9awim Privacy Policy

Welcome to the 9awim Privacy Policy. 9awim ("we", "us", "our") is committed to protecting the personal data of every player, visitor, and user ("you", "your") who interacts with our platform at 9awim.net. We take our obligations under Philippine data privacy law seriously, and this document sets out — in full and in plain language — exactly how we handle your information.

This Policy applies to:

• All visitors to the 9awim website, whether registered or not.
• All registered 9awim account holders and active players.
• Any person who contacts 9awim through our customer support channels, including live chat and email.
• Any person who subscribes to 9awim promotional communications.

By using the 9awim platform in any of the ways described above, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue your use of the platform and contact us to request account closure and data deletion where applicable.

This Privacy Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated by reference into our overall agreement with you.

For the purposes of the Data Privacy Act of 2012 (RA 10173), 9awim is the personal information controller responsible for the personal data collected through the 9awim platform. This means we determine the purposes for which and the means by which your personal data is processed.

9awim operates as a PAGCOR-licensed online casino and sports betting platform serving Filipino players across Metro Manila, Cebu, Davao, Quezon City, Makati, and throughout the Philippine archipelago. Our operations are subject to oversight by:

• Philippine Amusement and Gaming Corporation (PAGCOR) — our primary gaming regulator.
• National Privacy Commission (NPC) — the independent government agency responsible for enforcing the Data Privacy Act.
• Anti-Money Laundering Council (AMLC) — to whom we are required to report certain financial transactions under Philippine AML law.

Our designated Data Protection Officer (DPO) oversees all data privacy matters at 9awim. You may contact our DPO directly at [email protected] with the subject line "Data Privacy — DPO Inquiry" for any privacy-related concerns.

9awim collects personal data in several categories depending on your relationship with the platform. The following table provides a comprehensive overview of the categories of data we collect and the specific data points within each category:

9awim collects personal data through the following channels and mechanisms:

• Direct Registration: When you create a 9awim account, you actively provide your name, date of birth, email address, mobile number, and residential address through our registration form.
• Identity Verification (KYC): When you reach deposit, withdrawal, or regulatory thresholds, we request copies of government-issued identification documents and proof of address. These are submitted directly through our secure document upload system.
• Financial Transactions: Each time you make a deposit or withdrawal using GCash, Maya, BPI, BDO, Metrobank, InstaPay, GrabPay, or 7-Eleven, our payment processing system captures transaction metadata required for accounting and AML compliance.
• Platform Usage: Our systems automatically log technical data — including your IP address, device information, and session activity — every time you access the platform, whether logged in or not. This data is collected passively for security and platform performance purposes.
• Customer Support Interactions: When you contact our support team via live chat or email, the content of those communications and any personal data shared within them is captured and stored as part of your support record.
• Cookies and Similar Technologies: Our website uses cookies and similar tracking technologies to maintain your session, remember your preferences, and analyse platform usage. See Section 9 for full details on our Cookie Policy.

9awim processes your personal data only where we have a valid legal basis to do so under RA 10173. The legal bases we rely on are: (a) fulfilment of a contract with you; (b) compliance with a legal obligation; (c) legitimate interests of 9awim that do not override your rights; and (d) your freely given, specific, and informed consent.

The following table maps each processing purpose to its legal basis:

9awim does not share your personal data with third parties except in the limited circumstances described below. In all cases where data is shared with a third-party service provider, we require contractual assurances that they will protect your data to the same standard required by Philippine law.

• Payment Processors: GCash (GXI), Maya (Voyager Innovations), GrabPay, BancNet (for bank transfers), and payment aggregators receive the minimum transaction data necessary to process your deposits and withdrawals.
• Identity Verification Providers: We use trusted third-party KYC service providers to verify identity documents. These providers are bound by data processing agreements that restrict them to using your data solely for verification purposes.
• Game Content Providers: RNG and live dealer game providers may receive a pseudonymous player ID and session token to deliver game content. They do not receive your full identity or financial data.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies as required by law. Disclosure to these bodies is mandatory and does not require your additional consent.
• IT and Cloud Infrastructure Providers: Hosting, database management, and cybersecurity service providers who process data solely on 9awim's instructions and are prohibited from using it for any other purpose.
• Professional Advisors: Legal counsel, auditors, and compliance consultants engaged by 9awim, subject to professional confidentiality obligations.

9awim retains personal data for no longer than is necessary for the purposes for which it was collected, taking into account our legal, regulatory, and contractual obligations. The following retention periods apply:

• Account and identity data: Retained for the lifetime of your account plus 5 years after account closure, in compliance with PAGCOR record-keeping requirements and the Anti-Money Laundering Act's 5-year transaction record retention mandate.
• Transaction and financial records: Retained for 5 years from the date of the transaction, as required by AMLA and Bureau of Internal Revenue regulations.
• KYC documents: Retained for 5 years after the end of the business relationship, in line with PAGCOR and AMLC requirements.
• Customer support communications: Retained for 3 years from the date of the last interaction, for dispute resolution purposes.
• Marketing data: Retained until you withdraw consent or request deletion, whichever occurs first.
• Technical / server logs: Retained for 12 months for security monitoring and fraud prevention purposes.

Once the applicable retention period expires, your personal data will be securely deleted or anonymised such that it can no longer be attributed to you as an identified individual. Anonymised aggregated data (e.g., platform usage statistics) may be retained indefinitely for analytical purposes as it no longer constitutes personal data.

