Privacy Policy — panalo Online Casino Philippines

1 Introduction

This Privacy Policy ("Policy") is issued by panalo ("panalo," "we," "us," or "our"), the operator of the online gaming and sports betting platform accessible at panalo.onl. panalo is licensed and regulated by the Philippine Amusement and Gaming Corporation ("PAGCOR") and operates in compliance with the Republic Act No. 10173, known as the Data Privacy Act of 2012 ("DPA"), and its implementing rules and regulations as administered by the National Privacy Commission ("NPC") of the Philippines.

This Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal information that panalo processes in connection with the operation of the panalo platform and the provision of online gaming services to registered players and visitors located in the Philippines and elsewhere.

By registering a panalo account, accessing the panalo platform, or otherwise providing personal information to panalo, you acknowledge that you have read, understood, and consent to the data processing practices described in this Policy. If you do not agree with this Policy, you must not register an account or use the panalo platform.

2 Personal Information We Collect

panalo collects personal information through multiple channels, including account registration, identity verification, use of platform services, payment processing, and communications with panalo's support team. The categories of personal information we collect are described below.

2.1 Information You Provide Directly

2.2 Information Collected Automatically

When you access and use the panalo platform, we automatically collect certain technical and behavioral data, including:

• Device and Technical Data: IP address, device type and model, operating system, browser type and version, screen resolution, and mobile network operator (e.g., Globe, Smart, DITO);
• Usage Data: Pages viewed, games played, bet amounts, game outcomes, session duration, login timestamps, and navigation paths within the panalo platform;
• Location Data: General geolocation derived from your IP address, used to verify compliance with jurisdictional access requirements;
• Cookie Data: Data collected via cookies and similar tracking technologies as described in Section 8 of this Policy.

3 How panalo Uses Your Personal Information

panalo processes your personal information for the following purposes:

• Account Management: To create, maintain, and manage your panalo player account, including authentication, account security, and communications relating to your account;
• Identity Verification (KYC): To verify your age (21+ requirement), identity, and eligibility to use panalo in compliance with PAGCOR licensing requirements and Philippine Anti-Money Laundering Act (AMLA) obligations;
• Payment Processing: To process deposits via GCash, PayMaya, BDO, BPI, and Metrobank, and to process withdrawal requests to your registered Philippine payment accounts;
• Game Provision: To deliver online gaming services, record game outcomes, manage game histories, calculate and credit winnings, and resolve disputes relating to specific game rounds;
• Responsible Gaming: To implement and enforce responsible gaming tools including deposit limits, self-exclusion requests, and session monitoring as required by PAGCOR's responsible gaming framework;
• Security and Fraud Prevention: To detect, investigate, and prevent fraud, money laundering, unauthorized account access, and other prohibited activities;
• Legal Compliance: To comply with PAGCOR regulatory reporting requirements, NPC data breach notification obligations, court orders, and other applicable Philippine legal and regulatory requirements;
• Customer Support: To respond to your inquiries, complaints, and support requests and to maintain records of support interactions;
• Platform Improvement: To analyze aggregated usage data for the purpose of improving panalo platform features, game selection, and user experience;
• Marketing Communications: To send you promotional communications about panalo bonuses, new games, and events, where you have consented to receive such communications and have not subsequently withdrawn that consent.

4 Legal Basis for Processing

panalo processes your personal information under the following legal bases as recognized under the Data Privacy Act of 2012 and its implementing rules:

• Contractual Necessity: Processing necessary for the performance of the contract between you and panalo (the panalo Terms and Conditions), including account creation, game provision, payment processing, and customer support;
• Legal Obligation: Processing required for panalo to comply with applicable Philippine law, including PAGCOR licensing conditions, AMLA reporting obligations, NPC requirements, and other statutory requirements;
• Legitimate Interest: Processing necessary for the legitimate interests of panalo, including fraud prevention, platform security, and improvement of services, where such interests are not overridden by your rights and interests;
• Consent: Processing based on your freely given, specific, and informed consent, including for marketing communications and for any processing not otherwise covered by the above bases. You may withdraw consent at any time without prejudice to the lawfulness of processing based on consent prior to its withdrawal.

5 Data Sharing and Disclosure

panalo does not sell, rent, or trade your personal information to third parties for commercial purposes. panalo may share your personal information in the following limited circumstances:

• PAGCOR and Philippine Regulatory Authorities: panalo is required to provide player data, transaction records, and other information to PAGCOR as a condition of its operating license. We may also be required to disclose information to the Anti-Money Laundering Council (AMLC), the NPC, and other Philippine government agencies upon lawful demand;
• Payment Service Providers: We share necessary financial data with GCash (G-Xchange Inc.), Maya Philippines Inc. (PayMaya), and Philippine banking institutions solely for the purpose of processing deposits and withdrawals to and from your panalo account;
• Identity Verification Providers: We engage licensed KYC service providers to assist with identity document verification and face-matching as required by PAGCOR. These providers process your government ID data solely for the purposes of identity verification;
• Game Software Providers: Game outcome data may be shared with third-party game software providers (including JILI Games and other licensed providers) for auditing, dispute resolution, and technical support purposes, in accordance with their applicable data processing agreements with panalo;
• Legal Proceedings: We may disclose personal information to courts, law enforcement, and legal advisers in connection with legal proceedings, the exercise or defence of legal claims, or compliance with court orders;
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of panalo's assets, your personal information may be transferred to a successor entity, subject to equivalent privacy protections.

All third parties with whom panalo shares personal data are required by contract to process that data only for specified purposes and in accordance with applicable Philippine data privacy law.

