spinoyz Privacy Policy

This Privacy Policy ("Policy") describes how spinoyz ("spinoyz," "we," "us," or "our") collects, uses, stores, discloses, and protects personal information relating to registered players, prospective players, and visitors to the spinoyz platform at spinoyz.app (the "Platform").

spinoyz is committed to protecting your privacy and handling your personal data with transparency, integrity, and care. This Policy is drafted in compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as well as applicable guidelines issued by the National Privacy Commission (NPC) of the Philippines.

This Policy should be read alongside the spinoyz Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference and apply to your use of the Platform.

If you have questions about this Policy or how spinoyz handles your data, you may contact our Data Protection Officer (DPO) at the contact details provided in Section 14 of this Policy.

spinoyz collects personal information only to the extent necessary to provide you with a safe, functional, and compliant gaming experience. The categories of personal data we collect are described below.

spinoyz does not intentionally collect sensitive personal information (such as health data, religious beliefs, or political opinions) unless it is directly relevant to a responsible gaming assessment or legally required for AML compliance purposes.

spinoyz uses your personal data for the following purposes:

• Account Management: To create, maintain, verify, and manage your spinoyz player account, including processing your registration and authenticating your identity at login;
• Transaction Processing: To process deposits and withdrawals in Philippine Peso (PHP) via your chosen payment method (GCash, PayMaya, BDO, BPI, Metrobank, UnionBank, 7-Eleven, or Cebuana);
• KYC & Age Verification: To verify that you meet the 21+ age requirement mandated under PAGCOR regulations and Philippine law, and to comply with Know Your Customer (KYC) obligations;
• Regulatory Compliance: To fulfil our obligations under applicable anti-money laundering (AML) laws, tax regulations, and reporting requirements to Philippine regulatory authorities;
• Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the features, performance, and security of the spinoyz platform;
• Customer Support: To respond to your enquiries, resolve disputes, and provide assistance through our 24/7 Manila-based support team;
• Responsible Gaming: To monitor player behaviour for signs of problem gambling and to administer self-exclusion, deposit limits, and cooling-off tools in accordance with our Responsible Gaming Policy;
• Fraud Prevention: To detect, investigate, and prevent fraudulent activity, unauthorised account access, and other prohibited conduct as defined in the spinoyz Terms & Conditions;
• Communications: To send you service-related notifications, account alerts, transaction confirmations, and — where you have consented — promotional communications about spinoyz offers and new games.

spinoyz will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise permitted by applicable law.

Under the Philippine Data Privacy Act of 2012, spinoyz processes your personal data on the following legal bases:

• Performance of a Contract: Processing is necessary to fulfil our contractual obligations to you as a registered spinoyz player — including account management, game access, and payment processing;
• Legal Obligation: Processing is required to comply with applicable Philippine laws, including AML legislation, PAGCOR regulatory requirements, tax reporting obligations, and NPC guidelines;
• Legitimate Interests: Processing is necessary for the legitimate interests of spinoyz, including fraud prevention, platform security, responsible gaming monitoring, and business analytics — provided those interests are not overridden by your rights and interests;
• Consent: Where required by law, spinoyz will seek your explicit consent before processing your data for a specific purpose (such as sending promotional communications). You may withdraw your consent at any time by contacting support or updating your account notification preferences.

spinoyz may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment Providers: GCash, PayMaya, BDO, BPI, Metrobank, UnionBank, 7-Eleven, and Cebuana Lhuillier, for the purpose of processing your deposits and withdrawals;
• KYC & Identity Verification Partners: Third-party identity verification service providers engaged to assist with the verification of government-issued IDs and compliance screening;
• Game Software Providers: Licensed game content providers whose software powers games available on the spinoyz platform. These providers may receive pseudonymised gameplay data for the purposes of game operation and technical support;
• Regulatory Authorities: Philippine government agencies and regulatory bodies, including the National Privacy Commission, Bureau of Internal Revenue, Anti-Money Laundering Council (AMLC), and PAGCOR, where disclosure is required by law or regulatory order;
• IT & Security Service Providers: Cloud hosting providers, cybersecurity vendors, and technical infrastructure partners engaged to operate and secure the spinoyz platform. All such providers are contractually bound to process your data only on spinoyz's instructions and to maintain appropriate security standards;
• Professional Advisers: Lawyers, auditors, and compliance consultants, subject to professional confidentiality obligations, where necessary for the conduct of spinoyz's business.

spinoyz requires all third-party data processors to implement appropriate technical and organisational security measures and to process personal data only for the specific purpose for which it was shared.

spinoyz is a Philippines-based platform and primarily processes your personal data within the Philippines. However, some of our technology infrastructure providers and game software partners may be located outside the Philippines, which means your data may be transferred to and processed in other countries.

Where such international transfers occur, spinoyz ensures that adequate safeguards are in place to protect your data, including contractual arrangements that require recipient organisations to maintain data protection standards consistent with Philippine law. spinoyz will not transfer your personal data to any country or organisation that does not provide adequate protections.

