aaaji Casino — Privacy Policy

This Privacy Policy ("Policy") applies to all personal information processed by aaaji ("aaaji," "we," "us," or "our") in connection with your use of the aaaji online gaming platform at aaaji.vip, including account registration, gameplay, financial transactions, customer support interactions, promotional communications, and any other service offered through or in connection with the Platform.

aaaji takes its data protection obligations seriously. As a platform operating in the Philippines and serving Filipino players from Manila, Cebu, Davao, Quezon City, and across the archipelago, aaaji is committed to handling personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), the National Privacy Commission's ("NPC") circulars and advisories, and applicable PAGCOR data governance requirements.

By registering for an account or using the aaaji Platform, you acknowledge that you have read and understood this Policy and consent to the collection, use, storage, and processing of your personal information as described herein. Where your consent is specifically required under the DPA, we will request that consent separately and record it.

For the purposes of the Philippine Data Privacy Act of 2012, aaaji is the Personal Information Controller (PIC) in respect of all personal data processed in connection with the Platform. As a PIC, aaaji determines the purposes and means of processing your personal information and is responsible for ensuring that such processing complies with the DPA and all applicable data protection laws.

aaaji has appointed a Data Protection Officer (DPO) responsible for overseeing data protection compliance, handling data subject requests, and acting as the primary point of contact with the National Privacy Commission. The DPO can be contacted via email at [email protected] with the subject line "Data Protection Officer — Privacy Inquiry."

aaaji collects personal data across the following categories, depending on your interaction with the Platform:

aaaji collects personal data through the following channels and mechanisms:

• Directly from you: When you complete the account registration form, submit KYC documents, make deposits or withdrawal requests, contact customer support, or respond to surveys or promotions.
• Automatically from your device: When you visit aaaji.vip or use the Platform, our servers and analytics systems automatically collect technical data including IP address, device identifiers, browser data, and session information through server logs, cookies, and similar tracking technologies.
• From payment service providers: When you authorize a GCash, Maya, BPI, BDO, Metrobank, or other payment transaction, the relevant payment service provider shares transaction confirmation data with aaaji for processing and reconciliation purposes.
• From identity verification services: aaaji uses third-party KYC verification services to validate government-issued ID documents and perform liveness checks. These services process your identity documents and return a verification result and confidence score to aaaji.
• From fraud prevention and security services: aaaji uses third-party fraud detection, device fingerprinting, and risk scoring services that provide risk assessments based on technical signals from your device and session.

aaaji processes your personal data for the following specific purposes:

Under the Philippine Data Privacy Act of 2012, aaaji relies on the following legal bases for processing personal information, corresponding to the criteria set out in Sections 12 and 13 of the DPA:

aaaji does not sell your personal data to third parties. aaaji may share your personal data with the following categories of recipients, solely to the extent necessary for the specified purposes:

• Payment Service Providers (GCash, Maya, BPI, BDO, Metrobank, InstaPay operators): To process deposits and withdrawals, verify payment method ownership, and handle transaction disputes. These providers are BSP-regulated and maintain independent data protection obligations.
• KYC and Identity Verification Service Providers: To perform document verification and liveness checks required for PAGCOR-mandated age and identity verification.
• Game Software Providers (Pragmatic Play, PG Soft, NetEnt, and others): To deliver game content and record game results, limited to the data necessary to run the specific game session.
• Fraud Detection and Cybersecurity Service Providers: To detect, prevent, and investigate fraudulent activity, account takeover attempts, and platform abuse.
• PAGCOR (Philippine Amusement and Gaming Corporation): As required by law for regulatory oversight, periodic reporting, and compliance verification.
• Anti-Money Laundering Council (AMLC): As required by the AMLA for covered transaction reporting (CTR) and suspicious transaction reporting (STR) obligations.
• National Privacy Commission (NPC): In the event of a personal data breach requiring NPC notification, or in response to lawful NPC investigations.
• Law Enforcement and Courts: Where disclosure is required by a valid court order, subpoena, search warrant, or lawful demand from Philippine law enforcement authorities.
• Cloud Infrastructure and Hosting Providers: For the technical operation of the Platform on secure, dedicated cloud infrastructure. All providers are subject to contractual data processing agreements.

