sz77 Privacy Policy — How We Collect, Use, and Protect Your Personal Data

Introduction & Scope

This Privacy Policy ("Policy") is issued by sz77 and applies to all personal data collected through the sz77 online casino platform accessible at sz77.asia, including all associated web pages, mobile interfaces, and support communications channels ("the Platform").

This Policy explains how sz77 collects, processes, stores, shares, and protects personal data in accordance with Republic Act No. 10173 (the "Data Privacy Act of 2012" or "DPA"), its Implementing Rules and Regulations ("IRR"), and the issuances of the National Privacy Commission ("NPC") of the Philippines.

This Policy applies to all registered members, prospective members who have initiated but not completed registration, and any individual who provides personal data to sz77 through any channel — including customer support contact, KYC submission, or promotional participation.

Data Controller

The personal data controller for all data processed through the sz77 Platform is:

As data controller, sz77 determines the purposes and means of processing your personal data and is responsible for ensuring that processing is conducted lawfully, fairly, and transparently in accordance with the DPA and this Policy.

Personal Data We Collect

sz77 collects personal data through the following means: account registration forms, KYC document submissions, payment transactions, platform usage, customer support interactions, and — where you have provided consent — marketing communications.

The categories of personal data collected are:

sz77 does not intentionally collect sensitive personal information as defined under Section 3(l) of the DPA — including racial or ethnic origin, political opinions, religious beliefs, health information, and sexual orientation — except where this information is incidentally included in a government ID document submitted for KYC, in which case only the information necessary for identity verification purposes is processed.

Legal Basis for Processing

sz77 processes your personal data on the following legal bases as recognised under the Philippine Data Privacy Act:

• Contract performance: Processing necessary to register your account, process deposits and withdrawals, settle game outcomes, and manage your membership relationship with sz77;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act (Republic Act No. 9160, as amended) reporting requirements, and National Privacy Commission compliance obligations;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and analytics to improve the sz77 platform — where these interests are not overridden by your rights and interests;
• Consent: Processing for marketing communications (email, SMS) where you have expressly opted in. You may withdraw this consent at any time by updating your communication preferences in your account settings.

How We Use Your Personal Data

sz77 uses personal data collected from Filipino members for the following purposes:

• To create and manage your sz77 account, including verifying your identity and age as required under PAGCOR regulations and the DPA;
• To process deposits and withdrawals via GCash, Maya, BPI, BDO, UnionBank, and other supported payment channels;
• To settle game outcomes, calculate bonuses, and administer the sz77 loyalty program;
• To detect, investigate, and prevent fraud, money laundering, cheating, and other prohibited conduct under the sz77 Terms and Conditions;
• To operate responsible gaming monitoring — including flagging unusual betting patterns that may indicate problem gambling and enabling the use of self-exclusion and limit-setting tools;
• To comply with PAGCOR's player identity reporting requirements, AMLC covered and suspicious transaction reporting, and other regulatory obligations;
• To provide customer support through the 24/7 live chat and email channels;
• To send transactional communications (deposit confirmations, withdrawal notifications, account alerts) — these are necessary for account management and cannot be opted out of while your account is active;
• To send marketing communications about sz77 promotions and new game releases, where you have provided consent — you may opt out at any time;
• To analyze platform usage patterns using aggregated, anonymized data to improve the sz77 user experience.

sz77 does not use automated decision-making or profiling in ways that produce significant legal effects on members, with the exception of fraud detection systems that may flag accounts for human review.

Data Sharing & Third-Party Disclosure

sz77 does not sell, rent, or trade your personal data to third-party marketers or data brokers. Personal data is shared only in the following circumstances:

• Payment processors: GCash (Mynt), Maya (Voyager Innovations), BPI, BDO, UnionBank, and other payment service providers receive the minimum data necessary to process your deposit or withdrawal transaction;
• KYC verification providers: Identity verification service providers receive your submitted identification documents to perform age and identity verification on sz77's behalf, under data processing agreements that require GDPR/DPA-equivalent protections;
• Game software providers: Evolution Gaming, Asia Gaming, JILI, PG Soft, Pragmatic Play, and other game providers receive session data necessary to operate their games within the sz77 platform, under data processing agreements;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities, where sz77 is legally required to disclose information;
• Professional advisers: Legal counsel, auditors, and compliance consultants, under applicable professional confidentiality obligations;
• Business transfers: In the event of a merger, acquisition, or transfer of sz77's business or assets, member data may be transferred to the acquiring entity, provided that the acquiring entity assumes sz77's privacy obligations under this Policy.

All third-party service providers who receive personal data from sz77 are contractually required to process that data only for the specific purpose for which it was shared, to maintain appropriate technical and organisational security measures, and to comply with applicable Philippine data privacy regulations.

Cookies & Tracking Technologies

sz77 uses cookies and similar tracking technologies on the Platform. Cookies are small text files stored on your device by your browser that allow sz77 to recognize your session and preferences.