If you have questions about the specific countries to which your data may be transferred, please contact our Data Protection Officer at the details provided in Section 14.

spinoyz retains your personal data for as long as your player account remains active and for such additional periods as are required by applicable law or legitimate business need. The general retention periods applicable to different categories of data are summarised below:

• Account & Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in accordance with AML and regulatory record-keeping requirements;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by Philippine AML legislation and Bureau of Internal Revenue regulations;
• KYC Documents: Retained for the duration of your account and for five (5) years following account closure;
• Support Communications: Retained for three (3) years from the date of the communication, or longer where relevant to an unresolved dispute;
• Usage and Technical Data: Retained for up to two (2) years, unless a longer retention period is required for fraud investigation or regulatory purposes;
• Marketing Consent Records: Retained for the period of consent and for three (3) years following withdrawal of consent, as evidence of your consent status.

Once the applicable retention period has expired and there is no longer a legal or legitimate basis to retain your data, spinoyz will securely delete or anonymise it. Anonymised data — which can no longer be linked back to you — may be retained for statistical and analytical purposes without time limit.

spinoyz uses cookies and similar tracking technologies (such as local storage and session tokens) on the Platform to deliver a functional, personalised, and secure gaming experience.

The types of cookies used by spinoyz are:

• Strictly Necessary Cookies: Essential for the operation of the Platform, including maintaining your login session and securing your account. These cookies cannot be disabled without affecting the functionality of the Platform;
• Functional Cookies: Used to remember your preferences, such as your language settings and notification preferences, so you do not have to re-enter them on each visit;
• Analytics Cookies: Used by spinoyz to understand how players interact with the Platform — which pages are visited most, where errors occur, and how the platform can be improved. Analytics data is aggregated and does not identify individual players;
• Security Cookies: Used to detect and prevent fraudulent activity, bot access, and account takeover attempts.

spinoyz does not use third-party advertising cookies or cross-site tracking technologies. Cookies set by spinoyz are scoped to the spinoyz.app domain only and are not used to track your behaviour on other websites.

You may control cookie settings through your browser's privacy settings. Please note that disabling strictly necessary cookies may impair your ability to log in and use the Platform. For functional and analytics cookies, you may opt out by contacting our support team.

spinoyz implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• SSL/TLS Encryption: All data transmitted between your device and spinoyz servers is encrypted using industry-standard SSL/TLS protocols;
• Encryption at Rest: Sensitive personal data — including KYC documents and financial records — is encrypted when stored on spinoyz servers;
• Access Controls: Access to personal data is restricted to spinoyz personnel and contractors who require it to perform their job functions. All access is subject to role-based permissions, and all access events are logged and monitored;
• Two-Factor Authentication: spinoyz supports two-factor authentication (2FA) for player accounts and requires it for staff accounts with access to personal data;
• Penetration Testing: The Platform undergoes regular third-party security assessments to identify and remediate vulnerabilities;
• Incident Response: spinoyz maintains a formal data breach response plan. In the event of a breach that is likely to result in a risk to your rights, spinoyz will notify the National Privacy Commission and affected players in accordance with the requirements of the Data Privacy Act of 2012.

While spinoyz takes all reasonable steps to protect your data, no online platform is entirely immune to security risks. You are encouraged to use a strong password, enable two-factor authentication, and contact support immediately if you suspect your account has been compromised.

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by spinoyz. To exercise any of these rights, contact our Data Protection Officer at the details in Section 14.

spinoyz will respond to all valid privacy rights requests within thirty (30) days of receipt. We may need to verify your identity before processing your request. In complex cases, the response period may be extended by a further thirty (30) days, and we will notify you if this extension is necessary.

If spinoyz discovers or has reason to believe that a registered account belongs to an individual under the age of 21, we will immediately suspend the account, void all associated wagers, and delete all personal data associated with the account to the extent permitted by law. Any real-money deposits will be returned to the original payment source where technically and legally possible.

If you are a parent or guardian and believe your child has registered an account on spinoyz, please contact our support team immediately at [email protected] so that we can investigate and take appropriate action.

The spinoyz platform may contain references to or integrations with third-party service providers — including payment processors, game software suppliers, and customer communication tools. This Privacy Policy applies only to data collected and processed directly by spinoyz through the spinoyz.app platform.

When you interact with a third-party service that is integrated with spinoyz — such as initiating a GCash payment — that service provider's own privacy policy will govern the data they collect and process in connection with your interaction. spinoyz is not responsible for the privacy practices of third-party providers.

spinoyz carefully evaluates all third-party service providers before engagement and requires them to demonstrate adequate data protection practices as a condition of the business relationship.

spinoyz reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory guidance. The effective date at the top of this page indicates when the Policy was last revised.

Where changes are material — meaning they significantly affect your rights or how spinoyz processes your personal data — spinoyz will provide advance notice to registered players via email or a prominent notice on the Platform before the changes take effect.

Your continued use of the spinoyz platform after the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not agree with any changes, you may request closure of your account by contacting support.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way spinoyz processes your personal data, you may contact our Data Protection Officer (DPO). Our DPO is responsible for overseeing spinoyz's compliance with the Philippine Data Privacy Act and serves as the primary point of contact for all data privacy matters.

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe spinoyz has violated your rights under the Data Privacy Act of 2012. The NPC is the independent authority responsible for administering and enforcing the Data Privacy Act.

For responsible gaming concerns, self-exclusion requests, or account limit adjustments, please visit our Responsible Gaming page. For questions about your account, payments, or gameplay, our 24/7 Manila-based support team is also reachable at [email protected].

Effective Date: 1 January 2026  |  Last Reviewed: 1 January 2026  |  Version: 1.0