fa77 Privacy Policy

This Privacy Policy ("Policy") is issued by fa77 ("fa77", "we", "us", "our"), the operator of the online gaming platform at fa77.lat ("Platform"). It describes how fa77 collects, uses, stores, shares, and protects the personal data of individuals ("you", "Player", "User") who access or use the Platform, and sets out the rights available to you under applicable data protection law, including the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations.

By registering an account or otherwise using the fa77 Platform, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you should not use the Platform.

1.1  This Policy applies to all personal data processed by fa77 in connection with the Platform, including data collected through the website at fa77.lat, any mobile application fa77 may publish, and through communications between you and fa77's customer support team.

1.2  This Policy should be read alongside fa77's Terms and Conditions and Responsible Gaming Policy, which together govern your relationship with fa77.

1.3  Where this Policy refers to "personal data," it means any information that identifies you or could reasonably be used to identify you, directly or indirectly — including your name, contact details, government ID numbers, financial account numbers, device identifiers, and gameplay records.

2.1  fa77 acts as the data controller in respect of all personal data collected through the Platform. As data controller, fa77 determines the purposes and means of processing your personal data, and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.

2.2  fa77 operates under the regulatory framework of the Philippine Amusement and Gaming Corporation (PAGCOR). Regulatory obligations imposed by PAGCOR may independently require fa77 to collect, retain, and disclose certain personal data regardless of your consent preferences.

3.1  Identity Data: Full legal name, date of birth, nationality, and copies of government-issued identification documents (e.g., Philippine Passport, PhilSys National ID, UMID, Driver's Licence, PRC ID) collected during the KYC (Know Your Customer) verification process.

3.2  Contact Data: Registered email address, Philippine mobile number, and any correspondence address you provide.

3.3  Financial Data: GCash account details, PayMaya account details, bank account numbers (BPI, BDO, Metrobank), card details (Visa, Mastercard) used for deposits and withdrawals, transaction amounts, dates, and references.

3.4  Gameplay Data: Game session logs, bet amounts, game outcomes, win and loss history, bonus activation and wagering records, session durations, and game preferences.

3.5  Technical Data: IP address, device type and identifier, operating system, browser type and version, time zone, screen resolution, and session duration data collected automatically when you access the Platform.

3.6  Communications Data: Records of your interactions with fa77 customer support, including live chat transcripts, email correspondence, and support ticket histories.

3.7  Responsible Gaming Data: Deposit limit settings, self-exclusion elections, cooling-off periods, and any voluntary problem gambling declarations you make through the Platform's responsible gaming tools.

fa77 collects personal data through the following means:

• Direct collection: Information you provide when registering, completing KYC verification, making deposits or withdrawals, contacting customer support, participating in promotions, or updating your account settings.
• Automated collection: Technical and usage data collected automatically through cookies, web beacons, session tracking, and server logs when you access and navigate the Platform.
• Third-party sources: Identity verification data from KYC service providers; fraud risk signals from payment processors; publicly available sanctions and politically exposed persons (PEP) lists checked as part of AML compliance obligations.

fa77 processes your personal data for the following purposes, each grounded in a lawful basis under the DPA:

• Account creation and management — necessary for the performance of the contract between you and fa77.
• Identity and age verification (KYC) — necessary for compliance with PAGCOR regulatory obligations and applicable AML laws; the 21+ age restriction is a hard legal requirement under Philippine gaming law.
• Payment processing and fraud prevention — necessary for the performance of the contract and for fa77's legitimate interest in preventing financial crime.
• Regulatory compliance and AML monitoring — necessary for compliance with legal obligations imposed by PAGCOR, the Anti-Money Laundering Act, and related Philippine legislation.
• Responsible gaming monitoring — necessary for compliance with fa77's PAGCOR-mandated responsible gaming obligations and, where applicable, in the legitimate interest of player protection.
• Customer support — necessary for the performance of the contract and fa77's legitimate interest in resolving player disputes and improving service quality.
• Platform analytics and improvement — fa77's legitimate interest in understanding how the Platform is used and improving product features for Filipino players.
• Marketing communications — based on your consent, where you have opted in to receive promotional communications from fa77. You may withdraw consent at any time.

6.1  fa77 does not sell your personal data to third parties. We share personal data only where necessary for the purposes described in this Policy or where required by law.

6.2  Categories of recipients with whom fa77 may share personal data include:

• Payment processors and e-wallet providers: GCash, PayMaya, and banking partners (BPI, BDO, Metrobank) receive the minimum financial data necessary to process your deposit or withdrawal transactions.
• KYC and identity verification providers: Third-party services engaged by fa77 to verify the authenticity of identity documents and confirm player eligibility.
• Regulatory authorities: PAGCOR and other competent Philippine government authorities, where disclosure is required by law, court order, or regulatory direction.
• Game and technology providers: Software providers supplying game content to the fa77 Platform may receive pseudonymised gameplay data for game integrity and technical support purposes.
• AML and fraud screening services: Third-party services that screen player data against sanctions lists, PEP databases, and adverse media sources as required by AML compliance obligations.
• Professional advisers: Legal counsel, auditors, and insurers, where disclosure is necessary for the purpose of seeking professional advice or managing a claim.

