sugal Privacy Policy

This Privacy Policy applies to all personal data collected, processed, stored, or disclosed by sugal (hereinafter "sugal," "we," "us," or "our") in connection with your use of the sugal online gaming platform, accessible at sugal.one and its associated subdomains, applications, and services (collectively, the "Platform").

This Policy is intended to comply with Republic Act No. 10173, the Data Privacy Act of 2012 of the Republic of the Philippines, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). It also reflects applicable obligations under PAGCOR's regulatory framework and the Anti-Money Laundering Act (RA 9160, as amended).

By accessing the Platform, creating an account, making a deposit, or placing a wager on sugal, you confirm that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must discontinue use of the Platform and may request account closure by contacting sugal support.

For the purposes of the Data Privacy Act of 2012, sugal is the personal information controller in respect of all personal data processed through the Platform. This means sugal determines the purposes and means of processing your personal information.

sugal has designated a Data Protection Officer (DPO) as required by the DPA Implementing Rules and Regulations. The DPO is responsible for overseeing sugal's compliance with data privacy obligations and serves as the primary point of contact for player privacy inquiries and rights requests.

Contact details for the DPO are provided in Section 16 of this Policy.

sugal collects the following categories of personal data. The specific data points collected will depend on the nature of your interaction with the Platform:

3.1 Identity & Registration Data

• Full legal name (first name, middle name, last name)
• Date of birth and age confirmation (21+ verification)
• Nationality and country of residence
• Government-issued identification number and document type (e.g., Philippine passport, UMID, SSS ID, driver's license)
• Photograph or scan of identification document (for KYC purposes)
• Residential address (street, barangay, city/municipality, province, postal code)

3.2 Contact Data

• Email address registered on your sugal account
• Philippine mobile phone number (used for OTP and communication)

3.3 Financial & Payment Data

• GCash mobile number or account identifier
• Maya account identifier
• Bank account details for BPI, BDO, Metrobank, or other registered Philippine banks (account name, account number, branch — not full account credentials)
• Deposit amounts, transaction timestamps, and reference numbers
• Withdrawal requests, amounts, and processing status
• Currency conversion records where applicable

3.4 Account & Gaming Activity Data

• Account login history, including timestamps and IP addresses
• Game session records — games played, wagers placed, outcomes, and session duration
• Account balance history and transaction log
• Bonus and promotion claims and redemption history
• Responsible gaming settings and limit configurations
• Self-exclusion or account restriction records

3.5 Technical & Device Data

• IP address and approximate geolocation (province/city level)
• Device type, operating system, and browser version
• Session cookies and technical identifiers (see Section 9)
• Platform interaction logs (pages visited, features accessed, errors encountered)

3.6 Communications Data

• Content of customer support interactions via live chat, email, or in-platform messages
• Records of promotional communications sent to and responses from your account
• Complaint and dispute correspondence

sugal collects personal data through the following channels:

4.1 Directly from You

The majority of personal data sugal holds is provided directly by you during the registration process, account verification, payment transactions, or when you contact our support team. This includes all identity, contact, and financial data described in Section 3.

4.2 Automatically During Platform Use

When you access and use the sugal Platform, certain technical data is collected automatically via server logs, cookies, and analytics tools. This includes IP address, device information, session data, and interaction logs. See Section 9 for full details on cookie usage.

4.3 From Payment Service Providers

When you make a deposit or withdrawal via GCash, Maya, or a Philippine bank, the relevant payment service provider shares transaction confirmation data with sugal to verify the payment. sugal receives only the data necessary to confirm the transaction — we do not receive your GCash PIN, bank login credentials, or full account number.

4.4 From Identity Verification Partners

For enhanced KYC procedures, sugal may use third-party identity verification services to cross-reference the identity documents you submit. These providers are data processors operating under contractual data processing agreements with sugal and may not use your data for any purpose other than the verification service they are contracted to provide.

4.5 From Regulatory Bodies

In limited circumstances, sugal may receive data from PAGCOR, the AMLC, or other Philippine regulatory agencies in the exercise of their oversight functions, for example in connection with a player exclusion register or suspicious transaction inquiry.

sugal processes your personal data only for the specific, declared purposes listed below. We do not use your data for any purpose incompatible with those disclosed here without your separate consent:

Under the Data Privacy Act of 2012, sugal processes your personal data on the following legal bases:

• Contractual necessity: Processing required to establish and perform the player account agreement — including registration, payment processing, and provision of gaming services.
• Legal obligation: Processing required to comply with PAGCOR regulations, Anti-Money Laundering Act obligations, National Privacy Commission requirements, and other applicable Philippine laws.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and improvement of sugal's services — where these interests are not overridden by your rights and interests.
• Consent: Processing for optional activities such as receiving marketing communications and promotional notifications. Consent may be withdrawn at any time without affecting other processing activities that rely on a different legal basis.

sugal does not sell, rent, or trade your personal information. We share personal data with third parties only in the following specific circumstances:

7.1 Payment Service Providers

sugal shares the minimum necessary data with GCash, Maya, BPI, BDO, Metrobank, Coins.ph, and other payment processors to facilitate deposits and withdrawals. These providers receive only the transaction and identity data needed to verify and process the specific payment.

7.2 Identity Verification Services

Third-party KYC verification providers receive identity document data for the sole purpose of verifying your identity against Philippine national databases or document authenticity standards. These providers operate under strict data processing agreements.

7.3 Regulatory and Law Enforcement Authorities

sugal is required by Philippine law to disclose personal data and transaction records to PAGCOR, the AMLC, the NPC, or other competent authorities upon valid legal demand, in connection with gaming license obligations, AML investigations, or law enforcement requests. sugal will notify the affected player of any such disclosure where legally permitted to do so.

