sayagame Privacy Policy

sayagame ("we," "us," "the Platform," or "sayagame") is the data controller responsible for the personal information collected through the sayagame platform at sayagame.co. sayagame is an online gaming operator licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR) and operates in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations.

This Privacy Policy explains how sayagame collects, uses, stores, shares, and protects your personal data when you register an account, make transactions, play games, or otherwise interact with the Platform. It also explains the rights you have over your personal data and how to exercise them.

If you have questions about this Policy or sayagame's data practices, you may contact our Data Protection Officer (DPO) using the details in Section 14.

sayagame collects the following categories of personal data, depending on your interaction with the Platform:

sayagame does not collect sensitive personal information (as defined under R.A. 10173, Section 3(l)) beyond what is strictly necessary for government-mandated KYC and AML purposes.

sayagame uses your personal data for the following purposes:

• Account Management — Creating, maintaining, and securing your sayagame player account, including authentication and password recovery;
• Service Delivery — Processing deposits and withdrawals, crediting winnings, applying bonuses, and maintaining your game history and wallet balance;
• KYC & Age Verification — Verifying your identity and confirming that you meet the 21+ age requirement mandated by PAGCOR before processing your first withdrawal;
• Regulatory Compliance — Meeting sayagame's obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act, including filing required reports with PAGCOR, the AMLC, and the NPC;
• Fraud Prevention & Security — Detecting and preventing unauthorized access, duplicate accounts, bonus abuse, collusion, money laundering, and other prohibited activities;
• Responsible Gaming — Monitoring gaming behavior to identify potential problem gambling patterns, enforcing deposit and session limits, and managing self-exclusion records;
• Customer Support — Responding to your inquiries, resolving disputes, and improving our support quality based on interaction history;
• Platform Improvement — Analyzing aggregated and anonymized usage data to improve platform performance, game selection, and user experience;
• Marketing Communications — Sending promotional offers, bonus notifications, and product updates — only where you have provided consent or where permitted under the DPA's legitimate interest grounds. You may opt out at any time.

sayagame processes your personal data on the following legal bases under R.A. 10173:

• Contractual Necessity — Processing required to perform our obligations under the Player Agreement (Terms and Conditions), including account management, payments, and game delivery;
• Legal Obligation — Processing required to comply with PAGCOR licensing conditions, AMLA reporting, NPC obligations, and applicable Philippine law;
• Legitimate Interest — Processing for fraud prevention, security monitoring, responsible gaming oversight, and platform analytics — where sayagame's legitimate interests do not override your fundamental privacy rights;
• Consent — Processing for direct marketing and optional data sharing, where you have given clear, freely-given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

sayagame does not sell your personal data. We share your data only with the following categories of recipients, and only to the extent necessary:

• Payment Processors — GCash, PayMaya / Maya, BPI, BDO, Metrobank, Visa, and Mastercard — to process deposits and withdrawals. These providers operate under their own privacy policies and applicable BSP regulations;
• KYC / Identity Verification Providers — Third-party eKYC service providers who perform document verification and liveness checks as part of our PAGCOR-mandated KYC process;
• Regulatory Authorities — PAGCOR (as our licensing body), the AMLC (for mandated AML reporting), and the NPC (for breach notifications and regulatory inquiries) — where legally required;
• Game Content Providers — Third-party game studios and live casino operators whose games are hosted on sayagame, which may receive anonymized session data for game integrity and fairness auditing purposes;
• IT Service Providers — Cloud hosting, cybersecurity, and platform infrastructure providers who process data on our behalf under data processing agreements (DPAs) that require them to maintain equivalent data protection standards;
• Law Enforcement — Where sayagame is required by court order, subpoena, or binding legal process to disclose personal data. sayagame will notify affected Players where legally permitted to do so.

All third-party processors that receive personal data from sayagame are required to process it solely for the specified purpose, maintain appropriate security measures, and comply with R.A. 10173 and applicable Philippine data protection law.

6.1 What We Use. sayagame uses cookies and similar tracking technologies (local storage, session tokens, device fingerprinting) to operate the Platform securely and efficiently. Cookies are small data files stored on your device.

6.2 Types of Cookies.

• Strictly Necessary Cookies — Required for login session management, security token validation, and fraud prevention. These cannot be disabled without breaking core Platform functionality;
• Functional Cookies — Remember your language preferences, game display settings, and responsible gaming tool configurations;
• Analytics Cookies — Anonymized data on page views, navigation patterns, and feature usage — used to improve the Platform. No individual player is identifiable in analytics reports;
• Marketing Cookies — Used only where you have consented, to track promotional campaign effectiveness on sayagame's own properties. sayagame does not use third-party advertising cookies.

