90vip Privacy Policy

1.1 This Policy applies to all personal data processed by 90vip in connection with your use of the Platform, including data collected during account registration, gameplay, deposits and withdrawals, customer support interactions, and promotional activities.

1.2 This Policy should be read alongside the 90vip Terms & Conditions and the Responsible Gaming Policy, both of which form part of the overall agreement governing your use of the Platform.

1.3 90vip acts as the Personal Information Controller (PIC) under the DPA with respect to all personal data processed through the Platform. Where 90vip engages third-party service providers to process data on its behalf, those parties act as Personal Information Processors (PIPs) and are bound by data processing agreements consistent with the requirements of the DPA.

2.1 90vip collects the following categories of personal data from users of the Platform:

2.2 90vip does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA (such as health data, religious beliefs, or political affiliations) unless explicitly required by applicable law or regulatory directive. Where such data is collected for compliance purposes, it is processed under the appropriate lawful basis and with heightened security controls.

2.3 You are not obligated to provide optional data. However, failure to provide required data will prevent 90vip from creating or maintaining your account or processing financial transactions on your behalf.

3.1 90vip collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, contacting customer support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically through cookies, server logs, and analytics tools as you interact with the Platform. See Section 9 for full details on cookies.
• Third-Party Sources: Identity verification data returned by our KYC verification partners; fraud and AML screening results from compliance service providers; payment confirmation data from GCash, PayMaya, and Philippine banking partners.
• Publicly Available Sources: Where permitted by law, 90vip may supplement your data with information from publicly available Philippine government databases for identity verification or fraud prevention purposes.

4.1 Under Section 12 of the Data Privacy Act of 2012, the processing of personal data is lawful where it is based on at least one of the following criteria. 90vip relies on the following lawful bases for processing your personal data:

4.2 Where 90vip processes your data on the basis of consent (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent for marketing, update your notification preferences in your account settings or contact [email protected].

5.1 90vip uses the personal data it collects for the following specific purposes:

• To create, verify, and maintain your 90vip account, including verifying that you meet the minimum age requirement of 21 years as mandated for casino-style online gaming in the Philippines;
• To process financial transactions including GCash and PayMaya deposits, bank transfers, and withdrawals to your registered payment method;
• To comply with Anti-Money Laundering Act (AMLA) obligations, including customer due diligence, ongoing transaction monitoring, and reporting obligations to the Anti-Money Laundering Council (AMLC);
• To deliver customer support services including live chat, email responses, and resolution of account or transaction disputes;
• To personalize your gaming experience, including surfacing game recommendations, applicable promotions, and language and currency preferences relevant to Filipino players;
• To monitor for responsible gaming indicators, including unusual session patterns, rapid loss sequences, or self-exclusion requests, and to activate responsible gaming interventions where appropriate;
• To detect, investigate, and prevent fraud, account takeovers, bonus abuse, and other prohibited conduct as defined in the 90vip Terms & Conditions;
• To send you transactional communications including deposit confirmations, withdrawal updates, password reset notifications, and security alerts — these communications are mandatory and cannot be opted out of while your account is active;
• To send promotional communications (SMS, email, or in-app) where you have provided explicit opt-in consent;
• To analyze and improve Platform performance, user experience, and service reliability through aggregated and anonymized analytics.

5.2 90vip will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate lawful basis under the DPA.

6.1 90vip does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Your data is shared externally only in the following limited circumstances:

• KYC and Identity Verification Partners: Third-party providers engaged to verify the authenticity of government-issued IDs and perform liveness checks as required by AML and responsible gaming obligations;
• Payment Processors: GCash (G-Xchange Inc.), PayMaya (Maya Bank Inc.), and Philippine banking partners (BPI, BDO, Metrobank) receive financial data strictly necessary to process your deposit or withdrawal transaction;
• Game Content Providers: Software providers including Pragmatic Play, PG Soft, Jili, and CQ9 receive anonymized session data necessary for game delivery and RNG certification. These providers do not receive your identity or financial data;
• Regulatory and Law Enforcement Authorities: The Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities where disclosure is required by law, court order, or regulatory directive;
• Fraud Prevention Services: Industry-standard fraud screening and device fingerprinting services that receive hashed technical data to detect account fraud and multi-accounting;
• Professional Advisors: Legal counsel, auditors, and accountants bound by professional confidentiality obligations, where necessary to protect 90vip's legal rights or comply with regulatory requirements.

6.2 All third-party service providers with whom 90vip shares personal data are bound by written data processing agreements that require them to process your data solely for the specified purpose, implement appropriate technical and organizational security measures, and comply with the Data Privacy Act of 2012 and its IRR.

7.1 90vip retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following retention periods apply:

7.2 Upon expiry of the applicable retention period, 90vip will securely delete or irreversibly anonymize your personal data such that it can no longer be attributed to you as an identifiable individual. Anonymized data may be retained indefinitely for statistical analysis and service improvement.

7.3 Where you have requested account closure, 90vip will cease active use of your personal data for service delivery purposes immediately. Retention of data after account closure is limited strictly to legal and regulatory compliance purposes as outlined in the table above.