9awim implements a layered, defence-in-depth security architecture to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• Transport Layer Security (TLS/SSL): All data transmitted between your browser or mobile device and 9awim servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all pages and APIs.
• Encryption at Rest: Sensitive personal and financial data stored in our databases is encrypted using AES-256, an industry-standard symmetric encryption algorithm.
• Access Controls: 9awim staff access to personal data is strictly role-based and governed by the principle of least privilege. Access logs are maintained and reviewed regularly.
• Two-Factor Authentication (2FA): Players are strongly encouraged to enable 2FA on their accounts. 9awim staff access to production systems requires mandatory 2FA.
• Penetration Testing: We engage independent cybersecurity firms to conduct regular penetration tests and vulnerability assessments of our platform infrastructure.
• Incident Response Plan: 9awim maintains a documented incident response plan that activates automatically in the event of a suspected data breach, ensuring rapid containment and the 72-hour NPC notification requirement is met.
• Staff Training: All 9awim employees and contractors who handle personal data undergo mandatory data privacy and security training upon onboarding and annually thereafter.

While 9awim takes every reasonable precaution to secure your personal data, no security system is completely impenetrable. We encourage you to protect your own account by using a strong, unique password and enabling 2FA. Never share your login credentials with anyone.

9awim uses cookies — small text files stored on your device — and similar technologies to operate and improve the platform. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential to the functioning of the platform. These enable you to log in, maintain your session, and navigate securely between pages. They cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and whether you have dismissed certain notifications. These improve your experience but are not strictly required.
• Analytics Cookies: Collect aggregated, anonymised information about how players use the platform — which pages are visited most, how long sessions last, and where users encounter difficulties. This data is used exclusively to improve platform performance and UX.
• Security Cookies: Help detect and prevent fraudulent activity, bot traffic, and account takeover attempts. These are strictly necessary and cannot be opted out of.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary or security cookies will impair your ability to use the 9awim platform. For detailed instructions on managing cookies in your specific browser, refer to your browser's help documentation.

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by 9awim. These rights are available to all registered players and, where applicable, to non-registered users whose data we hold:

• Right to Be Informed: You have the right to know that 9awim is collecting and processing your personal data, for what purposes, and how it is being used. This Privacy Policy fulfils that obligation.
• Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how it is processed. We will respond to verified access requests within 15 calendar days.
• Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You can update most profile information directly through your account settings.
• Right to Erasure (Right to be Forgotten): You may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, and where no overriding legal obligation requires us to retain it. Note that certain data must be retained for regulatory compliance periods as described in Section 7.
• Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis. You may also withdraw consent to marketing communications at any time.
• Right to Data Portability: You may request a machine-readable copy of the personal data you have provided to us, for the purpose of transmitting it to another service provider.
• Right to Lodge a Complaint: If you believe 9awim has violated your data privacy rights, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines via their official website or their Manila office.

To exercise any of the rights above, please contact our Data Protection Officer at [email protected] with the subject line "Data Privacy Rights Request". We will verify your identity before processing any request and will respond within 15 calendar days of receiving a complete, verified request.

9awim employs the following measures to prevent underage access and data collection:

• Date of birth is a mandatory field during registration, and accounts where the entered date of birth indicates the user is under 21 are blocked from completing registration.
• Identity verification (KYC) requires government-issued photo ID that confirms the account holder's age, providing a secondary check beyond self-declared date of birth.
• Any account found — following KYC review or a third-party report — to belong to a person under 21 will be immediately suspended, all funds held pending investigation, and the matter reported to PAGCOR as required.

If you are a parent or guardian and believe your child has registered on the 9awim platform without your knowledge, please contact our support team at [email protected] immediately. We will prioritise the investigation and closure of any such account.

As a digital platform, some of 9awim's third-party service providers — including cloud hosting infrastructure, content delivery networks, and certain game providers — may be located outside the Philippines. Where personal data is transferred to a country that does not provide a level of data protection equivalent to Philippine law, 9awim implements appropriate safeguards to protect your data, including:

• Binding Data Processing Agreements (DPAs) that require overseas processors to handle Filipino user data in accordance with RA 10173 and NPC regulations.
• Contractual clauses that grant 9awim the right to audit overseas processors' data security practices.
• Selection of cloud and infrastructure providers that hold internationally recognised security certifications (e.g., ISO 27001, SOC 2 Type II).

In all cases, the transfer of your personal data outside the Philippines is subject to the requirements of the Data Privacy Act of 2012 and the NPC's guidelines on cross-border data transfers. 9awim will not transfer your data to a third country without first ensuring that adequate protections are in place.

9awim reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or platform operations. When we make material changes to this Policy, we will:

• Update the "Last Updated" date displayed at the top of this page.
• Post a prominent notice on the 9awim platform notifying registered players of the change.
• Where the change significantly affects your rights or how we use your data, send a direct notification to your registered email address at least 14 days before the change takes effect.

Your continued use of the 9awim platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you have the right to close your account and request deletion of your personal data (subject to mandatory regulatory retention periods as described in Section 7).

We encourage you to review this Privacy Policy periodically to stay informed about how 9awim protects your personal data. The current version of this Policy is always available at 9awim.net/privacy-policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or 9awim's data processing practices, you are welcome to reach out to our Data Protection Officer directly. We are committed to responding to all privacy-related inquiries promptly and transparently.

For complaints that have not been resolved to your satisfaction through our internal process, you may escalate your concern to the National Privacy Commission (NPC) of the Philippines, which is the supervisory authority responsible for enforcing the Data Privacy Act of 2012. The NPC is headquartered at 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City, Metro Manila.

We value the trust that our Filipino players place in 9awim with their personal data. Protecting that trust is not just a legal obligation — it is a core commitment that underpins everything we do.