ah999 Privacy Policy

1.1 ah999 operates the online gaming and sports betting platform accessible at ah999.win, serving Filipino players across the Philippines including Metro Manila, Cebu, Davao, Quezon City, and beyond. In the course of providing these services, ah999 necessarily collects and processes personal information relating to its players and visitors.

1.2 ah999 is committed to handling personal data responsibly, transparently, and in full compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines, its Implementing Rules and Regulations, and all applicable issuances from the National Privacy Commission (NPC). Where operations extend to other jurisdictions, ah999 also complies with applicable data protection legislation in those jurisdictions.

1.3 This Privacy Policy is intended to provide clear, honest information about our data practices. If anything in this document is unclear, or if you have specific questions about how your personal data is handled, you are encouraged to contact ah999's Data Privacy Officer using the contact details in Section 15.

1.4 This Privacy Policy should be read alongside ah999's Terms and Conditions and Responsible Gaming Policy, which together govern the overall relationship between ah999 and its players.

2.1 For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, ah999 acts as the Personal Information Controller in respect of personal data collected through the ah999.win platform and associated services.

2.2 ah999 determines the purposes and means by which personal data collected from players and visitors is processed. Where third-party service providers process personal data on behalf of ah999 — such as payment processors, identity verification services, and cloud infrastructure providers — they do so as Personal Information Processors acting under written contracts that impose appropriate data protection obligations.

2.3 ah999 has designated a Data Privacy Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection law. Contact details for the DPO are provided in Section 15.

3.1 The categories of personal data ah999 collects from players and visitors are set out in the table below. Not all categories are collected from every individual — the data collected depends on your relationship with ah999 and the services you use.

3.2 ah999 does not collect sensitive personal information as defined under the Data Privacy Act (such as racial or ethnic origin, political opinions, religious beliefs, or health information) unless strictly required for a specific regulatory purpose, in which case explicit separate consent will be obtained.

4.1 ah999 collects personal data through the following means:

• Information you provide when registering an account on ah999.win;
• Identity and financial documents submitted during KYC verification;
• Information you provide when contacting ah999 customer support via live chat or email;
• Responses to surveys, feedback forms, or promotional participation where applicable.

• Technical and usage data collected automatically when you access the platform, including via cookies and similar tracking technologies (see Section 12);
• Transaction logs generated by your deposit, withdrawal, and wagering activity;
• Security monitoring logs, including login records and IP address history.

• Identity and fraud verification data from authorised identity verification service providers;
• Transaction confirmation data from payment processors including GCash, Maya, and Philippine banking networks;
• Regulatory watchlist screening data required for Anti-Money Laundering (AML) compliance.

5.1 ah999 uses the personal data it collects for the following purposes:

5.2 ah999 will not use your personal data for purposes that are incompatible with those listed above without providing prior notice and, where required, obtaining your consent.

6.1 Under the Data Privacy Act of 2012, ah999 relies on the following lawful bases for processing personal data:

• Contractual necessity: Processing required to fulfill the agreement between ah999 and the player — including account creation, payment processing, and service delivery;
• Legal obligation: Processing required to comply with applicable law, including PAGCOR licensing requirements, Anti-Money Laundering Act obligations (Republic Act No. 9160 as amended), and the Data Privacy Act itself;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where these interests are not overridden by the data subject's rights;
• Consent: Processing for marketing communications, where you have explicitly opted in. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before withdrawal.

7.1 ah999 does not sell personal data to third parties. Personal data may be disclosed to the following categories of recipients only to the extent necessary for the purposes described in this Policy:

• Payment processors: GCash (G-Xchange, Inc.), Maya (PayMaya Philippines, Inc.), BPI, BDO, Metrobank, InstaPay/PesoNet networks, and 7-Eleven CLiQQ — to facilitate deposits and withdrawals;
• Identity verification providers: Third-party KYC and document verification services used to confirm player identity and comply with PAGCOR and AML requirements;
• Cloud and infrastructure providers: Technology providers who host ah999's platform infrastructure, subject to data processing agreements;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other competent Philippine authorities where disclosure is required by law or regulatory order;
• Law enforcement: Philippine law enforcement agencies where ah999 is legally required to disclose information in connection with criminal investigations;
• Professional advisors: Legal, compliance, and audit professionals bound by professional confidentiality obligations.

