Spintine Privacy Policy — How We Handle Your Personal Data

1 About This Privacy Policy

This Privacy Policy applies to all personal information collected by Spintine in connection with your use of the Spintine online gaming platform, including the website, mobile interface, customer support channels, and any related services. It applies to registered account holders as well as visitors to the Spintine website who have not yet registered.

This policy should be read together with the Spintine Terms and Conditions, the Responsible Gaming Policy, and any other supplementary notices provided at the point of data collection, such as registration forms or promotional opt-ins. Where there is a conflict between a supplementary notice and this policy, the supplementary notice will apply to the specific processing activity it covers.

2 Data Controller

For the purposes of the Data Privacy Act of 2012 and other applicable Philippine data protection regulations, Spintine is the personal information controller in respect of all data collected through the platform. Spintine operates under a PAGCOR licence and is subject to the regulatory oversight of both PAGCOR and the National Privacy Commission of the Philippines.

Spintine has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance. The DPO can be contacted via the email address provided in Section 15 of this policy. Any requests, questions, or complaints relating to personal data should be directed to the DPO in the first instance.

3 Personal Data We Collect

Spintine collects the following categories of personal data in connection with account registration, platform use, and regulatory compliance:

Spintine does not collect sensitive personal information — such as health data, religious beliefs, or political affiliations — except where directly relevant to a responsible gaming assessment made at your request or as part of a regulatory requirement.

4 How We Collect Your Data

Spintine collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to a survey or promotional offer;
• Automatically — when you access the Spintine platform, technical data such as IP address, device type, and session information is collected through server logs and cookies;
• From third parties — identity verification providers, payment processors (GCash, Maya, bank partners), fraud prevention services, and PAGCOR or other regulatory bodies may provide or confirm information about you where required by law or platform operations.

You are not required to provide personal data to browse the Spintine website, but an account cannot be registered or operated without the minimum data required for identity verification and payment processing.

5 How Spintine Uses Your Personal Data

Spintine uses personal data for the following purposes:

• Account registration and management — creating and maintaining your Spintine account, verifying your identity, processing your KYC documentation, and keeping your account information current;
• Payment processing — processing deposits and withdrawals via GCash, Maya, InstaPay, PESONet, BDO, BPI, UnionBank, and card channels, and maintaining records of all transactions;
• Regulatory compliance — meeting PAGCOR licensing requirements, anti-money laundering (AML) obligations under Republic Act No. 9160, and age verification requirements under Philippine gaming regulations;
• Platform security and fraud prevention — monitoring account activity for unusual patterns, detecting multi-account abuse, investigating suspected fraud, and protecting the platform and other players from bad actors;
• Responsible gaming — monitoring gaming activity to identify patterns that may indicate problematic behaviour, enforcing account restrictions you have set yourself, and complying with regulatory responsible gaming requirements;
• Customer support — responding to your enquiries, resolving disputes, and improving our support processes;
• Platform improvement — using aggregated and anonymised usage data to understand how players interact with Spintine, identify technical issues, and develop new features;
• Marketing communications — sending you information about Spintine promotions, new games, and offers, but only where you have provided consent or where it is in our legitimate interest to do so and you have not opted out.

Spintine does not use personal data for automated decision-making that has a significant legal effect on you without human review, except where required by PAGCOR's regulatory framework or fraud prevention systems, in which case you may request human review of any automated decision.

6 Legal Basis for Processing

Under the Data Privacy Act of 2012, Spintine processes personal data on the following legal bases depending on the processing activity:

• Contractual necessity — processing required to operate your Spintine account and fulfil the Terms and Conditions you agreed to at registration, including payment processing and account maintenance;
• Legal obligation — processing required to comply with PAGCOR licensing conditions, AML regulations, tax reporting requirements, and other applicable Philippine law;
• Legitimate interests — processing for fraud prevention, platform security, and improving Spintine's services, where Spintine's interests are not overridden by your privacy rights;
• Consent — processing for marketing communications and optional platform features where you have provided explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

7 Sharing Your Personal Data

Spintine does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Personal data is shared only in the circumstances described below:

• Payment processors — GCash, Maya, InstaPay/PESONet partners, and bank channels receive the transaction data necessary to process your deposits and withdrawals. Each payment provider operates under its own privacy policy and applicable data protection requirements;
• Identity verification providers — third-party KYC service providers receive identity documents and related data solely for the purpose of verifying your identity as required by PAGCOR. These providers are bound by confidentiality and data protection agreements with Spintine;
• Regulatory authorities — PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine government bodies may receive data where required by law, court order, or regulatory direction. Spintine will notify you of such disclosures where legally permitted to do so;
• Fraud prevention services — third-party fraud detection platforms may receive technical data (IP addresses, device fingerprints, transaction patterns) to help Spintine identify and prevent fraudulent activity on the platform;
• Service providers — cloud infrastructure providers, customer support software vendors, and analytics providers may process data on Spintine's behalf under data processing agreements that require them to protect your data and use it only for the purposes Spintine specifies.

