x999 Privacy Policy

This Privacy Policy ("Policy") describes how x999 ("x999," "we," "us," "our") collects, uses, stores, discloses, and protects the personal data of individuals ("you," "Player," "User") who access and use the x999 online gaming platform at x999.vu, including all associated websites, mobile interfaces, applications, and services.

x999 operates as a Personal Information Controller (PIC) as defined under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, hereinafter "DPA") and its Implementing Rules and Regulations. This Policy is issued in compliance with the DPA, National Privacy Commission (NPC) issuances, and all other applicable data protection legislation in the Philippines.

This Policy applies to all players who have registered an account with x999, all visitors who browse the x999 website without a registered account, all individuals who contact x999 via customer support channels, and all individuals whose personal data x999 receives through third-party partners in the course of providing platform services.

x999 is the personal information controller responsible for the personal data collected through the x999 platform. x999 operates under applicable Philippine gaming regulations and is subject to PAGCOR oversight in relation to the gaming activities conducted through the platform.

x999 has appointed a Data Protection Officer (DPO) who is responsible for overseeing the platform's compliance with the Data Privacy Act and this Privacy Policy. Contact details for x999's DPO are provided in Section 16 of this Policy.

Players located in the Philippines and accessing x999 from Philippine territory are the primary audience for this Policy. x999 acknowledges the specific privacy rights accorded to Philippine data subjects under RA 10173 and commits to honouring those rights in full.

x999 collects personal data in several categories, depending on the nature of your interaction with the platform. The following table summarises the categories of data collected and their purpose:

3.1 Sensitive Personal Information

Under RA 10173, certain categories of personal data are classified as Sensitive Personal Information (SPI) and are subject to heightened protection requirements. x999 may process the following SPI where strictly necessary: government identification numbers (for KYC purposes), financial account details (for payment processing), and health information (where voluntarily disclosed in connection with a responsible gaming self-exclusion request). x999 processes SPI only on the bases permitted under RA 10173 — primarily consent and legal obligation — and applies additional security controls to SPI storage and access.

x999 collects personal data through the following channels:

4.1 Directly from You

• Account Registration: When you create an x999 account, you provide your mobile number, email address, date of birth, and residential address.
• KYC Verification: When you submit identity documents and photographs to complete the verification process required for full account access and withdrawals.
• Payment Transactions: When you make deposits or request withdrawals, payment reference information associated with your GCash, Maya, BPI, BDO, Metrobank, UnionBank, 7-Eleven, USDT, or Coins.ph accounts is collected.
• Customer Support: When you contact x999's support team via live chat or email, the content of those communications is collected and retained.
• Responsible Gaming Requests: When you set deposit limits, request self-exclusion, or complete problem gambling self-assessments through your account settings.

4.2 Automatically Through Platform Use

• IP address and geolocation data when you connect to x999.
• Device and browser information recorded when you access the x999 platform.
• Session data including login times, pages visited, games accessed, and duration of play.
• Cookies, web beacons, and similar tracking technologies as described in Section 8.

4.3 From Third-Party Sources

• Identity Verification Providers: x999 may receive confirmation data from third-party KYC services used to verify the authenticity of submitted identity documents.
• Payment Processors: Transaction confirmation data from GCash, Maya, and other payment providers.
• Fraud and AML Screening: Screening results from compliance service providers used for anti-money laundering and fraud prevention purposes.
• PAGCOR and Law Enforcement: x999 may receive information from PAGCOR or Philippine law enforcement in the course of regulatory compliance and investigations.

