sagili Privacy Policy —
Your Data, Protected

sagili respects the privacy of all players, visitors, and users of our Platform. We are committed to handling your personal information with transparency, integrity, and in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations ("IRR"), and all relevant issuances of the National Privacy Commission ("NPC").

This Policy describes the types of personal data sagili collects, the purposes for which that data is used, the parties with whom it may be shared, the measures we take to protect it, how long we retain it, and the rights available to you as a data subject under Philippine law. Please read this Policy carefully alongside sagili's Terms & Conditions.

By registering for a sagili account or using any part of the sagili Platform, you confirm that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

For the purposes of the Philippine Data Privacy Act of 2012, sagili is the personal information controller responsible for the personal data collected through the sagili Platform. sagili determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data privacy laws.

sagili operates under the regulatory oversight of PAGCOR (Philippine Amusement and Gaming Corporation) and is subject to all applicable PAGCOR data handling and player information requirements in addition to the DPA.

sagili collects the following categories of personal data from players and Platform visitors:

sagili does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA (such as health data, racial or ethnic origin, religious beliefs, or political affiliations) unless specifically required by applicable law or PAGCOR regulation. Where such data is collected, explicit consent will be sought from the data subject.

sagili collects personal data through the following means:

• Direct collection: Information you provide when registering for a sagili account, completing KYC verification, making deposits or withdrawal requests, contacting support, or participating in promotions.
• Automated collection: Technical and usage data collected automatically when you access the sagili Platform, including through cookies, web beacons, log files, and similar technologies.
• Third-party sources: Identity verification and fraud prevention data from licensed KYC/AML service providers; payment confirmation data from payment processors including GCash, PayMaya, and Philippine banks; geolocation data from IP resolution services.
• Regulatory sources: Information received from PAGCOR or other Philippine regulatory authorities in connection with player verification or compliance requirements.

sagili processes your personal data for the following purposes:

• Account registration and management: To create and maintain your sagili account, verify your identity and eligibility, and manage your account settings and preferences.
• Gaming services: To enable your participation in games, process bets and wagers, calculate and credit winnings, and maintain your game history.
• Financial transactions: To process deposits and withdrawals in PHP via GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment methods; to detect and prevent fraudulent transactions.
• Legal and regulatory compliance: To comply with PAGCOR regulations, anti-money laundering (AML) obligations under the Anti-Money Laundering Act (AMLA) and its amendments, KYC requirements, and other applicable Philippine laws.
• Responsible gaming: To monitor gaming activity for signs of problem gambling, enforce self-exclusion requests, and comply with PAGCOR's responsible gaming mandate.
• Customer support: To respond to your enquiries, resolve complaints, and provide technical assistance.
• Platform improvement: To analyse usage patterns, diagnose technical issues, and improve the functionality and user experience of the sagili Platform.
• Marketing communications: To send promotional offers, newsletters, and updates about sagili — only where you have provided consent or where permitted by applicable law. You may opt out of marketing communications at any time through your account settings.
• Security: To detect, investigate, and prevent fraud, cheating, collusion, money laundering, and other illegal or prohibited activity on the sagili Platform.

sagili processes your personal data on one or more of the following legal bases as provided under the Philippine Data Privacy Act of 2012:

• Consent (Section 12(a) DPA): Where you have given specific, freely given, informed, and unambiguous consent to the processing of your personal data — for example, for marketing communications or non-essential cookies.
• Contract performance (Section 12(b) DPA): Where processing is necessary for the performance of the contract between you and sagili, including account management, processing of bets, and payment processing.
• Legal obligation (Section 12(c) DPA): Where processing is required for sagili to comply with applicable Philippine laws and regulations, including PAGCOR licensing conditions, AMLA obligations, and NPC requirements.
• Legitimate interests (Section 12(f) DPA): Where processing is necessary for the purposes of the legitimate interests of sagili, including fraud prevention, platform security, and business analytics — provided such interests are not overridden by your rights and freedoms.