6.3 Cookie Control. You may manage or delete cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to sayagame. Disabling other cookie types will not affect your ability to play games.

sayagame implements comprehensive technical and organizational security measures to protect your personal data, including:

• TLS 1.3 encryption for all data in transit between your device and sayagame servers;
• AES-256 encryption for sensitive data at rest, including ID document images and payment method details;
• Bcrypt hashing for all stored passwords — sayagame does not store passwords in plaintext;
• OTP-based two-factor authentication on all accounts;
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular third-party penetration testing and security audits;
• 24/7 automated intrusion detection and anomaly alerting systems;
• Data processing agreements with all third-party processors requiring equivalent security standards.

No security system is completely impenetrable. In the event of a data breach that poses a risk to your rights and freedoms, sayagame will notify you and the NPC within 72 hours of discovery.

sayagame retains personal data for the following periods:

• Account & Registration Data — Retained for the duration of your active account, plus five (5) years post-closure to meet PAGCOR and AMLA obligations;
• KYC & Identity Documents — Retained for five (5) years from the date of account closure, as required by AMLA implementing rules;
• Transaction & Financial Records — Retained for seven (7) years to comply with Bureau of Internal Revenue (BIR) requirements and AMLA record-keeping obligations;
• Gaming Activity Logs — Retained for three (3) years for dispute resolution and responsible gaming monitoring purposes;
• Support Communications — Retained for two (2) years from the date of last interaction;
• Marketing Preferences — Retained until you withdraw consent or opt out, after which marketing data is deleted within 30 days.

Upon expiry of the applicable retention period, sayagame will securely delete or anonymize your personal data so that it can no longer be linked to you as an individual.

Under R.A. 10173 and its Implementing Rules, you have the following rights with respect to your personal data held by sayagame:

To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "Data Subject Request." sayagame will respond within thirty (30) calendar days.

sayagame's services are strictly intended for individuals who are at least twenty-one (21) years of age, in accordance with PAGCOR regulations governing casino-style gaming in the Philippines. sayagame does not knowingly collect personal data from individuals under 21.

If sayagame discovers that a player account belongs to a person under 21, the account will be immediately suspended, all personal data associated with the account will be reviewed for mandatory reporting obligations, and the data will thereafter be handled in accordance with applicable law. If you believe sayagame has inadvertently collected data from a minor, please notify our DPO immediately at [email protected].

11.1 Consent-Based. sayagame will only send you promotional SMS, email, or in-app notifications about bonuses, new games, and special offers if you have opted in during registration or via your account notification settings.

11.2 Opt-Out. You may withdraw your marketing consent at any time by: updating your notification preferences in the sayagame account dashboard; replying STOP to any SMS communication from sayagame; or contacting our support team. Opt-out requests are processed within five (5) business days. Withdrawing marketing consent does not affect your ability to use the Platform or receive service-critical communications (e.g., withdrawal confirmations, security alerts, account notices).

sayagame's primary data infrastructure is located within the Philippines. Certain third-party service providers — including game content providers and cloud infrastructure partners — may process data in other jurisdictions. Where such transfers occur, sayagame ensures that:

• The receiving country provides an adequate level of data protection as assessed by the NPC, OR
• Appropriate safeguards are in place via contractual clauses, binding corporate rules, or equivalent mechanisms that meet NPC standards.

Players may request details of international transfer safeguards applicable to their data by contacting our DPO.

sayagame may update this Privacy Policy from time to time to reflect changes in our data practices, PAGCOR requirements, or applicable Philippine law. Material changes will be communicated to registered Players via SMS to your registered Philippine mobile number and/or a prominent notice on the Platform at least seven (7) days before the change takes effect. The "Last Updated" date at the top of this Policy will always reflect the most recent revision. Your continued use of sayagame following the effective date of any revision constitutes your acceptance of the updated Policy.

sayagame has appointed a Data Protection Officer (DPO) in accordance with R.A. 10173's requirements. For any data privacy queries, data subject requests, or privacy concerns, please contact:

• Data Protection Officer — sayagame
• Email: [email protected] (subject line: "Privacy / DPO Inquiry")
• Response time: Within 48 hours for general inquiries; within 30 calendar days for formal data subject requests
• 24/7 Live Chat: Available within the sayagame Platform after login

For unresolved concerns, you may also file a complaint with the National Privacy Commission of the Philippines.