The categories of cookies used by sz77 are:

• Strictly necessary cookies: Essential for platform operation — session authentication, security tokens, load balancing. These cannot be disabled without losing access to the Platform;
• Functional cookies: Remember your preferences such as language settings and recently played games. These improve your experience but are not essential;
• Analytics cookies: Collect anonymized and aggregated data about how members use the sz77 Platform to help us identify performance issues and improve functionality. sz77 uses first-party analytics only — we do not use Google Analytics or other third-party analytics services that track you across external websites;
• Responsible gaming cookies: Track session duration to support the session time limit tools in your account settings.

sz77 does not use advertising or retargeting cookies. You will not see sz77 advertisements tracking you across other websites based on your sz77 activity.

You can manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies will prevent you from logging in to your sz77 account.

Data Security

sz77 implements technical and organisational security measures appropriate to the risk level of the personal data processed. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your browser or device and sz77 servers;
• AES-256 encryption for sensitive data at rest, including KYC documents and financial account references;
• Role-based access controls limiting internal access to personal data to authorised personnel whose job function requires it;
• Multi-factor authentication required for all internal sz77 administrative access to systems containing member data;
• Regular penetration testing and security audits conducted by qualified third-party security firms;
• Incident response procedures compliant with NPC breach notification requirements under NPC Circular No. 16-03.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, sz77 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected members without undue delay where the breach is likely to result in high risk to their rights.

While sz77 implements robust security measures, no system is completely immune to security threats. You are responsible for maintaining the security of your account credentials — use a strong, unique password for your sz77 account and enable two-factor authentication.

Data Retention

sz77 retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following minimum retention requirements imposed by Philippine law:

• Transaction records and account history: Minimum five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act and PAGCOR licensing conditions;
• KYC and identity documents: Duration of account membership plus five (5) years following account closure, or longer if required by an active regulatory investigation;
• Support communications: Three (3) years from the date of the interaction, to support dispute resolution and regulatory compliance;
• Marketing consent records: Duration of consent plus three (3) years, to evidence consent in the event of a complaint.

Upon expiry of the applicable retention period, sz77 will securely delete or anonymize personal data in accordance with NPC guidelines. Anonymized data — which can no longer identify you — may be retained indefinitely for analytics purposes.

Your Rights Under the Philippine Data Privacy Act

As a data subject under the Philippine DPA, you have the following rights with respect to your personal data held by sz77:

• Right to access: You may request a copy of the personal data sz77 holds about you and information about how it is processed. Requests will be fulfilled within 15 business days;
• Right to correction: You may request correction of inaccurate, incomplete, or outdated personal data. Account details can be updated directly in your account settings; document corrections require support contact;
• Right to object: You may object to the processing of your personal data where it is based on legitimate interests. We will evaluate your objection and cease processing unless we have compelling legitimate grounds that override your interests;
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose collected, where consent has been withdrawn, or where processing was unlawful — subject to sz77's legal retention obligations under AMLA and PAGCOR rules, which may override erasure requests for specific data categories;
• Right to data portability: You may request your personal data in a structured, commonly used, machine-readable format;
• Right to complain: You may file a complaint with the National Privacy Commission if you believe sz77 has violated your data privacy rights. Contact the NPC through its official channels.

To exercise any of these rights, contact sz77's Data Protection Officer at [email protected] or through the 24/7 live chat. sz77 may require identity verification before processing a rights request to ensure we are responding to the correct individual.

Children & Minors Under 21

sz77 services are strictly limited to individuals who are 21 years of age or older. sz77 does not knowingly collect personal data from individuals under 21 years of age. Age verification is enforced through the KYC process — registration alone does not constitute confirmed eligibility.

If sz77 becomes aware that personal data has been collected from an individual under 21 years of age, that account will be immediately suspended and the personal data will be deleted following the resolution of any regulatory obligations related to the account (including any AMLC reporting requirements). Deposited funds held in confirmed underage accounts will be returned per PAGCOR guidelines.

If you are aware that a minor has registered with sz77, please report this immediately to our support team through the 24/7 live chat or at [email protected].

Cross-Border Data Transfers

Some of sz77's third-party service providers — particularly game software providers and certain KYC verification services — process data on servers located outside the Philippines. Where personal data is transferred to a country that does not provide an equivalent level of data protection to that required by the Philippine DPA, sz77 ensures that such transfers are covered by:

• Standard contractual clauses approved by the National Privacy Commission;
• Binding corporate rules where the receiving entity is part of a multinational group with approved intra-group data transfer policies;
• Other appropriate safeguards recognised by the NPC.

By registering with sz77 and accepting this Policy, you acknowledge that your personal data may be processed in countries outside the Philippines as described in this section, subject to the protections outlined above.

Changes to This Privacy Policy

sz77 reserves the right to update this Privacy Policy at any time. Material changes — those that significantly affect how your personal data is used or your rights with respect to it — will be communicated to registered members by email to their registered address and by prominent notice on the Platform at least seven (7) days before the changes take effect.

Your continued use of the sz77 Platform following the effective date of any update constitutes your acknowledgment of the revised Policy. The current version of this Policy is always accessible at sz77.asia/privacy-policy. The "Last Updated" date at the top of this document reflects the most recent revision.

Contact & Data Protection Officer

Questions, requests to exercise your data rights, or concerns about this Privacy Policy should be directed to sz77's Data Protection Officer:

sz77 will acknowledge data rights requests within five (5) business days and will resolve them within fifteen (15) business days of acknowledgment, or within any longer period permitted by the NPC where the complexity of the request requires it.

If you are not satisfied with sz77's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.