sagili may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• PAGCOR and Philippine regulatory authorities: sagili is legally obligated to report certain player data to PAGCOR and to cooperate with investigations by law enforcement and other competent Philippine authorities.
• Anti-Money Laundering Council (AMLC): Transaction data and suspicious activity reports may be submitted to the AMLC as required under the Anti-Money Laundering Act and its amendments.
• Payment processors: Financial data necessary to process deposits and withdrawals is shared with licensed payment service providers including GCash, PayMaya, BPI, BDO, and Metrobank.
• KYC/AML service providers: Identity verification data may be shared with licensed third-party KYC providers to facilitate player verification in compliance with PAGCOR requirements.
• Game providers: Limited technical data necessary to deliver licensed game content may be shared with sagili's game studio partners, including session tokens and game configuration data.
• IT and infrastructure providers: Data may be processed by third-party hosting, analytics, and security service providers acting as personal information processors under sagili's instructions, pursuant to appropriate data processing agreements.

sagili retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and PAGCOR regulations. The following general retention periods apply:

Following the expiry of applicable retention periods, sagili will securely delete or anonymise personal data in accordance with its internal data disposal procedures.

sagili implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• TLS encryption for all data transmitted between your device and sagili's servers.
• AES-256 encryption for personal and financial data stored at rest.
• Multi-factor authentication (MFA) options for player accounts.
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis, with full audit trails.
• Regular internal and third-party security audits and penetration testing.
• Incident response procedures compliant with NPC data breach notification requirements.

Despite sagili's best efforts, no security system is impenetrable. In the event of a personal data breach that is likely to harm your rights and freedoms, sagili will notify affected data subjects and the National Privacy Commission within the timeframes required under the DPA.

sagili uses cookies, web beacons, and similar tracking technologies on the Platform to improve your experience and enable core platform functionality. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function correctly, including session management, authentication, and security features. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, display preferences, and previously used payment methods.
• Analytics cookies: Used to collect anonymised or aggregated data about how players use the sagili Platform, helping us identify areas for improvement. These are only placed with your consent.
• Security and fraud prevention cookies: Used to detect and prevent fraudulent access attempts, bot activity, and account takeover attempts.

You can manage or delete cookies through your browser settings. Note that disabling strictly necessary cookies will affect your ability to use the sagili Platform. For further information on managing cookies, refer to your browser's help documentation.

Under the Philippine Data Privacy Act of 2012 and its IRR, you have the following rights with respect to your personal data held by sagili:

• Right to be informed: The right to be notified of how your personal data is collected, used, and processed, as described in this Policy.
• Right of access: The right to request a copy of the personal data sagili holds about you, along with information about how it is processed.
• Right to rectification: The right to request correction of inaccurate or incomplete personal data without undue delay.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to sagili's legal retention obligations.
• Right to object: The right to object to processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to file a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe sagili has violated your data privacy rights.

To exercise any of these rights, please submit a written request to sagili's Data Protection Officer using the contact details in Section 14. sagili will respond to verified data subject requests within the timeframes required under the DPA. Identity verification may be required before a request is processed.

The sagili Platform is strictly restricted to individuals aged 21 years and above as required by Philippine law and PAGCOR regulations. sagili does not knowingly collect personal data from individuals under the age of 21.

If sagili discovers or has reason to believe that personal data has been collected from a person under 21 years of age, sagili will immediately close the associated account, delete the collected data where legally permissible, and forfeit any associated balance in accordance with applicable PAGCOR guidelines.

If you are a parent or guardian and believe that your child under the age of 21 has registered on sagili, please contact our Data Protection Officer immediately using the contact details in Section 14.

sagili reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR requirements, or NPC guidance. The date of the most recent revision is displayed at the top of this page.

Where changes are material, sagili will provide notice to registered players via email or prominent notice on the Platform prior to the changes taking effect. Your continued use of the sagili Platform after the effective date of any amended Policy constitutes your acceptance of the updated terms.

sagili recommends that you review this Privacy Policy periodically to stay informed about how your personal data is being protected.

For any questions, requests, or complaints relating to this Privacy Policy or sagili's data processing practices, please contact sagili's Data Protection Officer using the details below. All data subject access requests, rectification requests, and privacy complaints should be directed to the DPO in writing.