, and responsible gaming tools.

6. Sharing Your Information

868k8 does not sell your personal information to third parties. Information is shared in the following limited circumstances:

• Payment Processors: Your financial information is shared with integrated payment service providers — including GCash, Maya, BDO, BPI, Metrobank, 7-Eleven's Cliqq payment system, and cryptocurrency processors — to facilitate deposits and withdrawals. These providers are bound by their own privacy policies and by applicable Philippine financial regulations;
• KYC & Identity Verification Partners: Your identity documents and verification data are processed by our regulated KYC service providers as part of the account verification process required under PAGCOR regulations and AML law;
• Game Technology Providers: Where you access third-party games hosted on the 868k8 platform, certain data (including account identifiers and game session data) may be shared with the game provider to enable gameplay. Game providers are contractually prohibited from using this data for any purpose other than service delivery;
• Regulatory Authorities: 868k8 is legally required to share information with PAGCOR, the Anti-Money Laundering Council (AMLC), the Bureau of Internal Revenue (BIR), the National Privacy Commission (NPC), and other competent Philippine authorities upon lawful request or where required by PAGCOR's licensing conditions;
• Anti-Fraud Services: Anonymized or aggregated risk data may be shared with industry fraud prevention networks to protect the platform and its players;
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all assets of 868k8, your personal information may be transferred to the successor entity, which will be bound by this Privacy Policy or a materially equivalent successor policy.

7. Cookies & Tracking Technologies

868k8 uses cookies and similar tracking technologies to operate, secure, and improve the Platform. The types of cookies used are described below:

• Strictly Necessary Cookies: Required for the Platform to function. These include session authentication cookies that keep you logged in, security cookies that protect against cross-site request forgery, and cookies that maintain your language and currency preferences. These cookies cannot be disabled without affecting Platform functionality;
• Functional Cookies: Used to remember your preferences such as the last game category you visited, your responsible gaming settings, and your notification preferences;
• Analytical Cookies: Used to understand how Players use the Platform, which pages are visited most frequently, where errors occur, and how platform performance can be improved. Data collected through analytical cookies is aggregated and does not identify individual users;
• Security & Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, multiple account creation, and unauthorized access attempts.

You may manage cookie preferences through your browser settings. Blocking strictly necessary cookies will impair your ability to use the Platform. Instructions for managing cookies in the major browsers used by Filipino players — Chrome, Safari, Firefox — are available in each browser's help documentation.

8. Data Retention

868k8 retains personal information for the period necessary to fulfil the purposes described in this Policy, subject to the minimum retention periods required by law:

• Account and Transaction Records: Retained for a minimum of five (5) years following account closure, as required under Philippine AML law (RA 9160) and PAGCOR licensing conditions;
• KYC Documents: Retained for a minimum of five (5) years following account closure or the last transaction, whichever is later;
• Game History Logs: Retained for a minimum of three (3) years as required under PAGCOR's record-keeping requirements;
• Customer Support Records: Retained for two (2) years following resolution of the relevant inquiry, unless the matter involves an ongoing dispute or regulatory investigation;
• Marketing Data: Retained until you withdraw marketing consent. Where consent is withdrawn, marketing data is removed within 30 days.

Upon expiry of the applicable retention period, personal information is securely deleted or anonymized in accordance with 868k8's data disposal procedures.

9. Data Security

868k8 implements technical and organizational security measures commensurate with the sensitivity of the personal information held and the risks associated with its processing:

• Encryption in Transit: All communications between your browser or device and the 868k8 Platform are encrypted using TLS with 256-bit encryption;
• Encryption at Rest: Sensitive personal information, including identity documents, financial data, and hashed passwords, is encrypted at rest using industry-standard encryption methods;
• Access Controls: Access to personal data within 868k8 is restricted to authorized personnel on a strict need-to-know basis. All access is authenticated and logged;
• Personnel Training: All 868k8 staff with access to personal data are trained in data privacy obligations under RA 10173 and in secure data handling procedures;
• Data Breach Response: 868k8 maintains a documented data breach response plan. In the event of a personal data breach that poses a real risk to affected individuals, 868k8 will notify the National Privacy Commission within 72 hours of discovery and affected data subjects within a reasonable period thereafter, as required under RA 10173.

10. International Data Transfers

In some cases, personal information collected by 868k8 may be processed by third-party service providers located outside the Philippines — for example, cloud infrastructure providers or game technology providers with servers in other jurisdictions.