8.1 In the course of providing its services, ah999 may transfer personal data to service providers and infrastructure systems located outside the Philippines — for example, cloud hosting services with data centres in other countries.

8.2 Where personal data is transferred outside the Philippines, ah999 ensures that appropriate safeguards are in place in accordance with the Data Privacy Act and NPC regulations. These safeguards may include:

• Standard contractual clauses approved by the National Privacy Commission;
• Transfers to jurisdictions that the NPC has determined provide an adequate level of data protection;
• Binding corporate rules where transfers are within a corporate group.

8.3 You may request information about the specific safeguards applied to international transfers of your personal data by contacting the ah999 Data Privacy Officer.

9.1 ah999 retains personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulation. The key retention periods applied by ah999 are:

• Active account data: Retained for the duration of your account relationship with ah999 and for a period of at least five (5) years following account closure, as required for AML compliance and regulatory audit purposes;
• Transaction records: Retained for a minimum of five (5) years following each transaction, in compliance with the Anti-Money Laundering Act;
• KYC documents: Retained for five (5) years following the end of the business relationship, or longer where required by PAGCOR or the AMLC;
• Customer support records: Retained for three (3) years following the resolution of the support interaction;
• Technical and usage logs: Retained for twelve (12) months unless retained longer for fraud investigation or regulatory purposes;
• Marketing data: Retained until you withdraw consent or opt out of communications.

9.2 Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with ah999's data disposal procedures.

10.1 ah999 implements technical, organisational, and administrative security measures designed to protect personal data against unauthorised access, disclosure, alteration, destruction, or loss. These measures include:

• TLS 1.3 encryption for all data transmitted between your device and ah999's servers;
• Encryption of sensitive data at rest within ah999's database infrastructure;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication requirements for internal system access;
• Regular security audits and penetration testing by independent third parties;
• Incident response procedures to detect, contain, and report data security incidents in accordance with NPC notification requirements.

10.2 In the event of a personal data breach that is likely to result in harm to affected data subjects, ah999 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected individuals as required by the Data Privacy Act and NPC Circular No. 16-03.

11.1 As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by ah999. These rights may be exercised by contacting the ah999 Data Privacy Officer using the details in Section 15.

11.2 ah999 will respond to rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, with notification to the data subject. No fee is charged for exercising these rights unless requests are manifestly unfounded or excessive, in which case a reasonable administrative fee may apply.

12.1 ah999 uses cookies and similar tracking technologies on the ah999.win platform. Cookies are small text files stored on your device that allow the platform to recognise your browser and remember information about your visit.

12.2 The categories of cookies used by ah999 are:

• Strictly necessary cookies: Essential for the platform to function — including session management, security, and login persistence. These cannot be disabled without affecting platform functionality;
• Functional cookies: Remember your preferences (such as language and game settings) to personalise your experience;
• Analytics cookies: Collect anonymised data about how the platform is used to help ah999 improve performance and game library relevance;
• Security cookies: Used to detect fraudulent logins, unusual session behaviour, and bot activity.

12.3 ah999 does not use third-party advertising cookies or allow advertising networks to place tracking cookies on the platform without your explicit consent.

12.4 You can control cookie settings through your browser — most modern browsers allow you to view, delete, and block cookies. Note that disabling certain cookies may impair the functionality of the ah999 platform.

13.1 If you are a parent or guardian and believe that your child under 21 has registered an account on ah999 or provided personal data to the platform, please contact the ah999 Data Privacy Officer immediately at [email protected] so that appropriate action can be taken.

13.2 Age verification is conducted during the account registration and KYC process. Any account where age verification cannot be satisfactorily completed will be suspended pending resolution.

14.1 ah999 may update this Privacy Policy from time to time to reflect changes in our data practices, regulatory requirements, or platform features. Material changes will be communicated to registered players via email or in-platform notification prior to the effective date of the change.

14.2 The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. We encourage you to review this Policy periodically to stay informed about how ah999 handles your personal data.

14.3 Your continued use of the ah999 platform after any update to this Privacy Policy constitutes your acknowledgment of the changes and, where applicable, your consent to the updated processing practices. If you do not agree to a material change, you should cease using the platform and contact ah999 to close your account.

15.1 If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by ah999, you may contact the ah999 Data Privacy Officer through the following channels:

15.2 If you are not satisfied with ah999's response to your data privacy request or complaint, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines. The NPC can be reached through their official government channels.