7.4 Technical Service Providers

sugal uses third-party service providers for platform hosting, data storage, analytics, and customer support tools. These providers act as data processors under contractual agreements that require them to process player data solely on sugal's instructions and to maintain appropriate security measures. They may not use your data for their own independent purposes.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of sugal's assets, personal data may be transferred to the successor entity as part of that transaction. Players will be notified prior to any such transfer and given the opportunity to request account closure if they do not wish to continue under the new operator.

The sugal Platform is operated primarily within the Philippines. Some technical service providers — including cloud infrastructure and analytics tools — may process data in data centers located outside the Philippines. Where such transfers occur, sugal ensures that:

• The recipient jurisdiction provides an adequate level of data protection, as recognized by the NPC; or
• Appropriate safeguards are in place, such as standard contractual clauses or binding corporate rules, as required by the DPA Implementing Rules and Regulations; and
• The transfer is limited to the minimum data necessary for the specific service being provided.

Players may request information about the specific countries to which their data may be transferred by contacting the DPO at [email protected].

sugal uses cookies and similar technologies to operate the Platform, maintain your session, prevent fraud, and analyze usage patterns. The following categories of cookies are used:

9.1 Strictly Necessary Cookies

These cookies are essential for the Platform to function. They maintain your login session, store security tokens, and enable core features such as the game lobby, cashier, and account settings. These cookies cannot be disabled without breaking essential Platform functionality.

9.2 Functional Cookies

These cookies remember your preferences — such as language settings, responsible gaming limits, and your recently played games shortlist — so you don't have to reconfigure them every session on sugal. They are not used for tracking across other websites.

9.3 Analytics Cookies

sugal uses anonymized, aggregated analytics to understand how players navigate the Platform — for example, which game categories are accessed most, where players encounter loading issues, and how support chat is used. This data does not identify individual players and is used exclusively to improve the sugal experience.

9.4 Managing Cookies

You can manage or disable non-essential cookies through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the Platform. Instructions for managing cookies in Chrome, Safari, and other major mobile browsers are available through those applications' help sections.

sugal implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption at rest: All personal data stored in sugal's systems is encrypted using AES-256 encryption. This includes identity documents, payment records, and account data.
• Encryption in transit: All data transmitted between your device and sugal's servers is protected by TLS 1.3. The connection security is indicated by the HTTPS protocol in your browser.
• Password security: Player passwords are stored using bcrypt hashing with individual salts. Plaintext passwords are never stored, logged, or accessible to any sugal staff member.
• Access controls: Access to player data is restricted to authorized personnel on a strict need-to-know basis. All internal access to personal data is logged and subject to periodic audit.
• Two-factor authentication: sugal offers SMS OTP-based 2FA for player accounts and mandates 2FA for all staff accounts with access to player data.
• Penetration testing: sugal conducts regular security assessments and penetration tests on the Platform infrastructure. Critical findings are remediated on a priority basis.
• Incident response: sugal maintains a documented data breach response plan consistent with NPC requirements. See Section 14 for breach notification procedures.

sugal retains personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law. The following retention schedule applies:

Upon expiry of the applicable retention period, sugal securely destroys or anonymizes the relevant data using methods that prevent reconstruction or identification. Secure deletion logs are maintained for audit purposes.

As a data subject under Republic Act No. 10173, you have the following rights in respect of your personal data held by sugal. To exercise any of these rights, contact our Data Protection Officer at [email protected] with the subject line "DPA Rights Request." Requests will be acknowledged within 2 business days and resolved within 30 calendar days.

The sugal Platform is strictly intended for individuals who are 21 years of age or older as required by PAGCOR. sugal does not knowingly collect or process personal data belonging to individuals under the age of 21. All accounts are subject to age verification at registration.

If sugal becomes aware that personal data has been collected from a person under 21 years of age, the Account will be immediately closed, all associated personal data will be deleted to the extent permitted by applicable legal retention obligations, and any funds deposited will be returned to the originating payment method. Any winnings generated on an underage account are not payable.

If you believe a minor has registered an account on sugal, please contact our DPO immediately at [email protected] so that the matter can be investigated and resolved promptly.

In the event of a personal data breach that is likely to result in serious harm to affected data subjects — including unauthorized access, disclosure, or destruction of personal data — sugal will:

• Notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, or as soon as practicable, as required by the DPA Implementing Rules;
• Notify affected players whose data was compromised without undue delay, providing a description of the breach, the categories and approximate number of data subjects affected, the likely consequences of the breach, and the measures taken or proposed to address the breach;
• Maintain an internal register of all data breaches, including those not required to be reported externally, for audit and compliance purposes;
• Conduct a post-incident review to identify root causes and implement remediation measures to prevent recurrence.

Notifications to affected players will be sent to the registered email address associated with the affected account. Players are encouraged to maintain an active and monitored email address in their sugal account settings.

sugal reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulations, NPC issuances, or sugal's data processing practices. Changes will be classified as follows:

• Material changes — changes that significantly affect how we use your data or your rights as a data subject — will be communicated by email to your registered address at least 14 days before taking effect, and a notice will be displayed on the Platform.
• Minor changes — clarifications, typographical corrections, or updates that do not materially affect player rights — may be published immediately without individual notice.

The effective date of the current version of this Policy is displayed at the top of the document. Continued use of the sugal Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree with any change, you may request account closure by contacting [email protected].

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data by sugal, please contact our Data Protection Officer using the details below. sugal is committed to addressing all data privacy inquiries promptly and transparently.

If you believe sugal has violated your data privacy rights under the Data Privacy Act of 2012 and our internal resolution process has not adequately addressed your concern, you may file a formal complaint with the National Privacy Commission (NPC) of the Philippines.