Privacy Policy

1. Information We Collect

1.1 Personal Information Provided by You

When you register for an xtaya account or use our services, we collect personal information that you voluntarily provide to us. This information is necessary for account creation, identity verification, regulatory compliance, and service delivery. The categories of personal information we collect include:

• Identity Information: Full legal name, date of birth, nationality, gender, and government-issued identification numbers as required for age verification and anti-money laundering compliance under PAGCOR regulations.
• Contact Information: Email address, mobile phone number, residential address, city, province, and postal code for account communications and verification purposes.
• Financial Information: Payment method details including bank account information, e-wallet identifiers (GCash, Maya, etc.), transaction histories, deposit amounts, withdrawal requests, and account balances.
• Authentication Credentials: Username, password (stored in encrypted form), security questions and answers, two-factor authentication settings, and login session information.
• Verification Documents: Copies of government-issued identification cards, utility bills, bank statements, or other documents submitted for identity verification and Know Your Customer (KYC) compliance.

1.2 Automatically Collected Information

When you access or use the xtaya platform, we automatically collect certain technical and usage information through cookies, log files, and similar tracking technologies. This information helps us improve our services, prevent fraud, and ensure platform security. Automatically collected information includes:

• Device Information: Device type, operating system, browser type and version, screen resolution, device identifiers, and hardware specifications.
• Connection Information: IP address, internet service provider, connection speed, geographic location data (country, region, city), and network information.
• Usage Data: Pages visited, games played, betting patterns, session duration, click behavior, navigation paths, timestamps of activities, and referral sources.
• Cookies and Tracking Data: Session cookies, persistent cookies, analytics cookies, preference settings, and other tracking identifiers used to enhance user experience and platform functionality.

1.3 Information from Third Parties

We may receive personal information about you from third-party sources including payment processors, identity verification services, fraud prevention agencies, and regulatory authorities. This information is used to verify your identity, prevent fraud, comply with legal obligations, and protect the integrity of our platform. Third-party information sources may include credit bureaus, government databases, and industry fraud prevention networks.

2. How We Use Your Information

xtaya uses the personal information we collect for legitimate business purposes related to providing, maintaining, and improving our gaming services. The specific purposes for which we use your information include:

2.1 Service Delivery and Account Management

• Creating and maintaining your xtaya user account
• Processing deposits, withdrawals, and financial transactions
• Enabling gameplay and betting functionality across our platform
• Calculating winnings, settling bets, and maintaining accurate account balances
• Providing customer support and responding to inquiries
• Sending transactional notifications regarding account activity, deposits, withdrawals, and gaming outcomes

2.2 Verification and Compliance

• Verifying your age and identity to ensure compliance with Philippine gaming regulations
• Conducting Know Your Customer (KYC) and anti-money laundering (AML) checks as required by PAGCOR and Philippine law
• Detecting and preventing fraud, unauthorized access, money laundering, and other illegal activities
• Investigating suspected violations of our Terms and Conditions
• Complying with legal obligations, regulatory requirements, court orders, and government requests
• Maintaining records for audit, compliance, and dispute resolution purposes

2.3 Platform Security and Fraud Prevention

• Monitoring account activity for suspicious behavior, unauthorized access, and security threats
• Implementing fraud detection algorithms and risk assessment models
• Protecting against cyberattacks, hacking attempts, and system vulnerabilities
• Identifying duplicate accounts, bonus abuse, and coordinated fraudulent activities
• Maintaining platform integrity and ensuring fair gaming for all users

2.4 Service Improvement and Analytics

• Analyzing user behavior and preferences to improve platform functionality
• Conducting research and analytics to enhance game offerings and user experience
• Testing new features, promotions, and services
• Optimizing website performance, loading times, and mobile responsiveness
• Understanding demographic trends and user engagement patterns

2.5 Marketing and Communications

With your consent where required by law, we may use your contact information to send promotional materials, bonus offers, newsletters, and marketing communications about xtaya services. You have the right to opt out of marketing communications at any time through your account settings or by following unsubscribe instructions in our emails. Transactional communications necessary for service delivery are not subject to opt-out and will continue regardless of marketing preferences.

3. How We Share Your Information

xtaya does not sell, rent, or trade your personal information to third parties for their independent marketing purposes. However, we may share your information with carefully selected third parties under the following circumstances:

Recipient Category	Purpose of Sharing
Payment Processors	Processing deposits, withdrawals, and financial transactions through GCash, Maya, banks, and other payment channels.
Identity Verification Services	Conducting age verification, identity authentication, and KYC compliance checks as required by Philippine gaming regulations.
Game Providers	Enabling gameplay functionality for slots, live dealer games, and other gaming content hosted by third-party providers.
Fraud Prevention Services	Detecting fraudulent activities, preventing money laundering, and sharing information about suspected fraud with industry partners.
Regulatory Authorities	Complying with PAGCOR regulations, responding to government inquiries, and fulfilling legal reporting obligations.
Legal and Professional Advisors	Obtaining legal counsel, accounting services, and professional advice necessary for business operations.
Cloud Service Providers	Hosting data securely on cloud infrastructure, maintaining backups, and ensuring platform availability.

