nn33ap Privacy Policy

This Privacy Policy ("Policy") describes how nn33ap ("nn33ap", "we", "us", "our") — the operator of the online gaming platform accessible at https://nn33ap.net (the "Platform") — collects, uses, stores, discloses, and protects personal information relating to individuals ("you", "User", "Player") who access or use our services.

This Policy is issued in accordance with and governed by the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission (NPC) of the Philippines. It should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated herein by reference.

By accessing the nn33ap Platform, creating an account, making a deposit, or otherwise interacting with our services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not consent to this Policy, you must not use the nn33ap Platform.

This Policy applies to all Filipino players accessing nn33ap from anywhere in the Philippines — whether in Metro Manila, Cebu, Davao, Quezon City, Makati, or any other part of Luzon, Visayas, or Mindanao — as well as to any individual who accesses the Platform from another jurisdiction.

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, the personal information controller responsible for your data is nn33ap, the operator of https://nn33ap.net.

nn33ap has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with applicable data privacy laws, responding to data subject requests, and acting as the primary point of contact for the National Privacy Commission. The DPO can be reached at the contact details provided in Section 14 of this Policy.

nn33ap processes your personal data in its capacity as a personal information controller, and in certain circumstances, as a personal information processor acting on behalf of third-party providers (such as game suppliers and payment processors) under appropriate data processing agreements.

nn33ap collects only the minimum personal data necessary for the purposes described in this Policy. The categories of personal data we collect include:

nn33ap collects personal data through the following channels:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team, respond to a survey, or opt in to marketing communications;
• Automatically through Platform use: When you access and navigate the Platform, our systems automatically record technical data including your IP address, device identifiers, browser type, session activity, and cookie data (see Section 9 for details on cookies);
• From third-party identity verification providers: When you submit a government-issued ID for KYC verification, our accredited third-party identity verification partner processes the document and returns a verification result to nn33ap;
• From payment service providers: When you initiate a GCash, Maya, GrabPay, QR Ph, BPI, BDO, Metrobank, 7-Eleven CLiQQ, InstaPay, or PesoNet transaction, the relevant payment provider shares transaction reference data with nn33ap to confirm deposit or withdrawal status;
• From game providers: Certified third-party game suppliers provide nn33ap with game session data, including bet amounts, outcomes, and RNG audit logs, to support the integrity of our Platform and comply with regulatory record-keeping obligations.

nn33ap processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012. The primary purposes for which we process your data, along with the applicable legal basis for each, are set out below:

• Account creation and management — necessary for the performance of our contract with you (the Terms & Conditions you accepted at registration);
• Identity and age verification (KYC) — necessary for compliance with our legal obligations under PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and the requirement that all players be at least 21 years of age;
• Processing deposits and withdrawals — necessary for the performance of our contract with you and for compliance with AML/CTF regulations;
• Fraud prevention and security — necessary for the legitimate interests of nn33ap and our players in maintaining a secure, fair Platform;
• Customer support — necessary for the performance of our contract with you to provide the services you have requested;
• Responsible gaming monitoring — necessary for compliance with our legal obligations and for the protection of your vital interests, including enforcing deposit limits, session controls, and self-exclusion requests;
• Regulatory reporting — necessary for compliance with our obligations to PAGCOR, the AMLC, the NPC, and any other competent Philippine regulatory authority;
• Marketing and promotional communications — based on your freely given, specific, and informed consent, which you may withdraw at any time by updating your communication preferences in your account settings or by contacting support.

nn33ap does not use automated decision-making processes (including profiling) that produce legal or similarly significant effects on you without human review, except where required to do so under applicable law.

nn33ap will never sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share your data only in the following circumstances and only to the extent strictly necessary:

• Service providers and processors: We engage trusted third-party service providers who process data on our behalf under written data processing agreements, including identity verification providers, payment processors (GCash, Maya, GrabPay, BPI, BDO, Metrobank, and others), IT infrastructure providers, cybersecurity firms, and customer support platform operators. These providers are bound by confidentiality obligations and are prohibited from using your data for any purpose other than providing services to nn33ap;
• Game suppliers: Certified third-party game providers receive the minimum gaming session data necessary to deliver and audit game outcomes on the Platform. All game suppliers engaged by nn33ap are independently certified and subject to data protection requirements consistent with this Policy;
• Regulatory and law enforcement authorities: nn33ap is required by law to disclose certain personal and financial data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and other competent Philippine government authorities upon lawful request or as required by applicable regulations;
• Business transfers: In the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of the assets of nn33ap, your personal data may be transferred to the acquiring entity, subject to that entity assuming obligations substantially equivalent to those set out in this Policy. You will be notified of any such transfer in advance;
• With your consent: We may share your personal data with any other third party where you have provided your explicit, informed consent to such sharing.

nn33ap retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account relationship with nn33ap, plus a minimum of five (5) years following account closure, in accordance with PAGCOR regulatory requirements and applicable AML/CTF record-keeping obligations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with the requirements of the Anti-Money Laundering Act and its implementing regulations;
• Gaming history records: Retained for a minimum of three (3) years from the date of each gaming session, for integrity monitoring and dispute resolution purposes;
• Customer support communications: Retained for two (2) years from the date of the final communication in each support thread, or longer where relevant to an ongoing dispute;
• Marketing consent records: Retained for the duration of your active consent, plus two (2) years following withdrawal of consent, to maintain an auditable record of consent history.

