Privacy Policy – me778 Online Gaming Platform

1. Data Controller

For the purposes of the Republic Act No. 10173 (Data Privacy Act of 2012) and applicable PAGCOR regulations, the data controller responsible for your personal data is me778, operating the online gaming platform at me778.org under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR).

me778 is committed to handling your personal data in a manner that is compliant with Philippine data privacy law and consistent with the trust you place in us when you register an account and use our platform. Questions about this Privacy Policy or about how me778 handles your personal data may be directed to our Data Protection Officer (DPO) using the contact details in Section 13.

2. Personal Data We Collect

me778 collects only the personal data that is necessary and proportionate to the purposes described in Section 4 of this Privacy Policy. The categories of personal data we may collect include:

me778 does not collect sensitive personal information as defined under the Data Privacy Act of 2012 (such as racial or ethnic origin, political opinions, or health data) unless required by PAGCOR regulations or applicable law, such as self-exclusion status under responsible gaming frameworks.

3. How We Collect Your Personal Data

me778 collects personal data through the following means:

• Direct collection: Data you provide when registering your me778 account, completing KYC verification, making deposits or withdrawals, contacting support, or setting responsible gaming limits.
• Automated collection: Technical and gaming data collected automatically when you access and use the me778 platform, including through cookies, log files, and session tracking technologies.
• Third-party sources: Identity verification and fraud prevention data from licensed KYC/AML service providers; payment data from GCash, Maya, BPI, BDO, Metrobank, and other integrated payment channels.
• Regulatory sources: Self-exclusion or restriction data shared by PAGCOR or other regulatory bodies pursuant to responsible gaming requirements.

4. Purpose & Legal Basis for Processing

me778 processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012. The following table summarises our processing purposes and the corresponding legal bases:

Where me778 relies on your consent as the legal basis for processing (e.g., for marketing communications), you have the right to withdraw that consent at any time by contacting our support team or updating your notification preferences within your me778 account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Sharing Your Personal Data

me778 does not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment providers: GCash, Maya/PayMaya, GrabPay, BPI, BDO, Metrobank, 7-Eleven CLiQQ, and other integrated payment channels, for the purpose of processing deposits and withdrawals.
• Game providers: Certified third-party game studios (e.g., Pragmatic Play, PG Soft, Jili, Habanero) who may receive gaming session data necessary to operate their games on the me778 platform.
• KYC and AML service providers: Licensed identity verification and fraud prevention vendors engaged to support our legal obligations.
• Regulatory authorities: PAGCOR and other Philippine government agencies, including the Anti-Money Laundering Council (AMLC), as required by law or upon lawful request.
• Technology and hosting providers: Cloud infrastructure and platform technology providers who process data on our behalf under strict data processing agreements.
• Legal and professional advisors: Where necessary for the purposes of legal proceedings, regulatory compliance, or professional advice.

All third parties with whom me778 shares personal data are required to process that data only for the specified purpose, in accordance with applicable Philippine data privacy law, and subject to confidentiality obligations.

6. Data Retention

me778 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

• Account data and KYC records are retained for a minimum of five (5) years from the date of account closure, in compliance with PAGCOR and AML regulatory requirements.
• Financial transaction records are retained for a minimum of five (5) years from the date of each transaction.
• Gaming activity records are retained for a minimum of three (3) years.
• Marketing consent records are retained for the duration of the consent and for a period of three (3) years thereafter as evidence of consent.
• Support communications are retained for two (2) years from the date of the last communication.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised. Anonymised data (which can no longer identify you) may be retained indefinitely for analytics and statistical purposes.

7. Data Security

me778 implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and the me778 platform;
• Hashed and salted password storage — me778 staff cannot read your password;
• Multi-factor authentication (OTP via SMS) for account access and sensitive account changes;
• Role-based access controls limiting staff access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of the me778 platform;
• Suspicious login detection and automated alerts to your registered Philippine mobile number.

Notwithstanding these measures, no internet transmission or electronic storage system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, me778 will notify affected users and the National Privacy Commission (NPC) in accordance with the Data Privacy Act of 2012 and its implementing rules.

8. Cookies & Tracking Technologies

The me778 platform uses cookies and similar tracking technologies to operate the platform, remember your preferences, and analyse platform usage. The categories of cookies used by me778 are as follows:

• Strictly necessary cookies: Required for the me778 platform to function, including session management, login state maintenance, and security. These cannot be disabled.
• Functional cookies: Remember your language preferences, account settings, and responsible gaming configurations.
• Analytics cookies: Collect anonymised data about how users interact with the me778 platform to help us improve the service.

You may control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the me778 platform. me778 does not use third-party advertising cookies or sell cookie-derived data to advertisers.

9. Your Data Privacy Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by me778. To exercise any of these rights, please contact the me778 Data Protection Officer using the details in Section 13.

• Right to be informed: The right to know what personal data me778 holds about you and how it is being used — addressed by this Privacy Policy.
• Right to access: The right to obtain a copy of the personal data me778 holds about your account.
• Right to correction: The right to have inaccurate or incomplete personal data corrected. You may update certain details directly within your me778 account settings.
• Right to erasure: The right to request deletion of your personal data, subject to me778's legal and regulatory retention obligations under PAGCOR and AML requirements.
• Right to object: The right to object to certain processing activities, including processing for direct marketing purposes.
• Right to data portability: The right to receive your personal data in a structured, commonly used format.
• Right to lodge a complaint: The right to file a complaint with the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

me778 will respond to all verified data subject requests within thirty (30) calendar days. We may request proof of identity before processing a request to protect against unauthorised access to your data.

10. Minors & Age Restriction

Age verification is a mandatory component of the me778 registration and KYC process. By registering an account, you confirm that you are at least 21 years of age and consent to the collection and processing of your personal data as described in this Privacy Policy.

11. International Data Transfers

me778's primary operations and data storage are based in the Philippines. Where it is necessary to transfer personal data to service providers or technology partners located outside the Philippines — for example, to certified game providers or cloud hosting services with data centres in other countries — me778 ensures that such transfers are subject to appropriate safeguards consistent with the Data Privacy Act of 2012 and its implementing rules, including contractual protections through data processing agreements that require the recipient to apply data protection standards equivalent to those applicable in the Philippines.

me778 does not transfer personal data to jurisdictions that do not provide adequate data protection protections without implementing appropriate supplementary safeguards.

12. Amendments to This Privacy Policy

me778 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where changes are material, me778 will provide notice by posting the updated Privacy Policy on me778.org and, where practicable, by notifying registered users via SMS or in-platform notification.

The "Last Updated" date at the top of this Privacy Policy indicates when the most recent revision was made. We encourage you to review this Privacy Policy periodically. Your continued use of the me778 platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised policy.

13. Contact & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your data privacy rights, or want to report a data privacy concern, please contact the me778 Data Protection Officer (DPO) through the following channels:

me778 will acknowledge all data privacy requests within three (3) business days and will respond substantively within thirty (30) calendar days. If your concern is not resolved to your satisfaction, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.