ah66 Privacy Policy — Your Data, Your Rights

ah66 ("we", "us", "our", or "the Platform") is committed to protecting and respecting the privacy of every individual who uses our online gaming platform at https://ah66.one. This Privacy Policy ("Policy") describes the personal information we collect, the purposes for which we use it, the legal basis for its processing, the circumstances under which we share it, and the rights available to you under Philippine law.

This Policy applies to all personal information collected from players, prospective players, and visitors to the ah66 website and all associated mobile-optimized interfaces, regardless of whether you are based in Manila, Cebu, Davao, Quezon City, Makati, or any other location in the Philippines or abroad.

This Privacy Policy is issued in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC). It also reflects ah66's obligations under PAGCOR's data governance and player protection framework.

By registering for an ah66 account, accessing the platform, or otherwise providing your personal information to us, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please do not use the ah66 platform.

For the purposes of the Philippine Data Privacy Act of 2012, the Personal Information Controller (PIC) responsible for the personal data collected through the ah66 platform is:

• Platform Name: ah66
• Website: https://ah66.one
• Regulatory Authority: Philippine Amusement and Gaming Corporation (PAGCOR)
• Data Protection Officer (DPO) Contact: [email protected] — Subject line: "Data Privacy — DPO Request" (displayed as plain text only)
• NPC Registration: ah66 maintains registration with the National Privacy Commission as required under RA 10173 and its IRR for personal information controllers processing sensitive personal information.

As Personal Information Controller, ah66 determines the purposes and means by which your personal data is processed. Where third-party service providers process personal data on our behalf — such as payment processors and game providers — they act as Personal Information Processors (PIPs) under written data processing agreements that bind them to confidentiality and security obligations consistent with RA 10173.

The following table summarizes the categories of personal data collected by ah66, the specific data types within each category, and the primary purpose for collection:

The majority of personal information ah66 holds about you is information you provide directly when registering an account, completing KYC verification, making or withdrawing funds, claiming bonuses, or contacting our support team. You control what information you submit — however, failure to provide information required for regulatory compliance (such as KYC documents) may prevent us from processing withdrawal requests.

When you access and use the ah66 platform, our systems automatically collect certain technical information about your device and session. This includes your IP address (used to determine approximate geographic location and detect jurisdictional restrictions), device identifiers, operating system, browser type, and login and activity timestamps. This data is collected for security monitoring, fraud detection, and platform optimization purposes.

ah66 may receive personal information from third-party sources in limited circumstances, including:

• Payment Processors: Confirmation of payment status from GCash, PayMaya, bank partners, and USDT processing services
• KYC Verification Services: Identity verification results from third-party KYC providers where ah66 uses such services
• PAGCOR and Law Enforcement: Regulatory instructions or court orders requiring ah66 to obtain or share information for compliance purposes
• Fraud Prevention Services: Shared fraud and AML watchlist data from industry or regulatory sources

Under the Philippine Data Privacy Act of 2012, ah66 processes personal information on the following legal bases:

• Contractual Necessity: Processing required to fulfil our contractual obligations to you under the ah66 Terms and Conditions — including account management, game provision, payment processing, and bonus administration.
• Legal Obligation: Processing required to comply with applicable Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), RA 10173, and orders from law enforcement or regulatory authorities including PAGCOR, AMLC, and the NPC.
• Legitimate Interests: Processing necessary for ah66's legitimate business interests, including fraud detection and prevention, platform security, responsible gaming monitoring, and service improvement — provided that such interests do not override your fundamental rights and freedoms.
• Consent: For processing activities not covered by the above bases — in particular, direct marketing communications — ah66 relies on your explicit consent. You may withdraw consent for marketing communications at any time through your account preferences or by contacting support.

ah66 uses your personal data for the following specific purposes:

• To create, manage, and maintain your ah66 account, including verifying your identity and age (21+ requirement) during registration and at subsequent points as required
• To process deposits and withdrawal requests via GCash, PayMaya, BDO, BPI, Metrobank, and USDT, and to maintain accurate financial records of your account transactions
• To administer bonuses, promotions, loyalty programs, and responsible gaming tools including deposit limits, session reminders, loss limits, and self-exclusion
• To comply with PAGCOR licensing conditions, Anti-Money Laundering Act requirements, AMLC reporting obligations, and other applicable Philippine regulatory requirements
• To detect, investigate, and prevent fraud, money laundering, multi-accounting, bonus abuse, and other prohibited conduct as defined in our Terms and Conditions
• To provide customer support via live chat and email, including resolving account and game disputes
• To send you transactional communications (account activity, payment confirmations, security alerts) and, with your consent, promotional communications about ah66 games and offers
• To monitor and analyze platform usage patterns for the purpose of improving platform performance, game library curation, and user experience
• To fulfill any court order, regulatory direction, or lawful law enforcement request requiring disclosure of personal information

ah66 will not use your personal data for purposes incompatible with those described in this Policy without first providing you with appropriate notice and, where required by law, obtaining your consent.