Upon expiry of the applicable retention period, your personal data will be securely deleted, anonymized, or pseudonymized in accordance with NPC guidelines and industry best practices. Where anonymization is applied, the resulting data may be retained indefinitely for analytical and statistical purposes without further notice to you.

nn33ap implements a comprehensive set of technical, organizational, and administrative security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• AES-256 encryption: All personal and financial data stored in nn33ap's databases is encrypted at rest using AES-256 encryption standards;
• TLS/SSL in transit: All data transmitted between your device and the nn33ap Platform is encrypted in transit using TLS 1.2 or higher;
• Access controls: Access to personal data within nn33ap is restricted on a strict need-to-know basis. All staff who handle personal data undergo regular data privacy training and are bound by confidentiality obligations;
• Two-factor authentication (2FA): nn33ap offers 2FA for all registered player accounts and requires it for all internal staff accounts accessing personal data systems;
• Penetration testing and vulnerability assessments: The Platform undergoes regular third-party security audits, penetration tests, and vulnerability assessments to identify and remediate security risks;
• Incident response: nn33ap maintains a documented data breach response procedure. In the event of a personal data breach, we will notify the National Privacy Commission and affected individuals within the timeframes prescribed by RA 10173 and NPC Circular No. 16-03.

nn33ap uses cookies and similar tracking technologies (such as web beacons and local storage objects) to operate and improve the Platform, personalize your experience, and analyse aggregate usage patterns. A cookie is a small text file placed on your device by a website you visit.

The categories of cookies used on the nn33ap Platform are:

• Strictly necessary cookies: Essential to the operation of the Platform. These cookies enable core functions such as secure login session management, account authentication, and fraud prevention. They cannot be disabled without impairing Platform functionality;
• Functional cookies: Allow the Platform to remember your preferences (such as your preferred language, currency display, or lobby layout) to provide a more personalized experience;
• Analytical cookies: Used to collect anonymized information about how visitors use the Platform — including pages visited, session duration, and error encounters — to help us improve the overall user experience. nn33ap uses privacy-respecting analytics tools that anonymize IP addresses before processing;
• Marketing cookies: Set only where you have given explicit consent. These cookies help nn33ap deliver relevant promotional offers and measure the effectiveness of our marketing campaigns.

You can manage or withdraw your consent to non-essential cookies at any time through your browser settings or via the cookie preference centre accessible on the Platform. Please note that disabling certain cookies may affect the functionality of the nn33ap Platform.

The nn33ap Platform is strictly intended for use by individuals who are at least twenty-one (21) years of age, consistent with Philippine gaming regulations applicable to casino-style online gaming. nn33ap does not knowingly collect personal data from any person under the age of 21.

During registration and KYC verification, nn33ap collects and verifies your date of birth using a valid Philippine government-issued ID. Any account found to have been registered by a person under 21 years of age will be immediately suspended, all gaming activity voided, and the matter reported to PAGCOR as required by applicable regulations.

As a data subject under the Data Privacy Act of 2012 (RA 10173), you are entitled to exercise the following rights with respect to your personal data held by nn33ap:

• Right to be informed: You have the right to be informed of the fact that your personal data is being processed, the purposes of such processing, and the identity of the data controller — all of which are set out in this Policy;
• Right of access: You have the right to obtain a copy of the personal data nn33ap holds about you, along with information about how it is processed;
• Right to rectification: You have the right to request the correction of inaccurate, incomplete, or outdated personal data held by nn33ap;
• Right to erasure: You have the right to request the deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations;
• Right to object: You have the right to object to the processing of your personal data on grounds of legitimate interest or for direct marketing purposes. Where you object to marketing, we will immediately cease processing your data for that purpose;
• Right to data portability: Where technically feasible and legally permissible, you have the right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated.

To exercise any of these rights, please submit a written request to our Data Protection Officer at [email protected] with the subject line "Data Privacy Rights Request". We will acknowledge your request within five (5) business days and respond fully within fifteen (15) business days, as required by NPC regulations. We may require you to verify your identity before processing your request.

The nn33ap Platform engages third-party service providers whose infrastructure and operations may be located outside of the Philippines — including game software providers whose servers are hosted in licensed gaming jurisdictions, and cloud infrastructure providers operating internationally. As a result, your personal data may be transferred to, stored in, or processed in countries outside the Philippines.

Where such cross-border transfers occur, nn33ap ensures that your personal data receives a level of protection that is at least equivalent to that afforded under the Data Privacy Act of 2012, through one or more of the following safeguards:

• Transfer to countries recognized by the NPC as providing an adequate level of data protection;
• Implementation of binding contractual clauses (standard data transfer agreements) consistent with NPC requirements;
• Transfer to recipients who are subject to binding corporate rules approved by a recognized data protection authority.

By using the nn33ap Platform and consenting to this Policy, you acknowledge and agree to such cross-border transfers of your personal data subject to the safeguards described above.

nn33ap reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, NPC guidance, or PAGCOR regulatory requirements. When we make material changes to this Policy, we will notify you by one or more of the following means: a prominent notice posted on the Platform, an email notification to your registered email address, or an in-platform notification upon your next login.

The "Last Updated" date at the top of this page indicates when this Policy was most recently revised. We encourage you to review this page periodically. Your continued use of the nn33ap Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

If any amendment materially reduces your rights or increases the scope of data we collect, we will seek your fresh consent before applying the amended Policy to your account where required to do so under RA 10173.

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by nn33ap, please contact our Data Protection Officer (DPO) through any of the following channels:

• Email: [email protected] (subject line: "Data Privacy Inquiry" or "Data Privacy Rights Request")
• Live Chat: Available 24/7 inside the nn33ap Platform — ask to speak with a Data Privacy representative

If you are not satisfied with our response, you have the right to escalate your complaint directly to the National Privacy Commission (NPC) of the Philippines, the independent body responsible for enforcing the Data Privacy Act of 2012.

nn33ap is committed to resolving all data privacy inquiries and complaints promptly, fairly, and in full compliance with our obligations under Philippine law and the PAGCOR regulatory framework.