Where personal information is transferred outside the Philippines, 868k8 ensures that appropriate safeguards are in place in accordance with Section 21 of RA 10173 and the NPC's guidelines on cross-border data transfers. These safeguards may include contractual clauses approved by the NPC, binding corporate rules, or transfer to jurisdictions with an adequate level of data protection as recognized by the NPC.

Details of specific international transfers and the safeguards applicable to each can be obtained by contacting the 868k8 Data Privacy Officer at the contact details listed in Section 16.

11. Minors & Age Restriction

The 868k8 Platform is strictly restricted to individuals aged 21 years and above, as required by PAGCOR. 868k8 does not knowingly collect personal information from individuals under 21 years of age.

Age is verified during the account registration process and confirmed through KYC documentation. Where 868k8 discovers that personal information has been collected from an individual under 21, the account will be immediately closed, all data collected will be securely deleted (subject to any legal retention obligations), and the matter will be reported to PAGCOR.

If you are a parent or guardian and believe your child has registered on the 868k8 Platform, please contact our Data Privacy Officer immediately at the contact details set out in Section 16.

12. Exercising Your Privacy Rights

You may exercise any of the data subject rights described in the Rights section above by submitting a written request to the 868k8 Data Privacy Officer using the contact details in Section 16. Requests should clearly state:

• Your full name and registered 868k8 username;
• The specific right you wish to exercise;
• Sufficient information to allow us to identify and locate your personal data;
• Where applicable, the specific personal information to which the request relates.

For security purposes, 868k8 may require identity verification before processing a data subject rights request. This is to prevent unauthorized access to or modification of personal data. We will acknowledge your request within five (5) business days and provide a substantive response within fifteen (15) business days of verifying your identity, or within any shorter period required by NPC guidelines.

Where a request cannot be fulfilled in full — for example, where deletion would conflict with a legal retention obligation — 868k8 will explain the specific reason in writing.

13. Marketing Communications

868k8 sends promotional communications including bonus offers, new game announcements, tournament invitations, and platform updates only to Players who have provided explicit marketing consent during registration or in their account settings.

You may withdraw marketing consent at any time by:

• Accessing your 868k8 account settings and updating your communication preferences;
• Clicking the "unsubscribe" link included in any marketing email from 868k8;
• Contacting the 868k8 support team via live chat or email.

Withdrawal of marketing consent will take effect within 30 days of receipt of your request. Please note that withdrawal of marketing consent does not affect transactional communications — 868k8 will continue to send you account-related notifications such as deposit confirmations, withdrawal status updates, and security alerts, as these are necessary for the operation of your account.

868k8 does not share personal information with third-party advertisers for the purpose of targeting you with advertising on other platforms.

14. National Privacy Commission Complaints

If you are dissatisfied with how 868k8 has handled a privacy concern or data subject rights request, you are encouraged to first contact the 868k8 Data Privacy Officer to seek internal resolution. We are committed to resolving privacy concerns promptly and fairly.

If you remain dissatisfied following 868k8's response to your complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. The NPC is responsible for administering and enforcing RA 10173 and its Implementing Rules and Regulations. Information on how to file a complaint with the NPC is available through the NPC's official government channels.

868k8 cooperates fully with NPC investigations and is committed to complying with any NPC decisions or orders.

15. Amendments to This Policy

868k8 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidelines, or PAGCOR requirements. Material changes will be communicated to registered Players via email to the address on file and/or through a notification displayed on the Platform.

Non-material clarifications may be made without individual notification. The current version of this Policy, including its effective date, is always available at 868k8.org/privacy-policy. The previous version of this Policy remains available upon request from the Data Privacy Officer for a period of twelve (12) months following replacement.

Your continued use of the Platform following the effective date of a material amendment constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must cease using the Platform and request account closure.

This Policy is Version 2.0 and is effective as of 1 January 2026.

16. Contact the Data Privacy Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information by 868k8, please contact the 868k8 Data Privacy Officer through the following channels:

• Email: [email protected] — Please include "Data Privacy Request" or "DPO Query" in the subject line so that your message is routed directly to the Data Privacy Officer.
• Live Chat: Available 24/7 through the 868k8 Platform. For data subject rights requests or formal privacy complaints, we recommend email for written record purposes, though live chat can assist with general privacy inquiries.

The 868k8 Data Privacy Officer will acknowledge receipt of data subject rights requests and formal complaints within five (5) business days, with a substantive response provided within fifteen (15) business days of identity verification.