Privacy Policy – paldo Online Gaming

1 Introduction and Scope

This Privacy Policy ("Policy") is issued by paldo ("paldo," "we," "us," or "our") and applies to all personal data collected, processed, and stored in connection with your use of the paldo online gaming platform, including the paldo website, mobile browser interface, games, casino, bingo, sports betting sections, and any associated customer support or account management services (collectively, the "paldo Platform").

paldo is committed to protecting the personal data of all registered players and website visitors in accordance with the Republic Act No. 10173, known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and all applicable issuances of the National Privacy Commission (NPC) of the Philippines.

By registering a paldo account or continuing to use the paldo Platform, you acknowledge that you have read and understood this Policy and consent to the collection, use, and processing of your personal data as described herein. If you do not agree, please discontinue use of paldo immediately.

2 Data Controller Information

For the purposes of the Data Privacy Act of 2012 and applicable data protection regulations, paldo is the personal information controller responsible for the personal data described in this Policy. paldo determines the purposes and means of processing your personal data in connection with the paldo Platform.

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by paldo, you may contact the paldo Data Protection Officer via the contact details provided in Section 14 of this Policy.

3 Categories of Personal Data We Collect

paldo collects the following categories of personal data from registered players and platform users:

4 How paldo Collects Your Data

paldo collects personal data through the following methods:

• Direct Submission: Data you actively provide when registering a paldo account, completing KYC verification, making a deposit or withdrawal request, contacting paldo support, or participating in promotions.
• Automated Collection: Technical and usage data collected automatically as you interact with the paldo Platform, including through cookies, session tracking technologies, server logs, and device fingerprinting tools.
• Third-Party Payment Providers: Where you deposit or withdraw via GCash, PayMaya, BPI, BDO, Metrobank, or InstaPay, paldo receives confirmation data from those providers sufficient to process your transaction. paldo does not receive or store full payment credentials from third-party e-wallet or banking providers.
• Identity Verification Services: In processing KYC submissions, paldo may use third-party document verification services to authenticate government-issued Philippine identification documents. These services process data solely on paldo's instructions.
• Responsible Gaming Tools: Where you set deposit limits, cooling-off periods, or self-exclusion on your paldo account, the configurations and associated timestamps are recorded to ensure the restrictions function correctly and cannot be bypassed.

5 Purposes for Which paldo Processes Your Data

paldo processes your personal data for the following purposes:

• Account Registration and Management: To create, maintain, and administer your paldo player account, authenticate your identity at login, and manage your account preferences and settings.
• KYC and Age Verification: To verify that you meet the eligibility requirements to use paldo — including the mandatory minimum age of 21 years — and to comply with Philippine gaming regulations and PAGCOR requirements.
• Processing Deposits and Withdrawals: To receive, record, and process your financial transactions on paldo in Philippine Peso, and to verify that your payment account name matches your registered paldo account details.
• Game Delivery and Platform Operation: To serve game content, record wagers and outcomes, calculate winnings and balances, and deliver the full paldo gaming experience in a technically stable manner.
• Anti-Fraud and Security: To detect, investigate, and prevent fraudulent transactions, duplicate accounts, money laundering, collusion, and other prohibited activities on paldo, and to protect both players and the platform.
• Regulatory Compliance: To comply with applicable Philippine laws and regulations, including record-keeping requirements, anti-money laundering (AML) obligations, and reporting duties to regulatory authorities.
• Responsible Gaming: To administer the deposit limit, session limit, cooling-off, and self-exclusion tools available to paldo players, and to monitor gaming behaviour where necessary to fulfil our responsible gaming obligations.
• Customer Support: To respond to enquiries, resolve disputes, process complaints, and provide account assistance via live chat and email.
• Marketing Communications: Where you have provided consent, to send you promotional offers, bonus notifications, and platform updates from paldo. You may withdraw consent for marketing communications at any time.
• Platform Improvement: To analyse aggregated and anonymised usage data to improve the paldo Platform, identify technical issues, and optimise the player experience.

6 Legal Bases for Processing

paldo processes your personal data on the following legal bases, as applicable under the Data Privacy Act of 2012:

• Contractual Necessity: Processing required to perform the paldo Terms & Conditions you accepted at registration — including account creation, game delivery, and payment processing.
• Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR-mandated KYC requirements, anti-money laundering obligations, and regulatory reporting duties.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and aggregated analytics, where such interests are not overridden by your rights and interests as a data subject.
• Consent: Processing for optional purposes such as marketing communications, where paldo has obtained your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.

7 Disclosure and Sharing of Your Data

paldo does not sell, rent, or trade your personal data to third parties. paldo may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to confidentiality obligations:

• Game Software Providers: paldo's game library is delivered by certified third-party providers. These providers may receive your player ID and session data to serve game content and record results. They do not receive your full identity data.
• Payment Processing Partners: GCash, PayMaya, BPI, BDO, Metrobank, and InstaPay receive the transaction data necessary to process your deposits and withdrawals. paldo does not transmit your full financial credentials to these partners beyond what is required for each transaction.
• Identity Verification Services: Third-party KYC service providers who authenticate your submitted government ID documents. These providers operate under strict data processing agreements and handle data solely on paldo's instruction.
• Regulatory and Law Enforcement Authorities: paldo may disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other competent Philippine authorities where required by law, court order, or regulatory direction.
• Fraud Prevention and AML Services: Specialist third-party services engaged to assist paldo in detecting and preventing fraud, money laundering, and other financial crimes. These services process data strictly for the purposes specified by paldo.
• Professional Advisors: Legal, audit, financial, and compliance advisors engaged by paldo who are subject to professional confidentiality obligations.

