Privacy Policy

This Privacy Policy ("Policy") describes how xoplay.ph ("xoplay.ph," "we," "us," or "our") collects, processes, stores, and protects the personal data of individuals ("you," "your," or "User") who access or use the xoplay.ph online gaming platform, accessible at xoplayph.net (the "Platform").

xoplay.ph takes data privacy seriously. We recognize that Filipino players entrust us with sensitive personal and financial information when they register and play on our Platform, and we are committed to handling that information responsibly, securely, and in accordance with applicable Philippine law — particularly the Data Privacy Act of 2012 (RA 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

By accessing the xoplay.ph Platform, creating an account, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the xoplay.ph Platform.

xoplay.ph is the data controller responsible for the personal information collected through the Platform. As data controller, xoplay.ph determines the purposes and means of processing your personal data and is accountable for ensuring that such processing complies with the Data Privacy Act of 2012 and all applicable regulations.

xoplay.ph has designated a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and applicable data privacy laws. You may contact the DPO directly for any privacy-related concerns at the contact details provided in Section 14 of this Policy.

xoplay.ph collects only the personal data that is necessary for the purposes described in this Policy. The categories of personal data we collect include the following:

xoplay.ph does not collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. We do not collect information about your religious beliefs, political opinions, or health status unless you voluntarily provide such information in the context of a responsible gaming self-exclusion request.

xoplay.ph collects personal data through the following means:

• Direct Collection: When you register an account on xoplay.ph, complete KYC verification, make a deposit or withdrawal, contact our support team, or submit any form on the Platform, you directly provide us with personal data.
• Automated Collection: When you access and use the xoplay.ph Platform, we automatically collect technical and usage data through cookies, web beacons, server logs, and similar tracking technologies. See Section 10 for more details on our use of cookies.
• Third-Party Sources: We may receive personal data about you from third-party payment processors (such as GCash, PayMaya, BPI, BDO, and Metrobank) in connection with your financial transactions on the Platform. We may also receive data from identity verification service providers used to conduct KYC checks.
• Publicly Available Sources: In limited circumstances related to fraud prevention or regulatory compliance, xoplay.ph may collect data from publicly available sources, including government databases and public records.

xoplay.ph uses your personal data only for legitimate, specified purposes. The primary purposes for which we process your data are as follows:

• Account Registration and Management: To create and maintain your xoplay.ph account, verify your identity, and manage your account settings and preferences.
• Age Verification: To confirm that you are at least 21 years of age, as required under Philippine gaming regulations. xoplay.ph strictly enforces the 21+ age requirement and will not knowingly allow minors to register or play on the Platform.
• Payment Processing: To process your deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods.
• KYC and AML Compliance: To fulfill our Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations under Philippine law, including verification of your identity and the source of your funds where required.
• Game Provision and Platform Operation: To provide you with access to xoplay.ph's full game library — including slots, live casino, bingo, sports betting, esports wagering, and God Fish Slicing — and to ensure the Platform operates correctly and fairly.
• Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance.
• Responsible Gaming: To monitor your gaming activity for signs of problematic behavior and to administer responsible gaming tools such as deposit limits, session reminders, and self-exclusion requests.
• Marketing and Promotions: To send you information about xoplay.ph promotions, bonuses, and new game releases, where you have consented to receive such communications. You may opt out of marketing communications at any time.
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorized account access, and other security threats to the Platform and its users.
• Legal and Regulatory Compliance: To comply with applicable Philippine laws and regulations, including reporting obligations to PAGCOR and other relevant authorities.
• Platform Improvement: To analyze usage patterns and improve the xoplay.ph Platform's features, performance, and user experience.

Under the Data Privacy Act of 2012, xoplay.ph processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and xoplay.ph — specifically, to provide you with access to the Platform and its services, process your transactions, and manage your account.
• Legal Obligation: Processing is necessary to comply with xoplay.ph's legal obligations under Philippine law, including KYC, AML, and regulatory reporting requirements.
• Legitimate Interests: Processing is necessary for xoplay.ph's legitimate interests in operating a secure, fair, and commercially viable gaming platform — including fraud prevention, security monitoring, and Platform improvement — provided such interests are not overridden by your rights and interests.
• Consent: For certain processing activities — particularly direct marketing communications — xoplay.ph relies on your freely given, specific, and informed consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

xoplay.ph does not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and other payment service providers, to the extent necessary to process your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and identity verification service providers engaged by xoplay.ph to assist with regulatory compliance.
• Game Providers: Third-party game software providers whose games are available on the xoplay.ph Platform, where necessary for the provision of those games.
• Regulatory Authorities: PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other Philippine government agencies, where disclosure is required by law or regulation.
• Law Enforcement: Philippine law enforcement agencies, where disclosure is required by a valid court order, subpoena, or other legal process.
• IT and Security Service Providers: Third-party providers of hosting, cloud infrastructure, cybersecurity, and fraud detection services engaged by xoplay.ph to support Platform operations.
• Professional Advisors: Legal counsel, auditors, and other professional advisors engaged by xoplay.ph, subject to professional confidentiality obligations.

