spin7 Privacy Policy

In this Privacy Policy, the following terms have the meanings given below:

spin7 is the Data Controller responsible for the Personal Data collected through the spin7 platform. As Data Controller, spin7 determines the purposes for which your Personal Data is processed and is responsible for ensuring that processing is carried out lawfully, fairly, and transparently in accordance with this Privacy Policy and applicable law.

For data protection inquiries, requests to exercise your data rights, or complaints regarding spin7's data handling practices, please contact our Data Protection Officer using the contact details provided in Section 16 of this Policy.

spin7 collects the following categories of Personal Data from Players and platform visitors:

spin7 does not collect or process biometric data beyond selfie photographs used for KYC identity verification. Selfie images are processed solely for identity verification purposes and are not used for facial recognition or biometric profiling.

spin7 collects Personal Data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting customer support, or completing any form on the Platform.
• Automated collection: Technical and gameplay data collected automatically when you access and use the Platform, including via cookies, web beacons, and server-side logging.
• Third-party providers: Identity verification data from licensed KYC service providers, payment confirmation data from GCash, PayMaya, and banking partners, and fraud risk signals from fraud detection services.
• Publicly available sources: In limited cases, publicly available information may be used to verify identity or comply with AML obligations, in accordance with applicable law.

spin7 processes your Personal Data on the following legal bases under the Philippine Data Privacy Act and applicable international frameworks:

• Contractual necessity: Processing required to fulfill the contract between spin7 and the Player — including account creation, gameplay, payment processing, and customer support.
• Legal obligation: Processing required to comply with applicable Philippine laws and regulatory requirements — including AML reporting, KYC verification, age verification, and regulatory audit obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where spin7's legitimate interests are not overridden by your data protection rights.
• Consent: Processing for direct marketing communications (email and SMS promotions). You may withdraw consent at any time without affecting the lawfulness of prior processing.

spin7 uses your Personal Data for the following purposes:

• Creating, managing, and maintaining your spin7 account;
• Verifying your identity and age (21+) in accordance with KYC requirements;
• Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and card networks;
• Detecting and preventing fraud, money laundering, cheating, bonus abuse, and other prohibited conduct;
• Complying with anti-money laundering (AML) reporting obligations and responding to regulatory inquiries;
• Providing customer support and resolving account disputes;
• Administering bonuses, promotions, and loyalty program benefits;
• Enforcing responsible gaming tools including deposit limits, loss limits, cool-off periods, and self-exclusion;
• Monitoring gameplay for patterns consistent with problem gambling and initiating responsible gaming interventions where appropriate;
• Improving the spin7 platform, game lobby, and user experience based on aggregate gameplay and usage analytics;
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts) via email and SMS;
• Sending promotional communications where you have provided consent, including offers, bonuses, and event notifications.

spin7 does not sell, rent, or trade your Personal Data. We share Personal Data with third parties only in the following circumstances and only to the extent strictly necessary for the stated purpose:

• Payment processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa/Mastercard networks — to process deposits and withdrawals. These providers operate under their own privacy policies and applicable financial regulation.
• KYC verification providers: Licensed third-party identity verification services that process your ID documents and selfie photographs to confirm your identity and age. All KYC providers are bound by data processing agreements with spin7.
• Fraud detection services: Specialist providers that analyze transaction patterns and technical data to identify and prevent fraud. Access is limited to the data necessary for fraud signal generation.
• Regulatory and law enforcement authorities: Philippine government agencies, the National Privacy Commission (NPC), financial intelligence authorities, and law enforcement bodies, where disclosure is required by applicable law or court order.
• IT and hosting infrastructure providers: Cloud hosting, database, and platform infrastructure providers who process data on spin7's behalf under binding data processing agreements and strict confidentiality obligations.
• Legal and professional advisors: Lawyers, auditors, and compliance consultants, subject to professional confidentiality obligations.

All third-party Data Processors engaged by spin7 are required to implement appropriate technical and organizational security measures and to process Personal Data only on documented instructions from spin7.

8.1 Some of spin7's third-party service providers operate outside the Philippines. Where Personal Data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that offered by the Philippine Data Privacy Act, spin7 implements appropriate safeguards to protect the transferred data.