6.3  All third parties with whom fa77 shares personal data are subject to contractual data protection obligations consistent with the requirements of the DPA.

7.1  Some of fa77's service providers and technology partners are located outside the Philippines. Where personal data is transferred to a recipient in a jurisdiction that does not have an equivalent level of data protection to that provided by the DPA, fa77 will implement appropriate safeguards — such as standard contractual clauses or binding corporate rules — to ensure that your personal data continues to be protected in accordance with this Policy.

7.2  fa77 does not transfer personal data internationally for purposes beyond those described in this Policy.

8.1  fa77 retains personal data for as long as your Account is active and for a period thereafter as required by applicable law and regulatory obligation. Specific retention periods include:

• KYC identity documents and verification records: minimum five (5) years following account closure, in line with AML requirements;
• Financial transaction records: minimum five (5) years from the date of the transaction;
• Gameplay records: minimum three (3) years from the date of the session;
• Customer support correspondence: three (3) years from the date of the last interaction;
• Marketing consent records: for the duration of the marketing relationship plus three (3) years.

8.2  Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

9.1  fa77 implements technical and organisational security measures appropriate to the risks associated with processing your personal data, including:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the fa77 Platform;
• Hashed and salted storage of account passwords — fa77 does not store your password in plaintext and cannot retrieve it;
• Access controls limiting internal access to personal data on a need-to-know basis;
• Regular security assessments and penetration testing of Platform infrastructure;
• Automated anomaly detection for suspicious login activity and unusual transaction patterns.

9.2  While fa77 takes reasonable steps to protect your personal data, no internet transmission is entirely secure. Players should enable two-factor authentication (2FA) on their fa77 Accounts as an additional layer of protection against unauthorised access.

10.1  fa77 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies used by fa77 fall into the following categories:

• Strictly necessary cookies: Required for the Platform to function — including session management, security tokens, and login state. These cannot be disabled without impairing Platform functionality.
• Functional cookies: Store your preferences such as language, display settings, and game history so you do not need to reconfigure them on each visit.
• Analytics cookies: Collect pseudonymised data about how players navigate the Platform. This helps fa77 identify and fix usability issues and improve the overall player experience.

10.2  You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in and using the Platform. fa77 does not use third-party advertising cookies.

Under the Philippine Data Privacy Act of 2012 and applicable regulations, you have the following rights in relation to your personal data held by fa77:

• Right to be informed: You have the right to be informed about how your personal data is being processed, which this Policy fulfils.
• Right of access: You may request a copy of the personal data fa77 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data held on your Account.
• Right to erasure ("right to be forgotten"): You may request deletion of personal data that is no longer necessary for the purpose for which it was collected, subject to fa77's legal retention obligations.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time.
• Right to data portability: You may request a machine-readable copy of personal data you have provided to fa77 where processing is based on consent or contract.
• Right to complain: If you believe fa77 has breached its obligations under the DPA, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, contact fa77 at [email protected]. fa77 will respond to verifiable requests within fifteen (15) business days. Requests may require identity verification before they are actioned.

12.1  The fa77 Platform is strictly prohibited for individuals under the age of twenty-one (21). fa77 does not knowingly collect personal data from persons under 21 years of age. Age verification is a mandatory step in the KYC process, and any account found to have been opened by a minor will be immediately suspended and all associated data handled in accordance with applicable law.

12.2  If you believe that a person under 21 has registered on the fa77 Platform, please contact [email protected] immediately. fa77 will investigate and take appropriate action without delay.

13.1  fa77 will send you promotional communications — including bonus offers, new game announcements, and platform updates — only where you have given explicit consent to receive such communications at registration or through your Account preferences.

13.2  You may withdraw consent to receive marketing communications at any time by updating your notification preferences in Account Settings or by contacting fa77 support. Withdrawal of marketing consent does not affect the lawfulness of processing carried out before withdrawal.

13.3  Transactional communications — including account security alerts, deposit confirmations, withdrawal notifications, and regulatory notices — are not marketing communications and cannot be opted out of while your Account remains active, as they are necessary for the provision of the fa77 service.

14.1  The fa77 Platform may contain links to third-party websites or services — for example, links to game provider websites or payment processor help pages. This Policy does not apply to those third-party sites. fa77 is not responsible for the privacy practices of third parties and recommends that you review the privacy policies of any external sites you visit.

15.1  fa77 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory guidance. The "Last Updated" date at the top of this Policy will be revised accordingly.

15.2  Where changes are material — for example, where fa77 begins processing personal data for a new purpose or sharing it with a new category of recipient — fa77 will notify registered players via email or a prominent notice on the Platform prior to the changes taking effect.

15.3  Continued use of the fa77 Platform after a Policy update constitutes your acknowledgement of the revised Policy.

16.1  For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by fa77, please contact our Data Protection Officer (DPO) at: [email protected]

16.2  If you are not satisfied with fa77's response to a data privacy concern, you have the right to escalate the matter to the National Privacy Commission of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012.

16.3  fa77 commits to acknowledging all data privacy requests within five (5) business days and providing a substantive response within fifteen (15) business days, or within any shorter timeframe required by applicable law.