aaopen Privacy Policy — Your Data, Protected

This Privacy Policy applies to all personal data processed by aaopen in connection with your use of the aaopen website (aaopen.org), its gaming services, mobile-optimised interface, customer support channels, and any related services (collectively, the "Platform").

For the purposes of this Policy, aaopen acts as the data controller in respect of personal data collected from registered users and visitors to the Platform. As data controller, aaopen determines the purposes and means by which personal data is processed, and bears responsibility for ensuring that processing activities comply with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

aaopen collects the following categories of personal data in connection with your use of the Platform:

aaopen does not collect sensitive personal information beyond what is required for KYC identity verification as mandated by PAGCOR regulations and anti-money laundering (AML) compliance obligations.

aaopen collects personal data through the following means:

• Direct registration: When you create an aaopen account, you provide your name, date of birth, mobile number, and email address directly.
• KYC verification: When you submit identity documents (such as your PhilSys ID, Driver's License, or Passport) for account verification, aaopen's KYC system processes those documents and their associated data.
• Payment processing: When you make a deposit or request a withdrawal, financial transaction data is generated and recorded in connection with your account.
• Platform use: As you navigate and play on the aaopen platform, technical data and gaming activity data is automatically collected through server logs, session tracking, and game system records.
• Customer support interactions: When you contact aaopen's support team via live chat or email, the content of those communications is stored for quality assurance, training, and dispute resolution purposes.
• Cookies and similar technologies: aaopen uses cookies and related tracking technologies as described in Section 7 of this Policy.

aaopen processes your personal data for the following specific purposes:

1. Account creation and management: To register you as a member, maintain your account, authenticate your identity at login, and process your account settings and preferences.
2. Service delivery: To provide access to the games, betting markets, live casino tables, bingo rooms, and all other features available on the aaopen platform.
3. Payment processing: To process deposits and withdrawals through GCash, Maya, and other supported payment channels, and to maintain accurate financial records.
4. KYC and regulatory compliance: To verify your identity, confirm your eligibility (including age verification for the 21+ requirement), and comply with PAGCOR licensing conditions, Anti-Money Laundering Act requirements, and other applicable Philippine laws.
5. Fraud prevention and security: To detect, investigate, and prevent fraudulent transactions, account abuse, money laundering, and other prohibited activities on the platform.
6. Customer support: To respond to your queries, complaints, and requests, and to provide assistance through aaopen's 24/7 live chat and email support channels.
7. Platform improvement: To analyse usage patterns, gameplay behaviour, and technical performance data for the purpose of improving the aaopen platform, fixing bugs, and developing new features.
8. Marketing and promotions: To send you relevant promotional offers, bonus notifications, and platform updates where you have provided your consent to receive such communications.
9. Responsible gaming: To monitor gaming behaviour for indicators of problem gambling, enforce account-level restrictions, and administer self-exclusion requests in accordance with aaopen's responsible gaming obligations.

aaopen processes your personal data on the following legal bases as recognised under the Data Privacy Act of 2012 and applicable Philippine law:

• Contractual necessity: Processing required to perform our obligations under the Terms and Conditions you have accepted, including account management, service delivery, and payment processing.
• Legal obligation: Processing required to comply with PAGCOR regulatory requirements, the Anti-Money Laundering Act (RA 9160, as amended), the Data Privacy Act, and other applicable Philippine laws.
• Legitimate interests: Processing necessary for aaopen's legitimate interests in fraud prevention, platform security, and service improvement, provided those interests are not overridden by your privacy rights.
• Consent: Processing for marketing and promotional communications, and for any non-essential cookies or tracking, where you have provided your explicit prior consent. You may withdraw consent at any time.

aaopen does not sell your personal data. We may share your data with the following categories of third parties, strictly for the purposes set out in this Policy:

• Game providers and software licensors: Game studios and live casino operators whose content is available on the aaopen platform may receive limited technical and gameplay data necessary to deliver their games and verify fair play outcomes.
• Payment service providers: GCash (GXI), Maya (Voyager Innovations), and other payment processors receive the financial and identity data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable Philippine financial regulations.
• KYC and identity verification services: Third-party verification providers may process your identity documents for the purpose of completing KYC requirements.
• Regulatory and law enforcement authorities: aaopen will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine authorities when required by law, court order, or regulatory direction.
• IT infrastructure and hosting providers: Technical service providers that host and maintain the aaopen platform may process personal data as data processors acting strictly under aaopen's instruction and under appropriate data processing agreements.

aaopen uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small data files placed on your device when you visit the aaopen website.

aaopen uses the following types of cookies:

• Strictly necessary cookies: Required for the Platform to function. These include session authentication cookies that maintain your login state. These cannot be disabled as they are essential to service delivery.
• Functional cookies: Store your preferences such as language settings, game lobby display options, and notification configurations to improve your experience on return visits.
• Analytics cookies: Collect aggregate, anonymised data about how users interact with the Platform — pages visited, session duration, error rates — to help aaopen identify and resolve usability issues.
• Security cookies: Used to detect and prevent fraud, bot activity, and unauthorised account access attempts.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may affect your ability to use certain features of the aaopen Platform, including account login.

aaopen retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following general retention principles apply:

• Account data: Retained for the duration of your active membership and for a minimum of five (5) years following account closure, in accordance with PAGCOR licensing requirements and AML record-keeping obligations.
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act.
• KYC documents: Retained for a minimum of five (5) years following the completion of the verification process or account closure, whichever is later.
• Customer support communications: Retained for two (2) years from the date of the last interaction, unless a longer period is required for an active dispute or regulatory matter.
• Marketing preference records: Retained for the duration of your membership or until you withdraw consent to marketing communications, whichever comes first.