6 Data Retention

panalo retains personal information only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. The general retention principles applied by panalo are as follows:

• Active Accounts: Personal information associated with active panalo accounts is retained for the duration of the account relationship;
• Closed Accounts: Following closure of a panalo account, we retain identity, financial, and transaction records for a minimum of five (5) years in compliance with PAGCOR licensing requirements and AMLA record-keeping obligations;
• Marketing Consent Records: Records of marketing consent and opt-out requests are retained for a period sufficient to demonstrate compliance with consent requirements;
• Support Records: Customer support interaction records are retained for a period of three (3) years following resolution of the relevant matter;
• Technical Logs: Server logs and technical access records are retained for a maximum of twelve (12) months unless extended retention is required for security investigation or legal proceedings.

Upon expiry of the applicable retention period, personal information will be securely deleted or irreversibly anonymized.

7 Data Security

panalo implements technical and organizational security measures designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL encryption and TLS 1.3 protocol for all data transmitted between your device and panalo's servers;
• Cryptographic hashing of all account passwords — panalo does not store passwords in recoverable plain-text format;
• Access controls ensuring that panalo personnel access personal data only on a strict need-to-know basis, with access logging and audit trails;
• Segregation of player funds from panalo operating funds in accordance with PAGCOR requirements;
• Regular security assessments and penetration testing of panalo's platform infrastructure;
• Optional two-factor authentication (2FA) for player accounts, with SMS OTP delivery to registered Philippine mobile numbers.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, panalo will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the DPA's breach notification requirements.

8 Cookies and Tracking Technologies

panalo uses cookies and similar tracking technologies on the panalo platform. Cookies are small text files placed on your device that help panalo deliver a functional, personalized, and secure platform experience. The categories of cookies used by panalo are:

• Strictly Necessary Cookies: Required for the panalo platform to function, including session management, login authentication, and security features. These cookies cannot be disabled without impairing core platform functionality;
• Performance and Analytics Cookies: Used to collect aggregated, anonymized data about how players use the panalo platform, including pages visited and time spent. This data helps panalo improve platform performance and user experience;
• Functional Cookies: Used to remember your preferences, such as language settings and game display preferences, to deliver a more personalized experience;
• Marketing Cookies: Used, where you have consented, to deliver relevant panalo promotional communications and to measure the effectiveness of panalo's marketing activities. These cookies do not track you across third-party websites.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the panalo platform. Disabling other cookie categories will not prevent you from using panalo but may affect the personalization and performance of your experience.

9 Your Data Privacy Rights

As a data subject under the Data Privacy Act of 2012, you hold the following rights with respect to your personal information processed by panalo:

• Right to Be Informed: The right to be informed about panalo's data processing practices, as provided in this Policy;
• Right to Access: The right to request a copy of the personal information panalo holds about you, together with information about how it is processed;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal information;
• Right to Erasure or Blocking: The right to request deletion or blocking of personal information where processing is unlawful or the data is no longer necessary for the purposes for which it was collected, subject to panalo's legal retention obligations;
• Right to Object: The right to object to the processing of your personal information based on legitimate interests, in particular with respect to direct marketing;
• Right to Data Portability: The right to receive your personal information in a structured, commonly used, and machine-readable format where processing is carried out by automated means;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph if you believe panalo has breached your data privacy rights.

To exercise any of these rights, please submit a written request to panalo's Data Protection Officer at the contact details set out in Section 13. panalo will respond to all data subject rights requests within thirty (30) days of receipt, in accordance with the DPA's response timelines. Requests may require identity verification before panalo can process them.

10 Children's Privacy

panalo's services are strictly restricted to persons aged 21 years or older, in compliance with PAGCOR regulations. panalo does not knowingly collect personal information from any individual under the age of 21. If panalo discovers or has reason to believe that it has collected personal information from a person under the age of 21, panalo will immediately suspend the associated account, void any associated transactions, and permanently delete the personal information collected, subject to any overriding legal retention requirements.

If you are a parent or guardian and believe that a person under 21 has provided personal information to panalo, please contact panalo immediately at [email protected] so that appropriate action can be taken.

11 Cross-Border Data Transfers

panalo primarily processes and stores personal information on servers located within the Philippines. Where it is necessary to transfer personal information to service providers or processors located outside the Philippines — for example, certain game software providers or cloud infrastructure providers — panalo will ensure that such transfers are effected only to countries or organizations that provide an adequate level of data protection comparable to the standards of the DPA, or pursuant to contractual arrangements that impose equivalent data protection obligations on the recipient.

Cross-border data transfers by panalo are subject to the NPC's rules on cross-border data flow and will only occur where a valid lawful basis for the transfer exists.

12 Amendments to This Policy

panalo reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, PAGCOR regulatory requirements, NPC guidance, or panalo's data processing practices. Where amendments are material, panalo will notify registered players via their registered email address or through a prominent notice on the panalo platform at least fourteen (14) days before the amended Policy takes effect.

Your continued use of panalo following the effective date of any amendment constitutes your acceptance of the amended Policy. The "Last Updated" date at the top of this page will always reflect the most recent revision. If you do not agree with any amendment, you must discontinue use of panalo and may request account closure in accordance with the Terms and Conditions.

13 Contact Information and Data Protection Officer

For all data privacy enquiries, requests to exercise data subject rights, or complaints relating to panalo's personal data processing practices, please contact panalo's Data Protection Officer:

• Data Protection Officer, panalo
• Email: [email protected] (plain text — not a clickable link)
• Platform: panalo.onl
• NPC Registration: panalo is registered with the National Privacy Commission of the Philippines in accordance with NPC Circular 16-01.
• PAGCOR Regulatory Authority: Philippine Amusement and Gaming Corporation, Malate, Manila, Philippines

panalo will acknowledge all privacy requests within five (5) business days and will provide a substantive response within thirty (30) days of receipt, extendable by a further thirty (30) days where the complexity or volume of requests reasonably requires it.