8.2 Safeguards used for international transfers include: contractual data protection clauses (Standard Contractual Clauses or equivalent), binding corporate rules, and reliance on adequacy decisions where applicable.

8.3 You may request information about the specific safeguards in place for any particular international data transfer by contacting spin7's Data Protection Officer using the details in Section 16.

spin7 retains Personal Data for as long as is necessary to fulfill the purposes for which it was collected, subject to the following minimum retention requirements:

At the end of the applicable retention period, Personal Data is securely deleted or anonymized. Anonymized data (which cannot be re-linked to an individual) may be retained indefinitely for aggregate analytics purposes.

spin7 uses cookies and similar tracking technologies to operate the Platform and provide a functional, personalized experience. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without preventing access to core Platform functions.
• Functional cookies: Remember your preferences such as language selection, lobby layout preferences, and responsible gaming settings between sessions.
• Analytics cookies: Collect aggregate, anonymized data about how Players use the Platform — which game categories are most visited, typical session flow, and page performance metrics. This data is used to improve the Platform.
• Security and fraud-prevention cookies: Used to identify suspicious device behaviour, detect bot activity, and verify that you are a legitimate user rather than an automated system.

You can control non-essential cookies through your browser settings. Disabling strictly necessary cookies will impair Platform functionality. spin7 does not use third-party advertising or behavioural tracking cookies.

Under the Philippine Data Privacy Act (RA 10173) and applicable international frameworks, you have the following rights with respect to your Personal Data held by spin7:

To exercise any of the above rights, contact spin7's Data Protection Officer at the email address provided in Section 16. spin7 will respond to all data rights requests within 15 business days of receipt. We may require identity verification before fulfilling any request to protect against unauthorized access to account data.

spin7 does not permit registration by persons under 21 years of age and takes active steps to prevent underage access, including mandatory date-of-birth declaration at registration and government ID-based age verification during the KYC process.

If spin7 becomes aware that Personal Data has been collected from an individual below the age of 21 — whether through registration or any other means — that account will be immediately closed, all associated data will be securely deleted (subject to any legal retention requirements), and any deposited funds will be returned via the original payment method where legally permissible.

If you are a parent or guardian and believe that a minor under your care has registered an account with spin7, please contact our support team immediately using the contact details in Section 16.

spin7 implements a comprehensive set of technical and organizational security measures to protect Personal Data against unauthorized access, accidental loss, destruction, alteration, or disclosure:

• 256-bit SSL/TLS encryption on all data transmitted between your device and spin7's servers;
• Encrypted storage at rest for all Personal Data, KYC documents, and financial records;
• Hashed and salted password storage — passwords are never stored or transmitted in plain text;
• Role-based access controls limiting staff access to Personal Data on a strict need-to-know basis;
• Two-factor authentication (2FA) available to all Players and mandatory for all spin7 internal staff systems;
• Regular third-party penetration testing and security audits;
• Real-time fraud monitoring and anomaly detection on account activity;
• Incident response procedures for detecting, containing, and notifying affected parties in the event of a data breach, in accordance with NPC notification requirements.

Despite these measures, no internet-based system is completely secure. If you suspect unauthorized access to your spin7 account, contact our support team immediately via live chat so we can investigate and take protective action.

The spin7 Platform does not contain links to third-party websites. All content and navigation within spin7.co is internal. In the event that any third-party integration displayed within the Platform (such as a game provider's interface) includes links to external content, spin7 is not responsible for the privacy practices of those third parties. Players should review the privacy policies of any external services they choose to interact with independently.

15.1 spin7 reviews and updates this Privacy Policy periodically to reflect changes in data processing practices, applicable law, or regulatory guidance. The "Last Reviewed" date at the top of this Policy indicates when the current version came into effect.

15.2 Where changes are material — meaning they significantly affect how we use your Personal Data or your rights as a data subject — spin7 will notify registered Players by email at least 14 days before the changes take effect, and will display a prominent notice on the Platform.

15.3 Your continued use of the spin7 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated terms.

For questions about this Privacy Policy, to exercise your data rights, or to raise a data protection concern, please contact spin7's Data Protection Officer:

If you are not satisfied with spin7's response to a data protection concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the supervisory authority responsible for enforcing the Philippine Data Privacy Act (RA 10173).