Upon expiry of the applicable retention period, personal data is securely deleted, destroyed, or anonymised in a manner that prevents reconstruction or identification.

aaopen implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS): All data in transit between your device and the aaopen Platform is protected by 256-bit SSL/TLS encryption.
• Password hashing: User passwords are stored using strong cryptographic hashing algorithms. aaopen does not store passwords in plain text, and aaopen staff cannot read your password.
• Access controls: Access to systems containing personal data is restricted to authorised personnel on a need-to-know basis and is subject to role-based access controls and audit logging.
• Two-factor authentication (2FA): aaopen provides SMS-based 2FA for user accounts and requires 2FA for administrative access to systems containing personal data.
• Regular security assessments: The Platform undergoes periodic security reviews and vulnerability assessments to identify and remediate potential weaknesses.

While aaopen takes all reasonable steps to protect your data, no online system is completely immune to risk. You are encouraged to use a strong, unique password and to enable 2FA on your aaopen account.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by aaopen:

• Right to be informed: The right to know what personal data aaopen holds about you, how it is being used, and with whom it has been shared.
• Right to access: The right to request a copy of your personal data held by aaopen, subject to identity verification.
• Right to correction: The right to request that inaccurate, incomplete, or outdated personal data be corrected without unreasonable delay.
• Right to erasure: The right to request deletion of your personal data in certain circumstances, such as where the data is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations.
• Right to data portability: The right to receive a copy of your personal data in a commonly used, machine-readable format for transfer to another data controller, where technically feasible.
• Right to object: The right to object to certain processing activities, including direct marketing and processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact the aaopen Data Protection Officer using the details in Section 16. aaopen will respond to all verified data rights requests within thirty (30) days. In complex cases, this period may be extended to sixty (60) days with notification of the extension and reasons.

The aaopen platform is strictly prohibited to persons under 21 years of age, consistent with Philippine law and PAGCOR regulations applicable to online casino gaming. aaopen does not knowingly collect personal data from individuals under 21 years of age.

If aaopen becomes aware that personal data has been collected from an individual below the minimum age requirement, that data will be deleted as soon as practicable and the associated account will be permanently closed. Deposited funds from ineligible accounts may be subject to regulatory procedures before return.

If you believe that aaopen has inadvertently collected data from a minor, please contact the aaopen support team or Data Protection Officer immediately at the contact details provided in Section 16.

The aaopen Platform is operated with Philippine players as its primary user base. Certain technical service providers, including cloud infrastructure, game providers, and KYC verification services, may be located outside the Philippines.

Where personal data is transferred to a country outside the Philippines, aaopen ensures that appropriate safeguards are in place to protect the data, consistent with the requirements of the Data Privacy Act of 2012. Such safeguards may include:

• Data processing agreements that impose obligations equivalent to those in RA 10173 on the receiving party.
• Transfer to recipients in jurisdictions recognised by the National Privacy Commission as providing adequate data protection.
• Standard contractual clauses or other approved transfer mechanisms.

The aaopen platform integrates third-party game content and services provided by licensed game studios and live casino operators. When you play a game supplied by a third-party provider, limited technical and gameplay data may be transmitted to that provider to enable the game to function correctly and to verify game outcomes.

Each third-party provider operates under its own privacy policy and data processing practices. aaopen requires all third-party providers to maintain appropriate data protection standards as a condition of their integration with the Platform. However, aaopen is not responsible for the independent data practices of third-party providers beyond the data processing obligations contractually imposed on them by aaopen.

aaopen may send promotional communications — including bonus offers, new game announcements, and platform updates — to registered members who have opted in to receive such communications at the time of registration or subsequently through account settings.

You may opt out of marketing communications at any time by:

• Updating your notification preferences in the aaopen Account Settings dashboard.
• Replying STOP to any SMS promotional message received from aaopen.
• Contacting the aaopen support team and requesting removal from marketing lists.

Opting out of marketing communications does not affect transactional communications, including deposit confirmations, withdrawal notifications, security alerts, and account status updates, which are necessary for service delivery.

aaopen may update this Privacy Policy from time to time to reflect changes in data processing practices, legal or regulatory requirements, or platform features. When material changes are made, aaopen will provide notice through one or more of the following channels: in-platform notification, email to your registered address, or a prominent announcement on the aaopen website.

The "Last Reviewed" date at the top of this Policy reflects the date of the most recent revision. Your continued use of the aaopen platform following the effective date of any update constitutes your acknowledgment of the revised Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how aaopen protects your personal data.

For all privacy-related inquiries, data rights requests, or concerns regarding aaopen's handling of your personal data, please contact us using the following details:

• Data Protection Officer, aaopen
• Email: [email protected]
• Subject Line: Please include "Privacy Request" or "Data Rights" in the subject line of your email.
• Live Chat: Available 24/7 at aaopen.org — please state that your query is privacy-related at the start of the chat.

aaopen commits to acknowledging all privacy-related inquiries within three (3) business days and to resolving them within the statutory timeframes prescribed by the Data Privacy Act of 2012.

If you are not satisfied with aaopen's response to a privacy complaint, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines.