aroonplay Privacy Policy

1.1 Scope. This Privacy Policy applies to all personal data processed by aroonplay in connection with: (a) the aroonplay website and all associated sub-pages; (b) the account registration and KYC process; (c) the use of any game, product, or service offered on the aroonplay platform; and (d) aroonplay's communications with registered Players and prospective users.

1.2 Data Controller. For the purposes of the Philippine Data Privacy Act of 2012 (R.A. 10173) and its Implementing Rules and Regulations, aroonplay is the personal information controller in respect of the personal data collected through the aroonplay platform. All enquiries regarding data privacy may be directed to aroonplay as set out in Section 14 of this Policy.

1.3 Agreement. By using the aroonplay platform, you acknowledge that you have read, understood, and consent to the data processing practices described in this Privacy Policy. If you do not consent, you should not register for or continue using aroonplay's services.

aroonplay collects personal data through three primary means: information you provide directly, information generated by your use of the platform, and information received from third parties in the course of identity verification and payment processing.

2.1 Data You Provide Directly. When registering for or using an aroonplay account, you may provide the following categories of personal data:

• Identity data: full legal name as it appears on your Philippine government-issued identification document;
• Contact data: registered Philippine mobile number (Globe, Smart, DITO, or MVNO), email address, and residential address;
• Date of birth: used to verify compliance with the 21+ age requirement;
• KYC documents: scanned or photographed copies of government-issued Philippine ID documents submitted for identity verification;
• Financial data: GCash account number, Maya account number, bank account details (account name, account number, bank name), or card details (processed exclusively by our PCI-DSS compliant payment processor — aroonplay does not store full card numbers);
• Account credentials: username or mobile number used as login identifier, and a cryptographic hash of your password (aroonplay never stores your password in plain text);
• Communications data: the content of any messages sent to aroonplay Support, including support ticket records.

2.2 Data Generated by Platform Use. When you use the aroonplay platform, the following data is automatically generated and collected:

• Transaction data: all deposits, withdrawals, wagers, game results, bonus claims, and account balance movements;
• Gaming behaviour data: game categories accessed, session duration, wagering patterns, and use of responsible gaming tools;
• Device and technical data: IP address, device type, operating system version, browser type and version, screen resolution, and mobile network carrier (Globe, Smart, etc.);
• Session data: login timestamps, session duration, logout method, and geographic region derived from IP address;
• Cookies and tracking data: as described in Section 9 of this Policy.

2.3 Data from Third Parties. aroonplay may receive personal data from third parties in limited circumstances:

• Identity verification providers: confirmation of identity document authenticity from third-party KYC service providers;
• Payment processors: transaction status confirmations from GCash, Maya, and banking partners — aroonplay does not receive your full financial account credentials from these providers;
• Fraud and AML screening services: risk scoring data from third-party fraud detection and Anti-Money Laundering screening tools, used to assess account risk in compliance with Philippine AML regulations.

aroonplay processes your personal data only where a lawful basis exists under the Data Privacy Act of 2012. The applicable lawful bases for aroonplay's processing activities are:

aroonplay uses the personal data collected for the following specific purposes:

5.1 General Principle. aroonplay does not sell, rent, or commercially transfer your personal data to any third party for that third party's own marketing or commercial purposes. Personal data is shared with third parties only in the specific circumstances described in this Section.

5.2 Service Providers (Data Processors). aroonplay engages carefully selected third-party service providers — known as data processors — who process personal data on aroonplay's behalf and under aroonplay's instructions. These include:

• Payment processors: GCash (Mynt/Globe Fintech Innovations), Maya (Voyager Innovations / PayMaya Philippines), BPI, BDO, Metrobank, and Visa/Mastercard processing partners, for the sole purpose of executing deposits and withdrawals in Philippine Peso;
• KYC verification providers: identity document verification services used to validate Philippine government-issued identification documents during the KYC process;
• Cloud hosting and infrastructure providers: aroonplay's platform infrastructure and data storage operate on servers hosted by certified cloud providers with appropriate data processing agreements;
• Game content providers: licensed game studios and live dealer providers whose game software is integrated into the aroonplay platform — these providers process technical game event data but do not receive your personal identity data;
• Fraud and AML screening services: transaction monitoring and risk assessment platforms used in compliance with Philippine AML obligations.

5.3 Regulatory and Law Enforcement Disclosure. aroonplay may disclose personal data to: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), Philippine courts, law enforcement agencies, or other government bodies where aroonplay is legally required to do so, or where aroonplay has a good-faith belief that disclosure is necessary to comply with a legal obligation, enforce its Terms and Conditions, or protect the rights, safety, or property of aroonplay, its players, or the public.

5.4 Business Transfers. In the event of a merger, acquisition, reorganisation, or sale of aroonplay's business or assets, your personal data may be transferred to the acquiring entity, subject to that entity assuming aroonplay's data privacy obligations under this Policy and applicable Philippine law.

6.1 Retention Periods. aroonplay retains personal data for as long as necessary to fulfil the purposes described in this Policy, and in accordance with the minimum retention periods mandated by applicable Philippine law:

• Account and identity data (including KYC documents): retained for a minimum of five (5) years following account closure, as required under PAGCOR regulations and Philippine AML legislation;
• Transaction records: retained for a minimum of five (5) years from the date of the transaction, in compliance with AMLC record-keeping requirements;
• Gaming session logs and bet history: retained for a minimum of three (3) years for dispute resolution and regulatory audit purposes;
• Support communications: retained for three (3) years from the date of the last communication in a ticket thread;
• Marketing consent records: retained for as long as the consent is active plus two (2) years after consent withdrawal, to demonstrate compliance.

6.2 Deletion and Anonymisation. Upon expiry of applicable retention periods, personal data will be securely deleted or irreversibly anonymised. Anonymised data — which can no longer identify you — may be retained indefinitely for statistical and analytical purposes without restriction.

7.1 Technical Measures. aroonplay implements the following technical security measures to protect your personal data:

• TLS 1.2 or higher encryption for all data in transit between your device and aroonplay's servers;
• AES-256 encryption for sensitive personal data and KYC documents stored at rest;
• Password storage using cryptographic hashing with salting — aroonplay never stores your password in plain text;
• Two-factor authentication (2FA) available for all Player accounts;
• Rate limiting and brute-force protection on login endpoints;
• Continuous monitoring of platform infrastructure for security anomalies and intrusion attempts;
• Regular security assessments and penetration testing of the aroonplay platform.

7.2 Organisational Measures. Access to personal data within aroonplay is strictly limited on a need-to-know basis. Staff with access to personal data are subject to confidentiality obligations. Data processing activities are logged and subject to internal audit.

7.3 Player Responsibility. aroonplay's security measures protect data on our systems. You are responsible for maintaining the security of your aroonplay login credentials. aroonplay strongly recommends enabling 2FA on your account and using a unique, strong password. aroonplay will never ask for your password via any communication channel.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules, you have the following rights in respect of your personal data held by aroonplay. Exercise any of these rights by contacting aroonplay's Data Protection Officer as described in Section 14.

9.1 What Are Cookies. Cookies are small text files placed on your device by aroonplay when you visit the platform. They enable the platform to recognise your device across sessions, maintain your login state, and remember your preferences.

9.2 Types of Cookies aroonplay Uses.

• Strictly Necessary Cookies: Required for the aroonplay platform to function. These include session authentication cookies, CSRF protection tokens, and load balancing cookies. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your preferences such as preferred language, display settings, and responsible gaming tool configurations. Disabling these affects platform usability but does not prevent access.
• Analytics Cookies: Used to understand how Players use the platform — which pages are visited most, how long sessions last, and where navigation errors occur. This data is aggregated and anonymised. aroonplay uses this data to improve the platform experience.
• Security Cookies: Used by aroonplay's fraud detection systems to analyse device fingerprints and identify suspicious access patterns consistent with credential stuffing, bot activity, or account takeover attempts.

9.3 Cookie Management. You can manage cookie preferences through your browser settings. Blocking strictly necessary cookies will impair your ability to use aroonplay. For other cookie types, your browser's cookie management interface provides control over which cookies are accepted. Note that clearing cookies will log you out of your aroonplay session.

9.4 Third-Party Cookies. Some aroonplay game providers may set their own functional cookies necessary for game operation. These are subject to the respective provider's privacy policies. aroonplay does not control the cookies set by third-party game content providers.

10.1 aroonplay's services are strictly for adults aged 21 and older. aroonplay does not knowingly collect, process, or store personal data of persons under 21 years of age. The mandatory KYC process is designed specifically to prevent minors from accessing real-money gaming services.

10.2 If aroonplay becomes aware that personal data has been collected from a person under 21 — through misrepresentation of age during registration or any other means — aroonplay will: (a) immediately suspend the relevant account; (b) void any winnings associated with the account; (c) securely delete or anonymise the personal data collected, subject to any legally mandated retention requirements; and (d) where the misrepresentation constitutes fraud, refer the matter to the appropriate Philippine authorities.

11.1 aroonplay primarily processes personal data within the Philippines. Where personal data is transferred to or processed in another country — for example by cloud infrastructure providers or game content providers with servers located outside the Philippines — aroonplay ensures that such transfers comply with the applicable requirements of the Data Privacy Act of 2012.

11.2 Where personal data is transferred cross-border, aroonplay implements appropriate safeguards including: contractual clauses binding the receiving party to data protection standards equivalent to those required under Philippine law; and/or restricting transfers to jurisdictions that the NPC has recognised as providing adequate data protection.

11.3 aroonplay does not transfer personal data to countries or organisations for purposes other than those described in this Policy.

12.1 In the event of a personal data breach that is likely to pose a real risk of serious harm to affected data subjects, aroonplay will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required under NPC Circular 16-03.

12.2 Where a breach is likely to result in a high risk to the rights and freedoms of affected Players, aroonplay will also notify the affected Players directly — via their registered email address or Philippine mobile number — with a description of the nature of the breach, the categories of data affected, the likely consequences, and the measures aroonplay has taken or proposes to take.

12.3 aroonplay maintains an incident response plan and conducts regular drills to ensure breaches are detected, contained, and notified within the legally required timeframes.

13.1 aroonplay reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, PAGCOR regulatory requirements, NPC guidelines, or aroonplay's data processing practices.

13.2 Material changes to this Privacy Policy will be communicated to registered Players via email to their registered address and/or by prominent notice on the aroonplay platform, no fewer than seven (7) days before the updated Policy takes effect.

13.3 Your continued use of aroonplay following the effective date of an updated Privacy Policy constitutes your acknowledgement of the changes. The current version of this Policy is always available at aroonplay.com/privacy-policy and is identified by the Effective Date at the top of this page.

14.1 aroonplay has appointed a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012. The DPO is responsible for overseeing aroonplay's data protection compliance and serving as the primary point of contact for data subject rights requests and privacy-related enquiries.

14.2 To exercise your data subject rights, raise a privacy concern, submit a data breach notification, or make any other data privacy enquiry, contact aroonplay's DPO through the Support channel below. This address is provided as plain text and is not a clickable link.

14.3 National Privacy Commission. If you are not satisfied with aroonplay's response to a privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines. The NPC's contact details are publicly available on the NPC's official government website.