spinplay Privacy Policy —
Your Data, Your Rights

1.1  This Policy has been prepared in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations (IRR) as issued by the National Privacy Commission (NPC) of the Philippines. spinplay is committed to upholding the data privacy rights of all Philippine-based players and processing personal data only in ways that are lawful, transparent, and proportionate to the purpose.

1.2  This Policy should be read alongside the spinplay Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference into the full suite of agreements governing your use of the platform.

1.3  This Policy is effective as of 1 January 2026. The most current version of this Policy is always accessible at spinplay.asia/privacy-policy.

2.1  For the purposes of the Data Privacy Act of 2012 and this Policy, spinplay acts as the personal information controller (PIC) in respect of the personal data it collects and processes from users of spinplay.asia.

2.2  spinplay has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and the DPA. Contact details for the DPO are set out in Section 15 of this Policy.

2.3  Where spinplay engages third-party service providers to process personal data on its behalf, those parties act as personal information processors (PIPs) and are bound by data processing agreements that impose equivalent data protection obligations to those contained in this Policy.

spinplay collects the following categories of personal data:

3.1  spinplay does not collect special categories of sensitive personal data (such as race, political opinions, religious beliefs, health data, or biometric data) except where strictly necessary for responsible gaming assessments or identity verification, and only with appropriate safeguards in place.

spinplay collects personal data through the following means:

• Direct Provision: Information you provide when registering an account, completing KYC, making a deposit or withdrawal, updating your profile, or contacting customer support;
• Automated Technologies: Technical and behavioral data collected automatically when you access or use the spinplay platform, including via cookies, web beacons, and server logs (see Section 10);
• Third-Party Sources: Identity and fraud verification data from KYC service providers; payment data from payment processors such as GCash, PayMaya, BPI, BDO, and Metrobank; age and identity verification from credit reference agencies where applicable;
• Publicly Available Sources: Publicly accessible information used for fraud prevention, sanctions screening, or regulatory compliance purposes.

spinplay processes your personal data for the following purposes and on the following legal bases under the DPA 2012:

• Contract Performance: To create and manage your account, process deposits and withdrawals, provide access to games, and fulfill all obligations under the spinplay Terms & Conditions;
• Legal Obligation: To comply with anti-money laundering (AML) obligations, KYC requirements, age verification duties, PAGCOR regulatory reporting, and obligations under the DPA 2012;
• Legitimate Interest: To prevent fraud, cheating, and bonus abuse; to improve platform security; to conduct analytics and improve the player experience; to manage IT infrastructure;
• Consent: To send you marketing emails and promotional SMS messages about spinplay offers and new games, where you have opted in to receive such communications. You may withdraw this consent at any time;
• Vital Interests: In rare circumstances where processing is necessary to protect the vital interests of a player or third party, for example in a responsible gaming intervention.

5.1  spinplay will not use your personal data for any purpose that is incompatible with the purposes described in this Policy without first obtaining your explicit consent or establishing a separate lawful basis under the DPA 2012.

6.1  spinplay does not sell, rent, or trade your personal data to third parties for their own marketing or commercial use. Personal data is shared only in the following circumstances:

• Service Providers: Payment processors (GCash, PayMaya, BPI, BDO, Metrobank, Visa, Mastercard), KYC verification providers, IT hosting and infrastructure providers, and customer support platform providers — all of whom are contractually bound to process your data only on spinplay's instructions;
• Game Providers: Where technically necessary to deliver specific games, limited technical session data may be shared with the relevant game provider (e.g., Pragmatic Play, NetEnt). Game providers do not receive full player profiles;
• Regulatory Authorities: The Philippine Amusement and Gaming Corporation (PAGCOR), the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or any other competent Philippine authority where disclosure is required by law;
• Fraud Prevention: With fraud prevention agencies and industry databases where necessary to prevent cheating, account fraud, or financial crime;
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of spinplay's business, personal data may be transferred to the acquiring entity subject to equivalent data protection commitments;
• With Your Consent: To any other third party where you have provided explicit, informed consent for that specific sharing.

7.1  Some of spinplay's service providers operate infrastructure or support functions outside the Philippines. Where personal data is transferred outside the Philippines, spinplay ensures that appropriate safeguards are in place as required by the DPA 2012 and NPC guidelines, including contractual data transfer mechanisms that impose equivalent data protection standards.