8.1 90vip implements a multi-layered information security program designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. Our security measures include:

• Encryption in Transit: All data transmitted between your device and the 90vip Platform is protected using TLS 1.2 or higher encryption protocols;
• Encryption at Rest: Sensitive personal data, including identity documents and financial account details, is encrypted at rest using AES-256 encryption;
• Access Controls: Access to personal data is restricted to authorized 90vip personnel on a strict need-to-know basis, enforced through role-based access controls and multi-factor authentication;
• Network Security: The Platform infrastructure is protected by web application firewalls (WAF), intrusion detection systems, and DDoS mitigation services;
• Security Monitoring: 90vip maintains continuous security monitoring of its systems, with automated alerts for anomalous access patterns or potential data breach indicators;
• Penetration Testing: Third-party security assessments and penetration tests are conducted periodically to identify and remediate vulnerabilities;
• Staff Training: All 90vip personnel with access to personal data undergo mandatory data privacy training covering DPA obligations, phishing awareness, and incident response procedures.

8.2 In the event of a personal data breach that is likely to result in a real risk of serious harm to affected data subjects, 90vip will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected data subjects without undue delay, in accordance with NPC Circular No. 16-03 on Personal Data Breach Management.

9.1 The 90vip Platform uses cookies and similar tracking technologies to deliver, secure, and improve the service. A "cookie" is a small text file placed on your device by the Platform when you access it. Cookies do not contain executable code and cannot access other data on your device.

9.2 90vip uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication cookies that keep you logged in and security cookies that protect against cross-site request forgery (CSRF). These cannot be disabled without breaking core Platform functionality.
• Functional Cookies: Remember your preferences such as language setting, preferred deposit method, and display settings to provide a more personalized experience on subsequent visits.
• Analytics Cookies: Collect aggregated, anonymized information about how users interact with the Platform — pages visited, session duration, error occurrences — to help 90vip identify areas for improvement.
• Security and Fraud Prevention Cookies: Used to detect multi-accounting, bonus abuse, and automated bot activity. These cookies collect device fingerprinting data that is processed solely for fraud and AML compliance purposes.

9.3 90vip does not use third-party advertising cookies or allow external advertisers to place cookies on the Platform. No cookie data is shared with social media platforms or advertising networks.

9.4 You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the 90vip Platform. For guidance on managing cookies in your specific browser, consult your browser's help documentation.

10.1 As a data subject under the Data Privacy Act of 2012, you are entitled to exercise the following rights with respect to your personal data held by 90vip:

• Right to be Informed (Section 16[a], DPA): You have the right to be informed of the fact that your personal data is being collected and processed, the purpose of processing, and the identity of the Personal Information Controller — all of which are covered by this Policy.
• Right to Access (Section 16[b], DPA): You have the right to access your personal data held by 90vip, including a copy of the data and information about how it is being processed, upon written request.
• Right to Rectification (Section 16[c], DPA): You have the right to correct inaccurate or incomplete personal data. You may update basic account information (mobile number, email address) directly from your account settings. For corrections to identity or KYC data, contact [email protected].
• Right to Erasure or Blocking (Section 16[d], DPA): You may request the deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, subject to 90vip's legal retention obligations under the AMLA and other applicable laws.
• Right to Object (Section 18, DPA): You have the right to object to the processing of your personal data where such processing is based on 90vip's legitimate interest, including for direct marketing or profiling purposes. Objection to processing necessary for contractual performance or legal compliance is not available.
• Right to Data Portability (Section 18[b], DPA): You have the right to obtain a copy of your personal data in a structured, commonly used, and machine-readable format for transfer to another service provider, where technically feasible.
• Right to File a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that 90vip has violated your data privacy rights. The NPC can be reached at privacy.gov.ph.

10.2 To exercise any of the rights listed above, please submit a written request to the 90vip Data Protection Officer at [email protected] with the subject line "Data Privacy Request — [Your Name] — [Right Being Exercised]". 90vip will acknowledge your request within three (3) Philippine business days and provide a substantive response within fifteen (15) Philippine business days of acknowledgment, as required by the DPA IRR.

11.1 The 90vip Platform is strictly intended for individuals who are 21 years of age or older. 90vip does not knowingly collect personal data from individuals under 21 years of age. The minimum age for participation in casino-style online gambling in the Philippines is 21 years as consistent with applicable regulatory guidance.

11.2 If 90vip becomes aware that it has inadvertently collected personal data from an individual under 21 years of age, it will immediately suspend the associated account, delete the personal data collected, and return any funds deposited, in accordance with Section 2.3 of the 90vip Terms & Conditions.

11.3 If you are a parent or guardian and you believe your child under 21 has provided personal data to 90vip, please contact us immediately at [email protected] so that we can investigate and take appropriate remedial action.

12.1 90vip reserves the right to update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, or NPC regulatory guidance. When material changes are made, 90vip will notify registered users via the email address or mobile number associated with their account, and a prominent notice will be displayed on the Platform for a period of not less than fourteen (14) days prior to the changes taking effect.

12.2 The "Effective Date" at the top of this Policy reflects the date on which the current version became operative. You are encouraged to review this Policy periodically. Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the revised terms.

12.3 Archived versions of previous Privacy Policy documents are available upon written request to [email protected].

13.1 90vip has designated a Data Protection Officer (DPO) in accordance with Section 21(e) of the Data Privacy Act of 2012 IRR. The DPO is responsible for overseeing 90vip's data protection compliance program and serving as the primary point of contact for data subject inquiries.

13.2 You may contact the 90vip Data Protection Officer through the following channel:

• Email: [email protected] (subject line: "Data Protection Officer — [Your Query]")
• Response Time: Acknowledgment within 3 Philippine business days; substantive response within 15 Philippine business days.
• Operating Hours: Monday to Sunday, 09:00–21:00 Philippine Standard Time (PHT)

13.3 If you are not satisfied with 90vip's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines. The NPC handles complaints from data subjects regarding alleged violations of the Data Privacy Act of 2012. The NPC's official website is privacy.gov.ph.