Privacy Policy — ah188

ah188 ("we," "us," "the Platform," "ah188") is a PAGCOR-licensed online gaming operator providing gaming services to registered players in the Republic of the Philippines. We take the privacy and security of your personal data seriously — not merely because we are legally required to, but because Filipino players who trust ah188 with their personal and financial information deserve to understand exactly how that information is handled.

This Privacy Policy applies to all personal data collected by ah188 through the ah188.app website, any mobile-optimized interfaces, customer support channels, and any other touchpoint through which ah188 interacts with current, former, or prospective players.

By registering an account with ah188 or continuing to use the platform after this policy has been made available to you, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any aspect of this policy, you should discontinue use of the platform and contact ah188 customer support to close your account.

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, the data controller — the entity that determines the purposes and means of processing your personal data — is:

ah188 has designated a Data Protection Officer (DPO) as required by the Data Privacy Act. The DPO is responsible for overseeing ah188's data protection strategy, ensuring compliance with RA 10173 and its implementing regulations, and serving as the point of contact for data subject rights requests and privacy-related inquiries from registered players.

ah188 collects the following categories of personal data, depending on the nature of your interaction with the platform:

3.1 Identity & Registration Data

• Full legal name as it appears on a Philippine government-issued identification document
• Date of birth (for mandatory age verification — minimum 21 years under PAGCOR regulations)
• Nationality and country of residence
• Government-issued ID type and reference number (submitted during KYC verification)
• Photograph or scanned image of government-issued identification (where required for KYC)

3.2 Contact Data

• Philippine mobile number (primary account identifier and OTP delivery channel)
• Email address (optional but recommended for account recovery)
• Residential address in the Philippines (required for full KYC tier)

3.3 Financial Data

• GCash account number or registered mobile number (for deposit and withdrawal processing)
• Maya account information where used as a payment method
• Philippine bank account details (BPI, BDO, Metrobank, or other banks) where used for transfers
• Transaction history: deposit amounts, withdrawal requests, dates, and payment method used
• Source of funds documentation (where requested for AML compliance)

3.4 Gaming & Behavioral Data

• Game session logs: games played, wager amounts, game outcomes, session duration, and session frequency
• Account login history: timestamps, device types, and approximate geographic location of login events
• Bonus and promotion utilization records
• Customer support interaction transcripts
• Responsible gaming limit settings and self-exclusion history

3.5 Technical Data

• IP address at time of login and account activity
• Device type, operating system, and browser type
• Cookies and similar tracking technology data (detailed in Section 11)
• Platform performance logs and error reports where these contain user-identifiable data

ah188 collects personal data through the following channels and methods:

• Direct collection at registration: Information you voluntarily provide when creating your ah188 account, including your mobile number, name, and date of birth.
• KYC verification submissions: Identity and address documentation submitted in connection with account verification requirements under PAGCOR regulations and the Anti-Money Laundering Act.
• Platform activity: Data generated automatically through your use of the ah188 platform, including game sessions, deposits, withdrawals, and customer support interactions.
• Payment processors: Financial data transmitted to ah188 by payment processing partners (GCash, Maya, BPI, BDO, Metrobank) in the course of processing your transactions.
• Cookies and device tracking: Technical data collected via cookies, web beacons, and device fingerprinting technologies as described in Section 11.
• Third-party identity verification services: Where ah188 uses third-party KYC verification providers to assist in document authentication, data may be received from those providers subject to their own data processing agreements with ah188.

ah188 processes your personal data for the following specific and documented purposes:

Under the Data Privacy Act of 2012, ah188 processes personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the gaming services contract between ah188 and the player — including account management, game provision, payment processing, and customer support.
• Legal obligation: Processing required for ah188 to comply with applicable Philippine law, including PAGCOR licensing requirements, the Anti-Money Laundering Act, the Data Privacy Act itself, and other regulatory obligations. This covers KYC verification, mandatory regulatory reporting, and age verification.
• Legitimate interests: Processing for purposes such as fraud prevention, platform security, responsible gaming monitoring, and platform analytics — where such interests are balanced against and do not override players' fundamental data privacy rights.
• Consent: Processing for marketing communications and optional data collection where no other legal basis applies. Consent is freely given, specific, informed, and revocable at any time.

ah188 does not sell your personal data to any third party. Personal data is shared only in the following specific and documented circumstances:

7.1 Payment Processors

Transaction data is shared with GCash, Maya, BPI, BDO, Metrobank, and other payment providers as necessary to process your deposits and withdrawals. These providers act as independent data controllers for their own platform data and are subject to their own privacy policies and Philippine BSP regulatory oversight.

7.2 PAGCOR and Regulatory Authorities

ah188 is legally obligated to share player account data and gaming transaction records with PAGCOR as part of our licensing obligations. Additionally, ah188 will disclose data to the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Bureau of Internal Revenue (BIR), and any other competent Philippine authority where required by law or valid legal process.

7.3 KYC and Identity Verification Providers

ah188 may use third-party identity verification service providers to assist in KYC document authentication. These providers process data under strict contractual data processing agreements that require them to handle data in compliance with RA 10173.

7.4 Game Content Providers

Certain aggregate and anonymized gaming data may be shared with licensed game content providers (slot, live casino, and other game studios) for the purpose of platform integration and game performance reporting. No personally identifiable data is shared with game providers beyond what is technically necessary for game session management.

