k8k Casino — Privacy Policy

1. About This Privacy Policy

This Privacy Policy ("Policy") describes how k8k Casino ("k8k", "we", "us", "our"), the operator of the online gaming platform accessible at https://k8k.lat, collects, uses, discloses, stores, and protects the personal data of individuals ("you", "your", "Data Subject") who access or use the k8k platform, whether as registered players, visitors, or prospective users.

This Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Republic of the Philippines, its Implementing Rules and Regulations issued by the National Privacy Commission ("NPC"), and applicable directives from the Philippine Amusement and Gaming Corporation ("PAGCOR") relating to the handling of player information on licensed online gaming platforms.

By accessing the k8k platform or creating a registered account, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read together with k8k's Terms & Conditions and Responsible Gaming Policy.

2. Data Controller Identity

The data controller responsible for your personal data collected through the k8k platform is k8k Casino, operating as a PAGCOR-regulated online gaming operator in the Philippines. The platform is accessible at https://k8k.lat.

k8k has designated a Data Protection Officer ("DPO") as required under the Data Privacy Act. The DPO is responsible for overseeing k8k's data protection compliance, handling data subject rights requests, and liaising with the National Privacy Commission. Contact details for the DPO are provided in Section 14 of this Policy.

3. Personal Data We Collect

3.1 Data Provided by You Directly

When you register for a k8k account or use the platform, we collect the following categories of personal data that you provide to us:

• Identity Data: Full legal name, date of birth, nationality, gender;
• Contact Data: Email address, mobile phone number, residential address in the Philippines;
• Identification Data: Government-issued ID number and document type (e.g., PhilSys / PSA National ID, SSS, UMID, Driver's License, Passport) submitted during KYC verification;
• Financial Data: GCash account number, PayMaya account details, bank account details (BPI, BDO, Metrobank, or other), transaction records, deposit and withdrawal history;
• Account Credentials: Username and hashed password (plaintext passwords are never stored);
• Communications: Records of your correspondence with k8k customer support via live chat or email.

3.2 Data Collected Automatically

When you access the k8k platform, certain data is collected automatically through technical means:

• Device & Technical Data: IP address, device type, operating system, browser type and version, screen resolution, device identifier;
• Usage Data: Pages visited, games played, session duration, bet amounts, game outcomes, login timestamps;
• Location Data: Approximate geographic location derived from IP address (country and city level, not GPS-precise);
• Cookie Data: Session tokens and analytical identifiers as described in Section 10.

3.3 Data from Third Parties

k8k may receive supplementary data from third-party identity verification providers, payment processors (e.g., GCash, PayMaya, InstaPay), and fraud prevention services as part of the account verification and transaction processing workflow.

4. How We Use Your Personal Data

k8k processes your personal data for the following purposes:

• Account Management: Creating, maintaining, and securing your k8k account; processing your k8k login authentication; sending account-related notifications;
• Service Delivery: Enabling access to all games, live casino, sports betting, bingo, keno, and sabong on the platform; processing deposits via GCash, PayMaya, BPI, BDO, and Metrobank; processing withdrawal requests;
• Regulatory Compliance: Fulfilling KYC verification obligations under PAGCOR regulations; complying with the Anti-Money Laundering Act (Republic Act 9160) and reporting obligations to the Anti-Money Laundering Council (AMLC); age verification to enforce the 21+ restriction;
• Responsible Gaming: Monitoring gaming behaviour to identify signs of problem gambling; enforcing self-exclusion and deposit limit requests; complying with PAGCOR responsible gaming directives;
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, multiple account registration, bonus abuse, and money laundering; maintaining platform integrity;
• Customer Support: Responding to your enquiries, complaints, and disputes; resolving technical issues affecting your account;
• Platform Improvement: Analysing aggregated, anonymised usage data to improve platform performance, game selection, and user experience;
• Legal Proceedings: Establishing, exercising, or defending legal claims in Philippine courts or regulatory proceedings.

k8k does not use your personal data for unsolicited third-party marketing. Promotional communications from k8k itself are sent only to players who have not opted out of marketing communications, and an opt-out mechanism is provided in every such communication.

5. Legal Basis for Processing

k8k processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual Necessity: Processing necessary to perform the contract between you and k8k (the Terms & Conditions), including operating your account, processing payments, and delivering gaming services;
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing requirements, KYC obligations, AML Act reporting requirements, and NPC directives;
• Legitimate Interest: Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics, where k8k's legitimate interests do not override your data protection rights;
• Consent: Processing for marketing communications, where you have given explicit consent, and processing of sensitive personal information where required (consent may be withdrawn at any time).

6. Data Sharing & Disclosure

k8k does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients on a strictly limited and controlled basis:

• Payment Processors: GCash (G-Xchange Inc.), PayMaya (PayMaya Philippines Inc.), BPI, BDO, Metrobank, and InstaPay network operators — solely to process transactions you initiate;
• Identity Verification Providers: Third-party KYC and identity verification services engaged by k8k to fulfil PAGCOR-mandated verification requirements;
• Game Providers: Software providers whose games are integrated into the k8k platform may receive limited pseudonymised session data necessary to deliver their game services;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies as required by law or regulatory order;
• Law Enforcement: Philippine law enforcement agencies pursuant to lawful court orders, subpoenas, or legal process;
• Professional Advisors: Legal, accounting, and audit firms engaged by k8k, subject to professional confidentiality obligations.

