palago Privacy Policy

This Privacy Policy ("Policy") is issued by palago ("palago," "we," "us," "our"), the operator of the online gaming platform accessible at palago.vip. This Policy governs the collection, use, storage, disclosure, and protection of personal data relating to all individuals who access, register on, or otherwise interact with the palago platform ("Players," "you," "your").

This Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and applicable circulars issued by the National Privacy Commission (NPC) of the Philippines. It applies to all personal data processed by palago in connection with the delivery of its online gaming services to Filipino players and any other persons who access the palago platform from within the Philippines.

By creating a palago Account, depositing funds, or otherwise using the palago platform, you acknowledge that you have read, understood, and consent to the collection and processing of your personal data as described in this Policy. If you do not consent to this Policy, you must not create a palago Account or use the platform.

For the purposes of the Philippine Data Privacy Act of 2012, palago is the Personal Information Controller (PIC) of personal data collected through the palago platform. palago operates under authorization from the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the data governance requirements imposed by PAGCOR on licensed online gaming operators.

palago has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act and this Policy. The DPO may be contacted through palago's official support channels as described in Section 16 of this Policy. Inquiries addressed specifically to the DPO should be marked accordingly to ensure proper routing.

palago collects personal data from Players through various means, including direct input at registration, through use of the platform, via communications with palago support, and automatically through technical systems. The categories of personal data collected are set out below.

• Full legal name (as per government-issued identification)
• Date of birth (for age verification purposes — 21+ requirement)
• Registered Philippine mobile number
• Email address
• Chosen username and hashed account password
• Residential address (required for KYC verification)

• Copies of government-issued Philippine identification documents (e.g., PSA National ID, passport, UMID, driver's license, SSS ID, PRC ID)
• Selfie or live photo used for identity liveness checks
• Proof of address documents where required
• Tax Identification Number (TIN) where required for large transaction reporting

• Deposit and withdrawal transaction records including amounts, dates, and payment method references
• GCash, Maya, or bank account reference identifiers (not full account numbers — palago does not store complete bank account credentials)
• Balance history and cashier activity logs
• Bonus and promotional credit transaction records

• Game session logs including game type, stakes, outcomes, and duration
• Betting history across all palago game categories
• Loyalty points accrual and VIP tier progression records
• Responsible gaming tool activation and settings (deposit limits, session limits, exclusion periods)

• IP address and approximate geolocation data
• Device type, operating system, and browser type
• Session timestamps and login activity
• Cookie identifiers and similar tracking technologies (see Section 8)

• Records of all live chat, email, and in-app communications with palago support
• Survey responses and feedback submitted to palago
• Complaint and dispute records

palago processes personal data only for specific, declared, and legitimate purposes. Each processing activity is grounded in one or more of the lawful bases recognised under the Philippine Data Privacy Act. The table below sets out palago's primary processing activities, their purposes, and the applicable legal basis:

Where palago relies on consent as the legal basis for processing, you may withdraw that consent at any time by contacting palago's support team or adjusting your Account communication preferences. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal, and will not affect processing conducted on a different legal basis.

palago does not sell, rent, or commercially trade personal data. palago discloses personal data to third parties only in the circumstances described below, and only to the minimum extent necessary for the disclosed purpose.

palago is required by Philippine law to share personal data with the following authorities in specified circumstances:

• PAGCOR — as part of regular licensing compliance reporting and in response to formal PAGCOR investigation requests
• Anti-Money Laundering Council (AMLC) — for covered and suspicious transaction reporting as required by the Anti-Money Laundering Act (RA 9160, as amended)
• National Privacy Commission (NPC) — in connection with data breach notifications and NPC investigations
• Philippine law enforcement agencies — pursuant to valid legal process, court orders, or official requests under applicable Philippine law

palago engages trusted third-party service providers (Personal Information Processors or PIPs under RA 10173) to assist in delivering the palago platform. These providers process personal data only on palago's documented instructions and are contractually bound to maintain confidentiality and comply with RA 10173. Categories of service providers include:

• Payment gateway providers (GCash, Maya, GrabPay, banks) — for transaction processing
• Identity verification service providers — for KYC and age verification
• Game software providers — for delivery of third-party games within the palago platform
• Cloud infrastructure providers — for secure hosting of palago's platform and data
• Fraud prevention and cybersecurity service providers
• Customer support platform providers

palago does not share personal data with third-party advertisers, data brokers, or marketing agencies. No personal data collected by palago is transferred to any entity for purposes unrelated to the direct delivery, security, and compliance functions of the palago platform.

palago retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. Minimum retention periods applicable to palago's data categories are set out below:

• Account & KYC data: Retained for a minimum of five (5) years from the date of Account closure or the date of the last transaction, whichever is later — as required under the Anti-Money Laundering Act
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction
• Gaming activity logs: Retained for a minimum of three (3) years for dispute resolution and RNG audit purposes
• Support communication records: Retained for a minimum of two (2) years from the date of the communication
• Marketing consent records: Retained for the duration of the relevant consent and for one (1) year following withdrawal of consent

Upon expiry of applicable retention periods, palago will securely delete or anonymise personal data in a manner that prevents reconstruction or re-identification. Where data is anonymised rather than deleted, the anonymised dataset is no longer considered personal data under RA 10173 and may be retained for statistical and analytical purposes.

palago implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures are reviewed and updated regularly to reflect evolving threats and best practices in data security. Key security measures in place at palago include:

• 256-bit SSL/TLS encryption for all data transmitted between Players' devices and the palago platform
• AES-256 encryption for personal data stored at rest on palago's servers
• Multi-factor authentication (MFA) for all palago internal systems access
• Role-based access controls limiting personal data access to authorised palago personnel with a documented business need
• Regular penetration testing and vulnerability assessments of the palago platform
• Continuous network monitoring and intrusion detection systems
• Hashed and salted storage of player account passwords (passwords are never stored in plaintext)
• Physical security controls at palago's data processing facilities
• Staff privacy and data security training programmes

palago uses cookies and similar tracking technologies on the palago platform to enable core functionality, improve user experience, maintain session security, and perform analytics. The types of cookies used by palago are described below:

These cookies are essential for the palago platform to function and cannot be disabled. They include session authentication tokens, security cookies that protect against cross-site request forgery (CSRF), and cookies that preserve your preferences during a session (such as language settings). These cookies do not require your consent as they are strictly necessary for service delivery.

palago uses analytical cookies to understand how Players interact with the platform — for example, which game categories are accessed most frequently, where players encounter errors, and how long sessions typically last. This data is used in aggregated, anonymised form to improve the palago platform. These cookies are set only with your consent, which you may withdraw by adjusting your browser cookie settings.

palago uses device fingerprinting and session tracking technologies to detect and prevent fraudulent activity, including the creation of multiple accounts and automated bot activity. These technologies are classified as strictly necessary cookies for security and compliance purposes and operate regardless of your general cookie preferences.

Most modern browsers allow you to view, manage, and delete cookies stored on your device. Disabling strictly necessary cookies will impair or prevent your ability to access the palago platform. Disabling analytical cookies will not affect your access to palago's core gaming features.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by palago. These rights are exercisable by submitting a written request to palago's support team or Data Protection Officer, as described in Section 16.

1. Right to be Informed — The right to be informed whether palago processes your personal data, and to receive information about the nature, purpose, extent, and duration of such processing. This Policy fulfils palago's obligation under this right.
2. Right of Access — The right to request a copy of the personal data palago holds about you, together with information about how it is processed. palago will respond to verified access requests within 15 business days.
3. Right to Correction / Rectification — The right to request that inaccurate, incomplete, or outdated personal data be corrected. You may update basic Account information directly through your palago Account settings; requests for KYC data corrections must be submitted to support.
4. Right to Erasure or Blocking — The right to request the deletion or blocking of your personal data where it is unlawfully processed, no longer necessary for the purpose it was collected, or where you have withdrawn consent and no other legal basis applies. Note that palago may be required to retain certain data for PAGCOR and AML compliance purposes regardless of an erasure request.
5. Right to Object — The right to object to processing of your personal data where that processing is based on legitimate interest, including direct marketing. Marketing communications opt-out can be actioned immediately through your Account preferences.
6. Right to Data Portability — The right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller, where technically feasible.
7. Right to Damages — The right to claim compensation for any damages sustained as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of personal data in violation of the Data Privacy Act.
8. Right to Lodge a Complaint — The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe palago has processed your personal data in violation of the Data Privacy Act. NPC contact information is published on the NPC's official website.