Some of aaaji's service providers — including game software providers, cloud infrastructure operators, and KYC verification services — may process your data in servers or facilities located outside the Philippines. Where such cross-border transfers occur, aaaji ensures that:

• The receiving country provides an adequate level of data protection, or
• Appropriate safeguards are in place, including contractual data processing agreements incorporating the NPC's standard contractual clauses or equivalent protections, or
• The transfer is covered by one of the derogations permissible under Section 21 of the DPA IRR (e.g., necessary for the performance of your contract with aaaji).

You may request information about the specific safeguards applicable to any particular cross-border transfer by contacting aaaji's Data Protection Officer.

aaaji retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Upon expiry of the applicable retention period, aaaji will securely destroy or permanently anonymize your personal data in accordance with its data disposal procedures and NPC guidelines on secure disposal of personal information.

aaaji implements organizational, technical, and physical security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Key security measures include:

• 256-bit TLS Encryption: All data transmitted between your device and aaaji's servers is encrypted using 256-bit Transport Layer Security (TLS) — the same standard used by Philippine banks and BSP-regulated financial institutions.
• Password Hashing: Account passwords are stored using bcrypt hashing — your actual password is never stored in plain text and cannot be retrieved even by aaaji staff.
• Two-Factor Authentication (2FA): SMS-based 2FA is available for all accounts and is strongly recommended. All administrative and staff accounts require mandatory 2FA.
• Access Controls: Personal data is accessible only to aaaji personnel who require it for their specific job function. Role-based access controls are implemented and regularly audited.
• Penetration Testing: aaaji engages independent cybersecurity firms to conduct regular penetration testing and vulnerability assessments of the Platform's infrastructure.
• Data Minimization: aaaji collects only the minimum personal data necessary for each identified purpose and does not retain data beyond applicable retention periods.

aaaji uses cookies and similar tracking technologies on aaaji.vip for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function — including session management, authentication tokens, and security cookies. These cannot be disabled without breaking the Platform.
• Functional Cookies: Remember your preferences, language settings, and responsible gaming configurations. Disabling these may affect your user experience.
• Analytics Cookies: Used to understand aggregate usage patterns on the Platform — which games are most popular, how players navigate the site, and where technical issues occur. These use anonymized or pseudonymized data.
• Security Cookies: Support fraud detection and device fingerprinting to identify suspicious access patterns and protect your account from unauthorized access.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features. aaaji does not use third-party advertising or retargeting cookies.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by aaaji. To exercise any of these rights, submit a written request to [email protected] with the subject line "Data Subject Rights Request."

If aaaji discovers that personal data has been collected from a person under 21 years of age, aaaji will immediately suspend the relevant account, delete the collected personal data to the extent permitted by AML retention obligations, and report the matter to PAGCOR in accordance with regulatory requirements. If you believe a minor has registered on aaaji, please contact [email protected] immediately.

aaaji may update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR or NPC regulatory guidance, our business practices, or the technical operation of the Platform. When material changes are made to this Policy, aaaji will:

• Update the "Effective Date" and "Last Reviewed" dates at the top of this page.
• Notify registered players via the email address or mobile number associated with their aaaji account.
• Where required by the DPA, obtain fresh consent for any new processing activities not covered by the basis for processing under the prior version of this Policy.

Your continued use of the aaaji Platform following the effective date of a revised Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must discontinue use of the Platform and close your account before the effective date.

For all data protection inquiries, data subject rights requests, or privacy-related complaints, please contact aaaji through the following channels:

• Data Protection Officer (DPO) Email: [email protected] — Subject line: "Data Protection Officer — [Nature of Inquiry]"
• General Support Email: [email protected]
• Live Chat: Available 24/7 from within the aaaji Platform after login. For privacy matters, request transfer to the compliance team.

aaaji is committed to resolving data protection concerns at the first instance and encourages players to contact the DPO before filing an NPC complaint, as many matters can be resolved swiftly through direct engagement.