Under RA 10173, x999 processes your personal data on one or more of the following lawful bases:

• Consent (Section 12(a), RA 10173): Where you have provided clear, voluntary, specific, informed, and evidenced consent — for example, when you agree to this Privacy Policy upon account registration, or when you opt in to marketing communications.
• Contractual Necessity (Section 12(b), RA 10173): Processing that is necessary for x999 to perform the contract with you — i.e., to provide online gaming services, process payments, manage your account, and deliver customer support.
• Legal Obligation (Section 12(c), RA 10173): Processing required to comply with applicable law, including PAGCOR regulations, the Anti-Money Laundering Act (RA 9160, as amended), the DPA itself, and applicable tax and financial reporting obligations.
• Legitimate Interests (Section 12(f), RA 10173): Processing necessary for x999's legitimate interests, where those interests are not overridden by your data protection rights — including fraud detection, security monitoring, platform analytics, and responsible gaming monitoring.

x999 uses the personal data we collect for the following purposes:

6.1 Account and Service Delivery

• Creating and managing your x999 account, including processing your registration and maintaining your account profile.
• Processing deposits and withdrawals via GCash, Maya, Philippine bank transfers, and other supported payment methods.
• Delivering the games, features, promotions, and services available through the x999 platform.
• Sending account-related communications including transaction confirmations, account status updates, and security alerts via SMS to your registered Philippine mobile number.

6.2 Identity Verification and Compliance

• Verifying that you are at least 21 years of age as required by PAGCOR regulations.
• Verifying your identity for KYC purposes before processing withdrawals above applicable thresholds.
• Screening your identity against sanctions lists, PAGCOR self-exclusion registers, and other legally required exclusion databases.
• Fulfilling anti-money laundering (AML) obligations under RA 9160 and related AMLC regulations.

6.3 Security and Fraud Prevention

• Detecting, investigating, and preventing fraud, bonus abuse, account takeover attempts, and other prohibited activities.
• Monitoring login locations and device usage to identify suspicious access patterns and protect your account security.
• Maintaining the integrity of x999's games and betting markets.

6.4 Responsible Gaming

• Operating x999's responsible gaming tools including deposit limits, loss limits, session timers, and self-exclusion.
• Monitoring gaming behaviour patterns to identify indicators of problem gambling and providing appropriate interventions as required by PAGCOR's responsible gaming framework.

6.5 Platform Improvement and Analytics

• Analysing aggregated and anonymised usage data to understand how players interact with the x999 platform and to identify opportunities for improvement.
• Testing new features, game formats, and platform updates before general release.

6.6 Marketing Communications

Where you have provided consent, x999 may send you promotional communications about new games, bonuses, and special offers via SMS or email. You may withdraw your consent to marketing communications at any time by updating your account notification preferences or contacting x999 support. Withdrawing marketing consent does not affect your account access.

x999 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. x999 shares personal data only in the circumstances described below, and only to the extent necessary for the stated purpose.

7.1 Service Providers (Personal Information Processors)

x999 engages third-party service providers who process personal data on x999's behalf as Personal Information Processors (PIPs) under RA 10173. These include:

• KYC and Identity Verification Services: To verify government-issued identification documents submitted during account registration.
• Payment Processors: Including GCash, Maya, BPI, BDO, Metrobank, UnionBank, and other payment service providers to facilitate deposits and withdrawals.
• Game Providers: Game studios including Pragmatic Play, PG Soft, Jili Games, Habanero, and others who deliver game content through the x999 platform. Game providers receive only the data necessary to deliver game sessions and calculate outcomes.
• Fraud and AML Screening Providers: Third-party services used to screen transactions and accounts against sanctions lists and fraud databases.
• Cloud Infrastructure and Hosting Providers: Who host x999's platform infrastructure under strict confidentiality and security obligations.
• Customer Support Technology Providers: Who provide the live chat and ticketing infrastructure used by x999's support team.

All Personal Information Processors are engaged under written data processing agreements that require them to process data only on x999's instructions, maintain appropriate security measures, and comply with RA 10173.