The palago platform is strictly restricted to individuals aged 21 years and above. palago does not knowingly collect personal data from individuals under 21 years of age. Age verification is conducted at registration and as part of the KYC process prior to withdrawal processing.

If palago becomes aware that personal data has been collected from an individual under 21 years of age, it will take immediate steps to delete that data, suspend the associated Account, and void any game activity or winnings associated with the Account. Any deposits made will be returned to the source payment method following identity verification.

Some of palago's third-party service providers — including cloud infrastructure providers and game software providers — may process or store personal data on servers located outside the Philippines. Where such cross-border data transfers occur, palago ensures that adequate safeguards are in place to protect your personal data, including:

• Binding contractual clauses consistent with NPC requirements for cross-border data transfers
• Transfer to jurisdictions with data protection standards deemed adequate by the NPC or by applicable international frameworks
• Contractual obligations on receiving processors to maintain security standards equivalent to those required under RA 10173

palago will not transfer personal data to jurisdictions that do not provide adequate data protection unless appropriate contractual safeguards are in place and the transfer is otherwise lawful under the Data Privacy Act.

The palago platform incorporates games and services provided by third-party software providers. While palago exercises due diligence in selecting reputable, certified providers, please note that game software providers operate their own technical systems as part of delivering their games. palago's contractual arrangements with game providers include data processing requirements consistent with the objectives of this Policy.

This Policy does not extend to the data practices of any third-party services accessed independently of the palago platform. palago does not embed third-party social media tracking pixels or advertising networks on the palago platform that would share your personal data with external advertising platforms.

As a PAGCOR-licensed online gaming operator, palago is a covered institution under the Philippine Anti-Money Laundering Act (RA 9160, as amended by RA 9194, RA 10167, and RA 10365). palago is legally obligated to:

• Collect and verify player identity data (KYC) in accordance with AMLC regulations
• Report covered transactions (transactions exceeding the threshold set by AMLC) to the Anti-Money Laundering Council
• Report suspicious transactions to the AMLC regardless of amount
• Maintain transaction records for a minimum of five (5) years as required by AMLA
• Cooperate fully with AMLC investigations, PAGCOR compliance reviews, and other lawful regulatory processes

AML-related disclosures to the AMLC are made on a confidential basis. palago is prohibited by law from notifying Players that they are or have been the subject of an AMLC suspicious transaction report.

Despite palago's technical and organisational security measures, no data system can be guaranteed completely immune from security incidents. In the event of a personal data breach that poses a real risk of serious harm to data subjects, palago will:

1. Contain the breach and preserve forensic evidence as quickly as practicable following discovery
2. Notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, providing all information required under NPC Circular No. 16-03
3. Notify affected Players directly within a reasonable period, providing information on the nature of the breach, personal data categories affected, likely consequences, and the remedial actions palago has taken or will take
4. Conduct a full post-incident review and implement remediation measures to prevent recurrence

Breach notifications to Players will be sent to the email address registered on their palago Account. Players are encouraged to keep their registered email address current to ensure receipt of any security communications from palago.

palago reserves the right to amend this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulations, NPC guidance, or palago's data processing practices. Material changes to this Policy will be communicated to registered Players by email to their registered address and by prominent notice on the palago platform no less than seven (7) days before the amended Policy takes effect.

The effective date of the current version of this Policy is stated at the top of this document. The most current version of this Policy is always available at palago.vip/privacy-policy. Continued use of the palago platform after the effective date of any amendment constitutes your acceptance of the revised Policy.

For any questions, requests, or complaints relating to this Privacy Policy or palago's handling of your personal data, please contact palago through the following channels:

• Live Chat: Available 24/7 via the palago platform — the fastest way to reach palago's support team for general privacy queries
• Data Protection Officer (DPO) — Email (plain text, not a link): [email protected] — mark your message "For the attention of the DPO" for formal data subject rights requests and breach reporting
• Website: palago.vip/privacy-policy

If you are not satisfied with palago's response to your privacy concern, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines. Information on how to submit a complaint to the NPC is available on the NPC's official government website.