All third-party service providers engaged by k8k are required to implement appropriate data protection safeguards and are prohibited from using your data for any purpose beyond the specific service they provide to k8k.

7. International Data Transfers

Some of k8k's service providers and game content partners operate infrastructure located outside the Philippines. Where your personal data is transferred to servers or processors outside the Philippines, k8k ensures that such transfers comply with the Data Privacy Act of 2012, specifically the requirements for cross-border data flows set out in NPC Circular 16-01 and subsequent NPC issuances.

k8k implements appropriate safeguards for international transfers, including data processing agreements with contractual clauses that require recipient organisations to maintain data protection standards equivalent to those applicable in the Philippines. Details of international transfer safeguards are available upon written request to k8k's Data Protection Officer.

8. Data Retention

k8k retains your personal data for the periods required by applicable law and regulatory obligations:

• Account Data: Retained for the duration of your active k8k account and for a minimum of five (5) years following account closure, as required by PAGCOR regulations and the Anti-Money Laundering Act;
• KYC Documents: Retained for a minimum of five (5) years from the date of the last transaction on your account, in compliance with AML Act retention requirements;
• Transaction Records: Retained for a minimum of five (5) years from the date of each transaction;
• Support Communications: Retained for three (3) years from the date of the communication, or longer if the communication relates to an unresolved dispute or legal matter;
• Analytical Data: Aggregated, anonymised analytics data may be retained indefinitely as it no longer constitutes personal data.

Upon expiry of the applicable retention period, k8k will securely delete or anonymise your personal data.

9. Security Measures

k8k implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit TLS/SSL encryption for all data in transit between your device and k8k servers;
• AES-256 encryption for sensitive personal data stored in k8k databases;
• Bcrypt password hashing — plaintext passwords are never stored or accessible;
• Role-based access controls ensuring only authorised personnel access personal data on a need-to-know basis;
• Regular independent security audits and penetration testing of the k8k platform;
• Multi-factor authentication required for administrative access to k8k backend systems;
• Intrusion detection systems and real-time security monitoring;
• Staff training on data protection obligations under the Data Privacy Act of 2012.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, k8k will notify the NPC within 72 hours of becoming aware of the breach, and will notify affected Data Subjects without undue delay where required by the Data Privacy Act.

10. Cookies and Tracking Technologies

k8k uses the following categories of cookies and similar technologies on the platform:

• Essential Cookies: Session authentication tokens and security cookies required for the platform to function. These cannot be disabled without impairing platform functionality;
• Functional Cookies: Cookies that remember your preferences (such as language settings and game lobby layout). These are optional;
• Analytical Cookies: First-party analytics cookies that collect anonymised data about how players use the platform, used to improve platform performance. No personal identifiers are transmitted to third parties through these cookies.

k8k does not place third-party advertising or retargeting cookies on the platform. You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from logging into your k8k account.

11. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights in respect of your personal data held by k8k:

• Right to be Informed: The right to be informed of how your personal data is collected and processed — which this Policy fulfils;
• Right of Access: The right to request a copy of the personal data k8k holds about you;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to Erasure (Right to be Forgotten): The right to request deletion of your personal data, subject to k8k's legal retention obligations under PAGCOR regulations and the AML Act;
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation where processing is based on legitimate interest;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to Damages: The right to be indemnified for any damages sustained from inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data;
• Right to Complain: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data protection rights have been violated.

To exercise any of the above rights, please submit a written request to k8k's Data Protection Officer at the contact details in Section 14. k8k will respond within fifteen (15) working days of receiving a verified request. Identity verification may be required before a request can be processed.

12. Children's and Minors' Privacy

k8k is a real-money online gambling platform restricted to individuals aged 21 years and above as required by PAGCOR regulations. k8k does not knowingly collect personal data from individuals under 21 years of age.

If k8k discovers that personal data has been collected from a person under 21 years of age — through misrepresentation during registration or otherwise — k8k will immediately suspend the associated account, void all transactions conducted by that account, and delete the personal data collected, retaining only the records necessary to document the age violation for regulatory reporting purposes.

If you are a parent or guardian and believe that a minor has registered a k8k account, please contact k8k support immediately via live chat so that the account can be identified and closed without delay.

13. Changes to This Privacy Policy

k8k reserves the right to amend this Privacy Policy at any time. Material changes will be communicated to registered players by email to the registered address and/or by a prominent notice on the k8k platform no less than seven (7) days before the revised Policy takes effect, except where immediate changes are required by law or NPC directive.

The date of the most recent update is displayed at the top of this Policy. Your continued use of the k8k platform after the effective date of any amended Policy constitutes your acknowledgment of the changes. We encourage you to review this Policy periodically.

14. Contact & Data Protection Officer

For privacy-related enquiries, data subject rights requests, or concerns about k8k's data handling practices, please contact k8k's Data Protection Officer:

• Email: [email protected]
• Subject Line: "Data Privacy Request" or "DPO Enquiry"
• Live Chat: Available 24/7 on the k8k platform — please state "data privacy" to be routed to the DPO team
• Response Time: k8k aims to acknowledge all privacy requests within 3 working days and respond fully within 15 working days

If you are not satisfied with k8k's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, the independent supervisory authority responsible for enforcing the Data Privacy Act of 2012.