Privacy Policy — 63boss

1. Introduction and Identity of the Data Controller

63boss ("the Company," "we," "us," or "our") operates the online gaming platform accessible at https://63boss.one and its associated interfaces (collectively, "the Platform"). In the context of this Privacy Policy, 63boss acts as the Personal Information Controller (PIC) as defined under Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), and its Implementing Rules and Regulations.

As a PIC, 63boss determines the purposes and means by which personal information collected through the Platform is processed. All processing activities are conducted in accordance with the general principles of transparency, legitimate purpose, and proportionality as required by the DPA and the regulations of the National Privacy Commission (NPC) of the Philippines.

63boss also operates in compliance with the regulatory requirements of the Philippine Amusement and Gaming Corporation (PAGCOR), which independently mandates certain data collection, verification, and retention practices as a condition of the Company's operating authorization.

2. Scope and Application of This Policy

This Privacy Policy applies to all personal information collected from individuals who:

• Register as members of the 63boss Platform
• Browse the Platform as unregistered visitors
• Communicate with 63boss through any channel, including live chat, email, or support tickets
• Interact with promotional materials or campaigns associated with the 63boss brand

This Policy applies regardless of the device or method used to access the Platform, whether through desktop browsers, mobile browsers, or any dedicated application. This Policy should be read together with the 63boss Terms & Conditions, which are available at Terms & Conditions.

3. Categories of Personal Information We Collect

63boss collects personal information across several categories depending on the nature of your interaction with the Platform:

3.1 Registration and Identity Data

• Full legal name as it appears on a government-issued ID
• Date of birth and age verification documentation
• Philippine mobile number and email address
• Residential address, city, and province within the Philippines
• Username and encrypted password

3.2 Identity Verification (KYC) Data

• Copies of government-issued identification documents (e.g., Philippine Passport, UMID, PhilSys National ID, Driver's License, SSS ID, Voter's ID)
• Selfie or liveness verification images where required by PAGCOR compliance procedures
• Proof of address documentation where requested
• Source of funds declaration for high-value accounts where required by anti-money laundering regulations

3.3 Financial and Transaction Data

• GCash mobile number or PayMaya account identifier linked to deposit and withdrawal transactions
• Bank account name and number for bank transfer transactions (BPI, BDO, Metrobank, and others)
• Transaction history including deposits, withdrawals, and account balance records
• Wagering history across all game categories

3.4 Technical and Usage Data

• IP address and geolocation data at the time of login and transactions
• Device type, operating system, and browser information
• Session duration, pages visited, and features accessed within the Platform
• Login timestamps and access logs

3.5 Communications Data

• Records of live chat conversations with customer support
• Email correspondence with 63boss
• Feedback, complaint, and dispute records

4. How We Collect Personal Information

63boss collects personal information through the following means:

5. Purposes for Which We Process Your Personal Information

63boss processes personal information only for the specific, legitimate purposes listed below. We do not process data beyond what is necessary to achieve these purposes.

• Account Registration and Management: To create, authenticate, and maintain your 63boss account.
• Age and Identity Verification: To confirm that you are 21 years of age or older and meet all eligibility requirements under PAGCOR regulations and the 63boss Terms & Conditions.
• Transaction Processing: To facilitate deposits, withdrawals, and wallet management in Philippine Peso through your chosen payment methods.
• Regulatory Compliance: To fulfil obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), and other applicable Philippine laws.
• Fraud Prevention and Security: To detect, investigate, and prevent unauthorized access, fraudulent activity, and abuse of the Platform.
• Customer Support: To respond to your enquiries, complaints, and requests for assistance.
• Responsible Gaming: To monitor gaming behavior and apply responsible gaming interventions where necessary, including self-exclusion, deposit limits, and support referrals.
• Platform Improvement: To analyze usage patterns, improve Platform performance, and develop new features based on aggregated, anonymized behavioral data.
• Marketing Communications: To send promotional offers, bonus notifications, and service updates — where you have provided consent or where permitted under applicable law. You may opt out of marketing communications at any time.

6. Legal Bases for Processing

Under the Data Privacy Act of 2012, each processing activity carried out by 63boss is grounded in one or more of the following lawful bases:

• Contractual Necessity: Processing required to perform our contractual obligations to you under the Terms & Conditions — including account management, transaction processing, and customer support.
• Legal Obligation: Processing required to comply with PAGCOR licensing requirements, the Anti-Money Laundering Act, tax obligations, and other applicable Philippine law.
• Legitimate Interest: Processing conducted for fraud prevention, Platform security, and service improvement where your interests and rights do not override our legitimate interest in conducting these activities.
• Consent: Processing for direct marketing communications and optional analytics, where your specific, informed consent has been obtained and may be withdrawn at any time.

7. Disclosure and Sharing of Personal Information

63boss does not sell, rent, or trade your personal information to any third party for commercial purposes. Personal information is disclosed only in the following limited circumstances:

7.1 Service Providers and Data Processors

63boss engages third-party service providers who process personal data strictly on our behalf and under written data processing agreements consistent with the DPA. These include: payment processors (GCash, PayMaya, banking partners), KYC and identity verification platforms, IT infrastructure and hosting providers, fraud detection services, and customer support technology platforms. These providers are permitted to use your data only for the specific purpose of delivering services to 63boss.

7.2 Game Studio Providers

Game studios integrated into the 63boss Platform may receive session identifiers and anonymized game activity data for the purpose of delivering and auditing game functionality. They do not receive your full personal profile unless required for regulatory compliance purposes and only to the extent necessary.