8 Cookies and Tracking Technologies

Spintine uses cookies and similar tracking technologies on the platform. Cookies are small text files stored on your device that help the platform remember your preferences, maintain your logged-in session, and analyse usage patterns.

The following types of cookies are used by Spintine:

• Essential cookies — required for the platform to function. These include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cannot be disabled without affecting platform functionality;
• Analytics cookies — used to understand how players navigate the platform, which features are used most frequently, and where technical issues occur. Data collected is aggregated and does not identify individual players;
• Preference cookies — store your platform settings such as language preference, notification settings, and display options;
• Marketing cookies — used only where you have consented to receive targeted promotional content. These cookies track which promotions you have viewed and interacted with.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using Spintine but may affect some personalisation features. Note that clearing your browser cookies will log you out of your Spintine session.

9 How Long We Keep Your Data

Spintine retains personal data for as long as your account remains active and for a minimum period after account closure as required by applicable Philippine law and PAGCOR's compliance obligations. The following retention periods apply:

• Account and identity data — retained for the duration of your account and for a minimum of five years following account closure, in compliance with AML record-keeping requirements under RA 9160;
• Transaction records — all deposit and withdrawal records are retained for a minimum of five years from the date of the transaction;
• Gaming activity data — bet history and game session records are retained for three years from the date of the activity;
• Customer support communications — retained for two years from the date of the interaction, or longer if the communication is relevant to an ongoing dispute or regulatory matter;
• Marketing data — retained until you withdraw consent or opt out of marketing communications, after which your preferences are updated and no further marketing is sent.

Where data is retained beyond your account's active period for legal compliance reasons, it is stored securely with access restricted to authorised personnel involved in compliance and legal functions. Data is deleted or anonymised once the applicable retention period expires.

10 How We Protect Your Data

Spintine implements technical and organisational security measures proportionate to the risks associated with processing your personal data. These measures include:

• SSL/TLS encryption for all data transmitted between your device and Spintine's servers;
• Encryption of sensitive data at rest, including financial account details and identity verification documents;
• Role-based access controls ensuring that staff can only access personal data relevant to their specific function;
• Regular security assessments and penetration testing of platform infrastructure;
• Logging and monitoring of all access to personal data for audit purposes;
• Staff training on data protection obligations and security practices.

Despite these measures, no internet-based platform can guarantee absolute security. If you suspect that your Spintine account has been compromised or that your personal data has been accessed without authorisation, please contact Spintine immediately at support@spintine.com. Spintine will investigate and take appropriate action, including notifying the National Privacy Commission where a reportable personal data breach has occurred.

11 Your Rights Under the Data Privacy Act

As a data subject under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights in respect of your personal data held by Spintine:

To exercise any of these rights, submit a written request to Spintine's Data Protection Officer at support@spintine.com. Spintine will respond within 15 business days of receiving a valid request. Identity verification may be required before certain requests are actioned to ensure that data is not disclosed to or modified at the request of an unauthorised party.

12 Children's Privacy

The Spintine platform is restricted to individuals aged 21 and above. Spintine does not knowingly collect personal data from persons under the age of 21. If you believe that a person under 21 has registered a Spintine account or provided personal data to the platform, please notify Spintine immediately at support@spintine.com.

Upon becoming aware of underage registration, Spintine will close the account, delete the associated personal data to the extent permitted by law, and handle any associated funds in accordance with PAGCOR's underage gambling procedures. Age verification checks are conducted as part of the KYC process for all registered accounts.

13 Cross-Border Data Transfers

Spintine's primary operations and data infrastructure are based in the Philippines. In some cases, personal data may be processed or stored by service providers located outside the Philippines — for example, cloud hosting providers or fraud detection platforms with servers in other jurisdictions.

Where personal data is transferred outside the Philippines, Spintine ensures that such transfers comply with the Data Privacy Act of 2012 and the regulations of the National Privacy Commission. This includes using contractual safeguards that require overseas processors to protect your data to standards equivalent to those required under Philippine law. Spintine will not transfer your data to a country that does not provide adequate privacy protections without implementing appropriate contractual or technical safeguards.

14 Updates to This Privacy Policy

Spintine may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or platform features. Where changes are material, Spintine will notify you via the email address registered to your account at least seven days before the changes take effect.

The date of the most recent update is shown at the top of this page and in the document header. We encourage you to review this policy periodically. Continued use of the Spintine platform after the effective date of any update constitutes acceptance of the revised policy.

15 How to Contact Us

For any privacy-related questions, requests to exercise your data rights, or complaints about how Spintine handles your personal data, please contact our Data Protection Officer using the details below:

If you are not satisfied with Spintine's response to your privacy complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines. The NPC is the government body responsible for enforcing the Data Privacy Act of 2012 and can be contacted through its official website and published contact channels.