All third parties with whom xoplay.ph shares personal data are required to handle such data in accordance with applicable data privacy laws and are prohibited from using your data for any purpose other than the specific purpose for which it was shared.

xoplay.ph retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's active status on the xoplay.ph Platform.
• Transaction and Financial Records: Retained for a minimum of five (5) years following the date of the transaction, in compliance with Philippine AML regulations and PAGCOR requirements.
• KYC and Identity Verification Documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant KYC process, whichever is later.
• Customer Support Records: Retained for a minimum of two (2) years following the resolution of the relevant support interaction.
• Marketing Consent Records: Retained for the duration of your consent and for a reasonable period thereafter to demonstrate compliance.

Upon expiry of the applicable retention period, xoplay.ph will securely delete or anonymize your personal data in accordance with our internal data disposal procedures. Where anonymization is not technically feasible, data will be securely destroyed.

xoplay.ph implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the xoplay.ph Platform is encrypted using industry-standard 256-bit SSL/TLS protocols.
• Encrypted Data Storage: Sensitive personal and financial data stored on xoplay.ph servers is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to authorized xoplay.ph personnel and service providers on a strict need-to-know basis. All access is logged and audited.
• Two-Factor Authentication: xoplay.ph supports and encourages the use of two-factor authentication (2FA) for player accounts to provide an additional layer of security.
• Regular Security Audits: xoplay.ph conducts regular security assessments, penetration testing, and vulnerability scans to identify and remediate potential security weaknesses.
• Incident Response: xoplay.ph maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, xoplay.ph will notify the National Privacy Commission and affected users in accordance with the requirements of the Data Privacy Act of 2012.

xoplay.ph uses cookies and similar tracking technologies to enhance your experience on the Platform, analyze usage patterns, and support security and fraud prevention functions. A cookie is a small text file placed on your device when you visit the xoplay.ph Platform.

The types of cookies used by xoplay.ph include:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These cookies enable core features such as account login, session management, and security. They cannot be disabled without affecting Platform functionality.
• Performance and Analytics Cookies: Used to collect anonymized data about how users interact with the Platform, including pages visited, time spent, and error messages encountered. This data helps xoplay.ph improve Platform performance and user experience.
• Functional Cookies: Used to remember your preferences and settings, such as your preferred language, game display settings, and responsible gaming configurations.
• Security Cookies: Used to detect and prevent fraudulent activity, unauthorized access attempts, and other security threats to the Platform.

You may manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the xoplay.ph Platform. Strictly necessary and security cookies cannot be disabled as they are essential to Platform operation and your account security.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by xoplay.ph. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14.

• Right to Be Informed: You have the right to be informed about how xoplay.ph collects and processes your personal data — which is the primary purpose of this Privacy Policy.
• Right of Access: You have the right to request a copy of the personal data xoplay.ph holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data xoplay.ph holds about you.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to xoplay.ph's legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, subject to xoplay.ph's overriding legitimate grounds.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe xoplay.ph has processed your personal data in violation of the Data Privacy Act of 2012.

xoplay.ph will respond to all valid data privacy rights requests within fifteen (15) business days of receipt. In complex cases, this period may be extended by a further fifteen (15) business days, with prior notice to you.

The xoplay.ph Platform is strictly intended for individuals who are at least 21 years of age, in compliance with Philippine gaming regulations. xoplay.ph does not knowingly collect personal data from individuals under the age of 21.

During the registration process, xoplay.ph requires all applicants to confirm that they are at least 21 years old. xoplay.ph further verifies age through its KYC process, which requires submission of a valid Philippine government-issued ID showing the applicant's date of birth.

If xoplay.ph becomes aware that personal data has been collected from an individual under the age of 21, we will immediately suspend the relevant account, delete the personal data in question, and void any associated transactions. If you believe that a minor has registered on the xoplay.ph Platform, please contact us immediately at the details provided in Section 14.

xoplay.ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. When material changes are made to this Policy, xoplay.ph will notify registered players via email or a prominent notice on the Platform.

The updated Privacy Policy will display a revised "Last Updated" date at the top of this page. Your continued use of the xoplay.ph Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Policy periodically to stay informed of how xoplay.ph protects your personal data.

If you do not agree with any changes to this Privacy Policy, you must cease using the xoplay.ph Platform and may request account closure in accordance with the Terms & Conditions.

If you have any questions, concerns, or requests relating to this Privacy Policy or xoplay.ph's handling of your personal data, please contact our Data Protection Officer. We aim to respond to all privacy-related inquiries within five (5) business days.

You also have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated. The NPC can be reached through its official website at privacy.gov.ph.