7.3 Regulatory and Law Enforcement Authorities

63boss will disclose personal information to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or any other competent Philippine government authority when required to do so by law, regulation, court order, or valid legal process. We will endeavor to notify you of such disclosure where legally permitted to do so.

7.4 Business Transfers

In the event of a merger, acquisition, or transfer of all or substantially all of the business assets of 63boss to a successor entity, personal data held by 63boss may be transferred to that entity. You will be notified of any such transfer and your rights under this Policy will continue to apply.

8. Cookies and Tracking Technologies

The 63boss Platform uses cookies and similar tracking technologies to ensure proper functionality, support security measures, and improve your experience. Cookies are small data files stored on your device when you visit the Platform.

You may manage optional cookie preferences through your browser settings or the cookie preference panel available on the Platform. Disabling essential cookies may affect Platform functionality. 63boss does not use third-party advertising cookies or behavioral tracking cookies for marketing profiling purposes.

9. Data Retention

63boss retains personal information for no longer than is necessary to fulfil the purposes for which it was collected, subject to the minimum retention periods mandated by applicable Philippine law:

• Account and identity data: Retained for the duration of the active account relationship plus a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with anti-money laundering record-keeping requirements under RA 9160.
• KYC and verification documents: Retained for the same period as identity data unless a longer period is required by regulatory direction.
• Customer support records: Retained for three (3) years from the date of the interaction, or longer where the interaction relates to an unresolved dispute or regulatory inquiry.
• Technical logs and access records: Retained for ninety (90) days for operational security monitoring, and up to twelve (12) months where retained for fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with 63boss's data disposal procedures.

10. Data Security Measures

63boss implements a comprehensive set of technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and the Platform
• Encryption of sensitive data fields (including financial data and identity documents) at rest in Platform databases
• Role-based access controls limiting staff access to personal data to those with a demonstrable operational need
• Multi-factor authentication for all administrative Platform access
• Regular penetration testing and vulnerability assessments conducted by independent security specialists
• Comprehensive audit logging of all access to personal data records
• Staff training and data privacy awareness programs conducted at regular intervals

While 63boss employs industry-standard security practices, no method of electronic transmission or storage is completely immune from risk. In the event of a security incident affecting your personal data, 63boss will respond in accordance with the obligations described in Section 13 of this Policy.

11. Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and NPC regulations, you have the following rights with respect to your personal information held by 63boss:

To exercise any of these rights, please contact the 63boss Data Protection Officer using the details provided in Section 15. We will respond to verified requests within fifteen (15) business days. In complex cases, we may extend this period by a further thirty (30) days with notice. If you believe your rights have not been adequately addressed, you have the right to lodge a complaint with the National Privacy Commission of the Philippines.

12. Children's Privacy and Underage Access

The 63boss Platform is strictly intended for adults aged 21 years and above, consistent with PAGCOR's age restriction policies for casino-style gambling services. 63boss does not knowingly collect, store, or process personal information from individuals under the age of 21.

As part of the registration process, users are required to confirm their age and submit to age verification procedures. Where 63boss becomes aware that personal information has been collected from an individual below the minimum age requirement, the relevant account will be immediately terminated, all funds managed in accordance with PAGCOR guidelines, and the personal data deleted as promptly as permitted by law.

If you are a parent or guardian and believe that a minor has registered on the Platform, please contact 63boss immediately using the contact details provided in Section 15.

13. Personal Data Breach Response

In the event that 63boss becomes aware of a personal data breach likely to pose a real risk of serious harm to affected data subjects, the Company will:

1. Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, in accordance with NPC Circular No. 16-03 and applicable NPC guidelines.
2. Notify affected data subjects without undue delay where the breach poses a high risk to their rights and freedoms, providing a clear description of the nature of the breach, the categories of data involved, likely consequences, and the measures taken or proposed to be taken.
3. Conduct a thorough internal investigation to determine the root cause, scope, and impact of the breach.
4. Implement remediation measures to contain the breach, prevent recurrence, and mitigate harm to affected individuals.

Breach notifications to affected 63boss members will be delivered via the email address registered to your account. 63boss maintains a documented incident response plan that is reviewed and tested on a regular basis.

14. Updates to This Privacy Policy

63boss reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or Platform services. Material changes will be communicated to registered users via the email address associated with their 63boss account, with reasonable advance notice where practicable.

The effective date at the top of this Policy reflects when the current version entered into force. We encourage you to review this Policy periodically. Your continued use of the 63boss Platform following notification of material changes constitutes your acknowledgement of the updated Policy.

Where the law requires your consent for continued processing following a material change, we will obtain such consent before the change takes effect with respect to your data.

15. Contact Information and Data Protection Officer

63boss has designated a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012 and NPC Advisory Opinion No. 2017-049. For all data privacy enquiries, data subject rights requests, or concerns relating to this Privacy Policy, please contact:

• Data Protection Officer, 63boss
• Platform: https://63boss.one
• Email: [email protected] (subject line: "Privacy / DPO Request")
• Live Chat: Available 24/7 through the Platform for general privacy enquiries

For escalated data privacy complaints that have not been resolved to your satisfaction by 63boss, you may file a complaint directly with the National Privacy Commission of the Philippines.

For concerns specifically related to responsible gaming data, self-exclusion records, or gaming behavior monitoring, please visit the Responsible Gaming page for relevant contacts and resources.