ah66 does not sell, rent, or trade personal data to third parties for their marketing purposes. We share personal data only in the following limited circumstances:

We share personal data with carefully selected third-party service providers who process data on our behalf under written contracts. These include: payment processing providers (GCash/Maya partners, banking partners, USDT processing services); game software providers and live casino studios; identity verification and KYC service providers; fraud detection and AML screening services; IT infrastructure and cloud hosting providers; and customer support software providers. All service providers are contractually bound to process personal data only as instructed by ah66, maintain appropriate security measures, and comply with applicable Philippine privacy law.

ah66 is required by law to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), the Philippine National Police (PNP), the National Bureau of Investigation (NBI), and other governmental authorities when required by valid legal process, court order, regulatory direction, or mandatory reporting obligation under Philippine law.

In the event of a merger, acquisition, business reorganization, or transfer of ah66's business or assets, personal data held by ah66 may be disclosed to prospective or actual acquirers and their advisors as part of due diligence, and transferred to a successor entity as part of the transaction. Affected players will be notified as required by RA 10173.

The ah66 platform uses cookies and similar tracking technologies (local storage, session identifiers) to enable platform functionality, maintain your login session, remember your preferences, detect fraud and suspicious activity, and analyze platform usage. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for core platform functions including login session management, security tokens, and payment processing flows. These cannot be disabled without impairing your ability to use the platform.
• Functional Cookies: Remember your preferences such as language settings, game filters, and responsible gaming tools configuration.
• Analytics Cookies: Collect aggregated, anonymized information about how players use the platform to help us improve navigation, game discovery, and overall user experience.
• Security Cookies: Support fraud detection and suspicious activity monitoring by identifying unusual patterns in platform usage.

You can control cookie settings through your browser preferences. Note that disabling strictly necessary cookies will impair your ability to log in and use the ah66 platform. ah66 does not deploy third-party advertising cookies or share cookie data with social media platforms for advertising retargeting.

ah66 retains personal data for as long as necessary to fulfill the purposes for which it was collected, subject to applicable legal and regulatory minimum retention requirements. The following general retention periods apply:

• Account Data (active accounts): Retained for the duration of your account's active status and for a minimum of five (5) years following account closure, as required by PAGCOR regulations and AMLA record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years following the transaction date, in compliance with AMLA and PAGCOR record-keeping obligations. Extended retention may apply where transactions are the subject of regulatory investigation.
• KYC / Identity Documents: Retained for a minimum of five (5) years following account closure. Copies of government-issued IDs are stored with heightened security controls.
• Support and Communications Records: Retained for a minimum of three (3) years from the date of the relevant communication, or longer if related to an ongoing dispute or regulatory matter.
• Technical and Log Data: Typically retained for twelve (12) to twenty-four (24) months for operational and security purposes.

Following the expiry of applicable retention periods, personal data will be securely deleted, anonymized, or de-identified in accordance with ah66's data retention and disposal procedures. Data subject to ongoing legal proceedings, regulatory investigations, or AMLC reporting will be retained until the matter is fully resolved.

ah66 implements appropriate technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction, in accordance with the security requirements of RA 10173 and NPC regulations. Our security measures include:

• SSL/TLS Encryption: All data transmitted between your device and ah66's servers is encrypted using industry-standard SSL/TLS protocols. Sensitive data — including login credentials and payment information — is never transmitted in plain text.
• Data Encryption at Rest: Sensitive personal information and financial data stored on ah66's systems is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Personal data is accessible only to ah66 personnel and authorized service providers who require access to perform their specific duties. Role-based access controls, multi-factor authentication, and audit logging are applied to all systems containing personal data.
• Security Monitoring: ah66's systems are continuously monitored for unauthorized access attempts, unusual activity patterns, and security incidents.
• Incident Response: ah66 maintains a data breach response procedure compliant with RA 10173 requirements, including notification to the NPC and affected data subjects within prescribed timeframes in the event of a qualifying breach.
• Two-Factor Authentication: Players are strongly encouraged and supported to enable SMS-based two-factor authentication on their ah66 accounts to protect against unauthorized login.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal information held by ah66:

• Right to be Informed: The right to be notified of how your personal data is being or will be processed, including the identity of the Personal Information Controller, the purposes of processing, and the recipients of your data — which is the purpose of this Privacy Policy.
• Right to Access: The right to request access to the personal data ah66 holds about you, including a copy of that data in a commonly used electronic format where technically feasible.
• Right to Correction: The right to request correction of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized personal data held about you.
• Right to Erasure or Blocking: The right to suspend, withdraw, or order the blocking, removal, or destruction of your personal data in specific circumstances, including where the data is incomplete, outdated, false, unlawfully obtained, or no longer necessary for the purposes collected — subject to ah66's legal retention obligations.
• Right to Object: The right to object to the processing of your personal data, including processing for direct marketing purposes. Objection to processing for direct marketing will be honored immediately. Objection to processing carried out on other legal bases will be considered and responded to in accordance with RA 10173.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format for transfer to another controller, where technically feasible.
• Right to Damages: The right to be indemnified for any damages sustained as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data, subject to applicable Philippine law.
• Right to Complain to the NPC: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe ah66 has processed your personal data in breach of RA 10173.

To exercise any of the above rights, contact ah66's Data Protection Officer at [email protected] with the subject line "Data Privacy — Rights Request" (displayed as plain text only). We will respond to verified requests within thirty (30) days as required by RA 10173, or notify you of any extension within the prescribed period. We may require identity verification before processing data access or correction requests.

The ah66 platform is strictly intended for individuals who are twenty-one (21) years of age or older. ah66 does not knowingly collect personal information from individuals under 21 years of age. Under PAGCOR regulations, casino-style online gaming is prohibited for persons under 21 in the Philippines.

Age verification is conducted during account registration as part of ah66's KYC process. Any account found to belong to an individual under 21 years of age will be immediately suspended, the personal data associated with the account will be securely deleted, and all account balances forfeited in accordance with ah66's Terms and Conditions and PAGCOR regulatory requirements.

If ah66 becomes aware that it has inadvertently collected personal information from a person under 21 years of age without appropriate consent and age verification, it will take immediate steps to delete that information. If you are a parent or guardian and believe your child under 21 may have accessed ah66, please contact us immediately at [email protected] (plain text, not a link).

Some of ah66's third-party service providers — including certain game software providers, cloud infrastructure providers, and KYC verification services — may be located or operate servers outside of the Philippines. Where personal data is transferred to recipients in countries outside the Philippines, ah66 ensures that appropriate safeguards are in place to protect that data to a standard equivalent to RA 10173 requirements, including:

• Standard contractual clauses requiring the receiving party to maintain data protection standards equivalent to Philippine law
• Ensuring the receiving country provides an adequate level of data protection as recognized by the NPC, where applicable
• Conducting due diligence on third-party processors' data security and privacy practices before engagement

Personal data transferred internationally is limited to the minimum necessary for the relevant processing purpose, and international transfers are conducted only where necessary to provide the ah66 platform services to Filipino players.

ah66 may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Material changes — those that affect your rights or the way we use your personal data in a significant manner — will be communicated to you via email to your registered address or through a prominent notice on the ah66 platform at least fourteen (14) days before the changes take effect.

The date of the most recent revision to this Policy is shown at the top of this page. Your continued use of the ah66 platform after the effective date of any updated Policy constitutes your acknowledgment of the revised Policy. We encourage you to review this Policy periodically to stay informed about how we protect your personal information.

If you have any questions, concerns, or requests relating to this Privacy Policy or the personal data ah66 holds about you, please contact our Data Protection Officer:

• Email: [email protected] — Subject line: "Data Privacy — DPO" (plain text only — not a clickable link)
• Live Chat: 24/7 via your logged-in ah66 account dashboard — for immediate data privacy queries
• Response Time: DPO email inquiries are addressed within five (5) business days; formal rights requests within thirty (30) days as required by RA 10173

If you are not satisfied with ah66's response to a data privacy complaint, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines through the NPC's official website and complaints process. We take all data privacy complaints seriously and will cooperate fully with any NPC investigation.