8 Cookies and Tracking Technologies

paldo uses cookies and similar tracking technologies on the paldo Platform to ensure proper functionality, enhance your experience, and gather analytics data. The following types of cookies are used:

• Strictly Necessary Cookies: Required for the paldo Platform to function. These include session cookies that maintain your login state, security tokens, and load-balancing cookies. These cannot be disabled without impairing Platform functionality.
• Functional Cookies: Remember your preferences on paldo — such as language settings, game lobby layout, and responsible gaming tool configurations — to provide a more personalised experience.
• Analytics Cookies: Allow paldo to measure and analyse how players interact with the Platform — including pages visited, session duration, and game engagement — on an aggregated and anonymised basis, to improve the Platform.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent behaviour, account takeover attempts, and bot activity on paldo. These cookies contribute to the integrity of the Platform and the security of player accounts.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to use the paldo Platform, including paldo login and game access.

9 Data Retention

paldo retains personal data for the periods necessary to fulfil the purposes described in this Policy, and as required by Philippine law and regulatory obligations:

• Active Account Data: Retained for the duration of your active paldo account and for a period of five (5) years following account closure, in accordance with record-keeping requirements applicable to Philippine gaming operators.
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of submission, or longer where required by PAGCOR regulations or AML obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, as required under Philippine AML regulations.
• Gaming Activity Logs: Retained for three (3) years from the date of each session, for dispute resolution, fraud prevention, and regulatory audit purposes.
• Customer Support Records: Retained for two (2) years from the date of resolution of each support interaction.
• Marketing Consent Records: Retained for the duration of your consent and for a period sufficient to demonstrate compliance in the event of a regulatory enquiry.

Upon expiry of the applicable retention period, personal data held by paldo will be securely deleted or permanently anonymised so that it can no longer be attributed to an identified or identifiable individual.

10 Security Measures

paldo implements technical and organisational security measures appropriate to the sensitivity of the personal data it processes. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the paldo Platform.
• Encryption at rest for all personally identifiable and sensitive data stored on paldo infrastructure.
• Role-based access controls ensuring that paldo personnel may access personal data only to the extent required for their specific function.
• Multi-factor authentication required for privileged access to paldo's administrative systems.
• Regular security assessments, vulnerability scanning, and penetration testing of the paldo Platform and data infrastructure.
• Incident response procedures enabling paldo to detect, contain, and report personal data breaches in accordance with NPC notification requirements under the DPA.

11 Your Rights as a Data Subject

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, you are entitled to the following rights with respect to your personal data held by paldo:

To exercise any of the above rights, please contact the paldo Data Protection Officer using the contact details in Section 14. paldo will respond to data subject requests within the timeframes prescribed by the DPA. Please note that certain rights may be limited where paldo is required to retain data by law or where erasure would conflict with regulatory obligations.

12 Children's Privacy and Age Restriction

The paldo Platform is strictly intended for adults aged 21 years and above, in accordance with PAGCOR regulations and Philippine gaming law. paldo does not knowingly collect personal data from individuals under 21 years of age.

During the paldo registration and KYC process, all applicants are required to verify their date of birth against a valid Philippine government-issued identification document. Accounts where the registered player is found to be under 21 years of age are immediately suspended and any associated funds are held pending review and return in accordance with applicable regulations.

If paldo becomes aware that personal data has been collected from an individual under the age of 21 without appropriate parental or guardian consent, paldo will take immediate steps to delete that data and close the associated account.

13 Updates to This Privacy Policy

paldo reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. The revised Policy will be published on this page with an updated Effective Date.

Where changes to this Policy are material — for example, where paldo introduces a new processing purpose that requires your consent, or where there are significant changes to data sharing arrangements — paldo will provide advance notice to registered players via the email address associated with their paldo account.

Your continued use of the paldo Platform after the publication of an updated Privacy Policy constitutes your acknowledgement of and, where applicable, consent to the changes. If you do not agree to the updated Policy, you must cease using paldo and may request account closure.

14 Contact the paldo Data Protection Officer

If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by paldo, you may contact the paldo Data Protection Officer:

• Email: [email protected] — please include "Privacy / DPO Request" in your subject line.
• Live Chat: Available 24 hours a day, 7 days a week, via the paldo Platform. Select the Privacy or Data Request category when initiating your chat.
• Response Timeframe: paldo will acknowledge data subject requests within 5 business days and provide a substantive response within 30 calendar days, or within such other period as may be prescribed by the NPC.

If you are not satisfied with paldo's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, the supervisory authority responsible for enforcing the Data Privacy Act of 2012.