All third-party service providers with whom we share personal information are contractually obligated to protect your data, use it only for specified purposes, and comply with applicable data protection laws. We conduct due diligence on service providers to ensure they maintain appropriate security standards and data handling practices.

4. Data Security and Protection

xtaya implements comprehensive technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction. Our security infrastructure includes:

• Encryption: All data transmissions between your device and our servers are encrypted using industry-standard SSL/TLS protocols. Sensitive information including passwords and financial data is encrypted at rest using advanced encryption algorithms.
• Access Controls: Strict access controls limit employee access to personal information on a need-to-know basis. All personnel with data access undergo background checks and sign confidentiality agreements.
• Network Security: Firewalls, intrusion detection systems, and continuous monitoring protect our infrastructure from external threats and unauthorized access attempts.
• Regular Audits: We conduct periodic security assessments, vulnerability scans, and penetration testing to identify and remediate potential weaknesses in our systems.
• Incident Response: We maintain incident response procedures to detect, contain, and respond to security breaches promptly, including notification protocols as required by Philippine data protection laws.
• Physical Security: Data centers hosting xtaya infrastructure implement physical security controls including access restrictions, surveillance, and environmental protections.

While we employ robust security measures, no internet-based system can be guaranteed completely secure. You acknowledge that you provide information to xtaya at your own risk and that we cannot guarantee absolute protection against all security threats. You are responsible for maintaining the confidentiality of your account credentials and should notify us immediately if you suspect unauthorized access to your account.

5. Data Retention

xtaya retains your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. Specific retention periods vary depending on the type of information and applicable legal requirements:

• Account Information: Retained while your account remains active and for a minimum of five years after account closure to comply with PAGCOR record-keeping requirements and Philippine anti-money laundering regulations.
• Transaction Records: Financial transaction data is retained for at least seven years as required by Philippine taxation and financial record-keeping laws.
• Communications: Customer support interactions and account communications are retained for dispute resolution purposes and regulatory compliance, typically for three to five years.
• Marketing Data: Information related to marketing communications is retained until you withdraw consent or request deletion, subject to legal obligations requiring longer retention.

After the applicable retention period expires, we securely delete or anonymize your personal information in accordance with data protection best practices. However, certain information may be retained indefinitely in anonymized or aggregated form for statistical analysis and business intelligence purposes, where such data cannot be linked back to individual users.

6. Your Privacy Rights

Under the Data Privacy Act of 2012 and related Philippine regulations, you have the following rights regarding your personal information held by xtaya:

• Right to Access: You may request confirmation of whether we hold personal information about you and obtain copies of that information, subject to legal restrictions and verification requirements.
• Right to Correction: You may request correction of inaccurate or incomplete personal information. You can update most account information directly through your account settings.
• Right to Erasure: You may request deletion of your personal information where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that may prevent immediate deletion.
• Right to Object: You may object to processing of your personal information for marketing purposes or based on legitimate interests, though this may affect our ability to provide certain services.
• Right to Data Portability: You may request that we provide your personal information in a structured, commonly used, and machine-readable format for transfer to another service provider where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time, though this does not affect the lawfulness of processing conducted before withdrawal.
• Right to Lodge Complaints: You have the right to file complaints regarding our data practices with the National Privacy Commission of the Philippines.

To exercise any of these rights, please contact our Data Protection Officer through the contact information provided at the end of this Privacy Policy. We will respond to your request within the timeframes required by Philippine law, typically within fifteen to thirty days depending on the complexity of the request. We may require identity verification before processing requests to ensure we are disclosing information only to authorized individuals.

7. Cookies and Tracking Technologies

xtaya uses cookies, web beacons, and similar tracking technologies to enhance user experience, analyze platform usage, and deliver personalized content. Cookies are small text files stored on your device that allow us to recognize you and remember your preferences. We use the following types of cookies:

• Essential Cookies: Required for platform functionality including authentication, security, and session management. These cookies cannot be disabled without affecting site operation.
• Performance Cookies: Collect anonymous information about how users interact with our platform, helping us identify issues and optimize performance.
• Functionality Cookies: Remember your preferences, language settings, and customization choices to provide a personalized experience.
• Analytics Cookies: Track user behavior and engagement patterns to help us understand usage trends and improve our services.

You can manage cookie preferences through your browser settings, though disabling certain cookies may limit platform functionality. Most browsers allow you to refuse cookies, delete existing cookies, or receive notifications before cookies are stored. Please refer to your browser's help documentation for specific instructions on cookie management.

8. Children's Privacy

xtaya services are intended solely for individuals who have reached the legal gambling age of 21 years in the Philippines. We do not knowingly collect personal information from individuals under 21 years of age. If we discover that we have inadvertently collected information from a minor, we will immediately delete that information and close any associated account. Parents or guardians who believe their child has provided personal information to xtaya should contact us immediately so we can take appropriate action.

9. Changes to This Privacy Policy

xtaya reserves the right to modify, update, or replace this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be communicated to registered users via email or prominent notice on our platform. Your continued use of xtaya services following notification of Privacy Policy changes constitutes acceptance of those changes. We encourage you to review this Privacy Policy periodically to remain informed about how we protect your information.

10. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer using the following information:

For formal complaints regarding our data protection practices, you may also contact the National Privacy Commission of the Philippines through their official channels.