7.2  spinplay does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards, such as standard contractual clauses approved by the National Privacy Commission, or obtaining your explicit consent to the transfer.

8.1  spinplay retains personal data for as long as is necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, or to resolve disputes and enforce agreements. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account plus five (5) years after account closure, to comply with AML and regulatory record-keeping requirements;
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by Philippine AML regulations;
• KYC Documents: Retained for five (5) years from account closure or from the date of the last transaction, whichever is later;
• Customer Support Records: Retained for three (3) years from the date of the interaction;
• Marketing Data: Retained until you withdraw consent or request deletion, subject to applicable legal retention requirements.

8.2  At the end of applicable retention periods, personal data is securely deleted or permanently anonymized in accordance with spinplay's data disposal procedures.

Under the Data Privacy Act of 2012, you have the following rights in relation to the personal data spinplay holds about you:

10.1  spinplay uses cookies and similar tracking technologies on its platform for the following purposes:

• Strictly Necessary Cookies: Required for the platform to function correctly, including maintaining your login session, processing payments, and enforcing security measures. These cannot be disabled;
• Performance Cookies: Used to collect anonymous aggregated information about how players use the platform, enabling spinplay to identify errors and improve the user experience;
• Functional Cookies: Used to remember your preferences, such as language settings, game lobby filters, and display preferences;
• Analytics Cookies: Used by spinplay's analytics tools to understand player behavior patterns and improve platform design and content.

10.2  spinplay does not use cookies to serve third-party advertising. You can manage non-essential cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair platform functionality, including your ability to log in and play.

11.1  spinplay's services are strictly for individuals who are 21 years of age or older, consistent with Philippine gaming regulations. spinplay does not knowingly collect personal data from persons under the age of 21.

11.2  If spinplay becomes aware that it has inadvertently collected personal data from a person under 21, it will take immediate steps to delete that data and close the associated account. Parents and legal guardians are encouraged to actively supervise the online activities of minors and to contact spinplay immediately at [email protected] if they suspect an underage person has registered an account.

12.1  spinplay implements a range of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure, including:

• 256-bit SSL/TLS encryption for all data in transit;
• AES-256 encryption for sensitive data at rest;
• Hashed and salted storage of all passwords — spinplay staff cannot view player passwords;
• Multi-factor authentication available for player accounts and mandatory for staff accessing player data systems;
• Role-based access controls limiting data access to staff who require it for their job function;
• Regular security audits and penetration testing by independent third parties;
• Continuous monitoring of platform infrastructure for anomalous activity;
• Data breach response procedures including NPC notification protocols.

12.2  While spinplay employs industry-standard security measures, no system is completely impenetrable. spinplay cannot guarantee absolute security of your personal data and encourages players to use strong, unique passwords and to enable two-factor authentication on their spinplay accounts.

13.1  The spinplay platform integrates with third-party services including payment processors, game providers, and analytics tools. These third parties have their own privacy policies, and spinplay is not responsible for the privacy practices of third-party services accessed through the platform.

13.2  All third-party processors engaged by spinplay are subject to written data processing agreements that require them to: (a) process data only on spinplay's documented instructions; (b) implement appropriate technical and organizational security measures; (c) not engage sub-processors without spinplay's prior written consent; and (d) assist spinplay in fulfilling player data rights requests where the processor holds relevant data.

14.1  spinplay reviews and updates this Privacy Policy periodically to reflect changes in our data practices, applicable law, or regulatory guidance from the National Privacy Commission. The current version and its effective date are always shown at the top of this page.

14.2  Where changes to this Policy are material, spinplay will notify registered players via email to their registered address and/or via a prominent notice on the platform prior to the changes taking effect. Continued use of the platform after the effective date of an updated Policy constitutes acceptance of the revised terms.

If you have any questions, concerns, or requests regarding this Privacy Policy or the personal data spinplay holds about you, please contact us:

If you are not satisfied with spinplay's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC), which is the supervisory authority for data protection in the Philippines.

This Privacy Policy was last updated on 1 January 2026. Document reference: spinplay-PP-2026-01.