7.5 Legal Proceedings

ah188 may disclose personal data to legal advisors, courts, or law enforcement agencies where required in connection with legal proceedings, the enforcement of our Terms & Conditions, or the protection of ah188's legal rights and those of our players.

Where ah188 engages service providers — such as gaming software providers, cloud infrastructure providers, or specialized technology vendors — who process data outside the Philippines, such transfers are conducted only where:

• The recipient country or organization affords a level of data protection recognized as adequate by the National Privacy Commission; or
• ah188 has implemented appropriate contractual safeguards, such as NPC-approved standard contractual clauses in data processing agreements with the receiving entity; or
• The transfer is expressly required for the performance of a contract between ah188 and the player, or is necessary for the establishment, exercise, or defense of legal claims.

Players who wish to know whether their data is being processed in a specific jurisdiction may submit an inquiry to ah188's Data Protection Officer.

ah188 retains personal data for no longer than is necessary for the purpose for which it was collected, subject to the following retention schedule:

After the applicable retention period expires, personal data is securely deleted or anonymized so that it can no longer be associated with an identifiable individual.

ah188 implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, and unlawful disclosure. These measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and ah188 servers is encrypted using industry-standard 256-bit SSL/TLS encryption, indicated by the padlock icon and "https://" in your browser's address bar.
• At-rest encryption: Sensitive data stored in ah188's databases — including passwords (hashed and salted) and financial account details — is encrypted at rest using AES-256 encryption or equivalent standards.
• Access controls: Access to player personal data within ah188's systems is restricted to authorized personnel on a strict need-to-know basis, with access logging and regular privilege reviews.
• Two-factor authentication: ah188 offers optional SMS-based two-factor authentication (2FA) for player accounts and requires 2FA for internal staff accessing player data systems.
• Penetration testing: ah188's platform infrastructure undergoes periodic security assessments and penetration testing conducted by qualified security professionals.
• Incident response: ah188 maintains a documented data breach response procedure compliant with the NPC's 72-hour notification requirement under the Data Privacy Act.

ah188 uses cookies and similar technologies on the ah188.app website to enable core platform functionality, improve performance, and — where you have provided consent — deliver relevant promotional content.

11.1 Types of Cookies Used

• Strictly necessary cookies: Required for fundamental platform functions such as maintaining your login session, processing transactions, and security verification. These cannot be disabled without preventing you from using the platform.
• Performance and analytics cookies: Collect aggregate, anonymized information about how players navigate and use the platform to enable ongoing platform improvements. Used only with consent.
• Functional cookies: Remember your platform preferences, such as language settings, previously selected game categories, and responsible gaming limit settings, to provide a more personalized experience.
• Marketing and targeting cookies: Used, where consent is provided, to display relevant promotional offers based on your gaming activity and preferences. These do not track your activity outside the ah188 platform.

11.2 Cookie Management

On your first visit to ah188.app, you will be presented with a cookie consent notice allowing you to accept, decline, or customize non-essential cookies. You may change your cookie preferences at any time through the Cookie Settings option in the platform footer. Note that disabling strictly necessary cookies will impair your ability to use the platform.

Under the Data Privacy Act of 2012, registered players — as data subjects — hold the following rights with respect to their personal data processed by ah188. These rights may be exercised by contacting ah188's Data Protection Officer as described in Section 15.

The ah188 platform is strictly intended for adults aged 21 years and above, as required by PAGCOR's minimum age regulations for real-money gaming in the Philippines. ah188 does not knowingly collect personal data from individuals under 21 years of age.

If ah188 becomes aware that personal data has been collected from an individual under 21, the account will be immediately closed, the data will be securely deleted (subject to any retention obligations arising from the regulatory requirement to report underage access to PAGCOR), and the matter will be reported to PAGCOR in compliance with our licensing obligations.

If a parent or guardian believes that their child under 21 has registered or attempted to register on ah188, they should contact ah188 customer support immediately via 24/7 live chat so that the account can be closed and data addressed accordingly.

ah188 may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable Philippine law or NPC guidance, or changes to PAGCOR's data protection requirements for licensed operators.

Material changes — those that substantively affect player data rights or the ways in which personal data is processed — will be communicated to registered players via SMS notification to their registered mobile number and/or a prominent notice on the ah188 platform at least fourteen (14) days before the change takes effect.

Minor updates such as typographic corrections, clarifications of existing language, or updates to contact details may be made without advance notification. The "Last Updated" date at the top of this policy will always reflect the date of the most recent revision.

Archived versions of this Privacy Policy are available upon written request to ah188's Data Protection Officer.

For any questions, requests, or concerns related to this Privacy Policy, the exercise of your data subject rights, or ah188's data protection practices generally, you may contact ah188's Data Protection Officer through the following channels:

• 24/7 Live Chat: Available directly on the ah188 platform. The fastest channel for most player inquiries and data subject rights requests.
• Email (DPO): [email protected] — please include "Data Privacy Request" in the subject line for routing to the DPO team. Responses within 5 business days for written requests, and within 15 days for formal data subject rights requests as required by RA 10173.

Players who are dissatisfied with ah188's response to a data privacy concern have the right to escalate the matter to the National Privacy Commission of the Philippines (NPC), the supervisory authority responsible for enforcing RA 10173. NPC contact information is publicly available at the NPC's official government website.