7.2 Regulatory and Legal Disclosure

x999 may disclose personal data to the following authorities where required by law or legally enforceable demand:

• PAGCOR — for gaming regulatory compliance, licence monitoring, and player protection purposes.
• Anti-Money Laundering Council (AMLC) — for AML/CTF reporting obligations under RA 9160.
• National Privacy Commission (NPC) — in connection with data breach notifications or regulatory investigations.
• Philippine law enforcement agencies — pursuant to lawful court orders, subpoenas, or other legally enforceable processes.
• Bureau of Internal Revenue (BIR) — where gaming tax reporting obligations require disclosure of player winnings data.

7.3 Business Transfers

In the event of a merger, acquisition, corporate restructuring, or sale of all or part of x999's assets, personal data held by x999 may be transferred to the acquiring entity as part of the transaction. Players will be notified of any such transfer and the applicable privacy protections at the earliest practicable opportunity.

x999 uses cookies and similar tracking technologies to provide a functional and personalised platform experience, maintain session state, support security monitoring, and gather analytics data that helps x999 understand how the platform is used.

8.1 Types of Cookies Used

• Essential Cookies: Required for basic platform functionality — including maintaining your login session, storing your preferences, and enabling the cashier to function. These cookies cannot be disabled without impairing your ability to use x999.
• Security Cookies: Used to detect fraudulent login attempts, protect against cross-site request forgery (CSRF), and monitor for suspicious session activity. These cookies are necessary for account protection and cannot be disabled.
• Analytics Cookies: Collect aggregated and anonymised data about how players navigate and use x999 — which games are played most, how long sessions last, which features are used. This data is used solely for platform improvement and is not shared with third-party advertising networks.
• Preference Cookies: Store your display preferences, language settings, and other personalisation choices to improve your experience on return visits.

8.2 Cookie Management

You may control non-essential cookies through your browser settings. Most modern browsers allow you to block or delete cookies, or to receive notifications before a cookie is placed. Note that disabling certain cookies may affect the functionality of the x999 platform — in particular, essential and security cookies are required for core account features to operate.

x999 does not use third-party advertising cookies or participate in behavioural advertising networks. The analytics tools x999 uses are configured to anonymise IP addresses and do not enable individual tracking across other websites.

x999 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, comply with applicable legal retention obligations, and support legitimate platform operations including fraud investigation and dispute resolution.

The following general retention principles apply:

• Account and Identity Data: Retained for the duration of your active account plus a minimum of five (5) years following account closure, as required by PAGCOR and AMLC retention obligations under RA 9160.
• Transaction and Financial Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with AMLC record-keeping requirements.
• KYC Documents: Retained for five (5) years following the date of submission or the date of account closure, whichever is later.
• Customer Support Logs: Retained for three (3) years from the date of the support interaction, to support dispute resolution and service quality improvement.
• Analytics Data: Aggregated and anonymised analytics data may be retained indefinitely, as anonymised data does not constitute personal data under RA 10173.
• Marketing Preferences: Retained until you withdraw consent to marketing communications, plus a reasonable period to ensure your opt-out has propagated to all relevant systems.

Upon expiry of the applicable retention period, x999 will securely destroy or anonymise personal data using methods appropriate to the sensitivity of the data and the medium on which it is stored.

x999 implements comprehensive technical, organisational, and administrative security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and x999 is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to the x999 website, mobile interface, and all API communications.
• Encryption at Rest: Sensitive personal data stored in x999's systems — including identity documents and payment details — is encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to personal data is restricted to authorised x999 personnel who require access to perform their job functions. Access rights are reviewed regularly and revoked promptly upon role change or departure.
• Multi-Factor Authentication: Internal systems containing personal data require multi-factor authentication for administrative access. x999 also offers two-factor authentication to players for their account login.
• Penetration Testing and Security Audits: x999 conducts regular security assessments including penetration testing of platform systems by qualified security professionals.
• Incident Response: x999 maintains a formal data breach incident response plan, including notification procedures to the NPC and affected players as required under NPC Circular 16-03.

Under the Philippine Data Privacy Act of 2012 and NPC implementing regulations, you have the following rights with respect to your personal data held by x999. x999 will respond to verifiable data subject requests within the timeframes prescribed by RA 10173.

To exercise any of these rights, contact x999's Data Protection Officer using the details in Section 16. x999 will verify your identity before processing any data subject request to protect your personal data from unauthorised access. Responses will be provided within thirty (30) days of receipt of a verifiable request, unless the complexity of the request requires an extension, in which case x999 will notify you of the extended timeline.

If you are not satisfied with x999's response to a data subject request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC's contact details are publicly available at the NPC's official website.

The x999 platform is strictly for adults aged 21 years and above. x999 does not knowingly collect personal data from individuals under the age of 21. The minimum age of 21 for casino-style gambling is mandated by PAGCOR regulations applicable to online gaming in the Philippines.

All account registrations undergo age verification to confirm that the registrant is at least 21 years old. If x999 discovers that personal data has been collected from a person under 21 — whether through misrepresentation of age or any other means — x999 will immediately close the account, return any deposited real-money funds to the original payment method, forfeit any bonus funds or winnings derived from bonus funds, and delete the collected personal data to the extent not required for legal compliance documentation.

x999's primary infrastructure and data storage is designed to comply with Philippine data localisation expectations. However, some of x999's third-party service providers — including certain game studios and cloud infrastructure providers — may be located outside the Philippines. Where personal data is transferred outside the Philippines, x999 ensures that appropriate safeguards are in place to protect your data.

These safeguards include: contractual data protection clauses consistent with NPC requirements, verification that the receiving country provides an adequate level of data protection, and implementation of technical security measures equivalent to those applied within the Philippines.

x999 does not transfer your financial data or sensitive personal information to jurisdictions that do not provide adequate data protection safeguards without your explicit consent or a specific legal basis under RA 10173.

The x999 platform integrates third-party game content from licensed studios. When you play a game provided by a third-party studio on x999, that game provider may collect certain technical data necessary to deliver the game session — such as session tokens and game outcome data. This data collection is governed by the game provider's own privacy practices and the data processing agreements between x999 and those providers.

The x999 platform does not contain links to external third-party websites for browsing or navigation purposes. Where x999 materials reference external organisations such as PAGCOR or the National Privacy Commission in a legal or regulatory context, those references are for informational purposes. x999 is not responsible for the privacy practices of any third party.

x999 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or PAGCOR and NPC regulatory guidance. The current version of this Policy is always available on this page and is identified by the "Effective Date" at the top of the document.

Where changes to this Policy are material — meaning they significantly affect how we collect, use, or share your personal data — x999 will provide registered players with at least 14 days' notice via the contact details associated with their account before the updated Policy takes effect. For non-material changes (such as clarifications or corrections), the updated Policy will take effect on the date of posting.

Your continued use of x999 after the effective date of any updated Policy constitutes your acceptance of the revised terms. If you do not agree with the updated Policy, you must stop using x999 and may request account closure.

If you have questions about this Privacy Policy, wish to exercise your data subject rights under RA 10173, or want to raise a data protection concern with x999, please contact x999's designated Data Protection Officer (DPO) through the following channels:

• Email: support@x999.vu — Subject line: "Data Privacy Request" or "DPO Inquiry" (plain text — this is not a clickable link).
• Live Chat: Available 24/7 through the x999 platform after logging in to your account. Identify your inquiry as a data privacy matter and request escalation to the DPO team if required.
• Response Time: x999 targets a DPO response within 3 business days for standard inquiries and within 30 days for formal data subject requests as required by RA 10173.

If you are not satisfied with x999's response to your data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines. The NPC's contact information is publicly available on the NPC's official government website.

x999 is committed to resolving privacy concerns raised by Filipino players in a timely, transparent, and respectful manner. Our DPO team is trained in Philippine data protection law and approaches every inquiry with the seriousness it deserves.