Privacy Policy — How 22pub Handles Your Personal Data

Introduction

22pub ("22pub," "we," "us," or "the Company") is committed to protecting the privacy and personal data of all users of the 22pub online casino and sports betting platform ("Platform"), accessible at https://22pub.org. This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect personal information in connection with your use of the Platform.

This Policy has been drafted in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC") of the Philippines. It is also informed by the data privacy requirements imposed on PAGCOR-licensed operators under the Philippine Amusement and Gaming Corporation's regulatory framework.

This Policy applies to all personal data processed by 22pub in connection with: the creation and management of player accounts; financial deposits and withdrawals; identity verification (KYC); gameplay and betting activity; customer support interactions; and marketing communications where applicable consent has been obtained.

Data Controller

For the purposes of the Data Privacy Act of 2012 and this Policy, 22pub is the personal information controller in respect of all personal data collected and processed through the Platform. 22pub has appointed a Data Protection Officer ("DPO") responsible for overseeing compliance with data privacy obligations and handling player enquiries and rights requests relating to personal data.

Contact details for the 22pub Data Protection Officer are set out in Section 16 of this Policy. Players are encouraged to direct all privacy-related enquiries, access requests, and complaints to the DPO in the first instance.

Personal Data We Collect

22pub collects the following categories of personal data from players, depending on the features and services used:

How We Collect Personal Data

22pub collects personal data through the following means:

• Direct submission: Information you provide when creating an account, completing KYC verification, making deposits or withdrawals, contacting support, or setting responsible gaming preferences;
• Automated technical collection: Data collected automatically through your use of the Platform, including IP addresses, device identifiers, session timestamps, and cookies or similar tracking technologies (see Section 8);
• Third-party sources: Identity verification and AML screening data obtained from regulated KYC and compliance service providers; payment confirmation data from e-wallet and banking partners (GCash, PayMaya, BPI, BDO, Metrobank); fraud detection data from third-party security services;
• PAGCOR-mandated reporting: Data required to be collected and maintained under PAGCOR's licensing conditions and anti-money laundering obligations under the Anti-Money Laundering Act (AMLA) of the Philippines.

Legal Basis for Processing

22pub processes personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to fulfill the contract between 22pub and the player — including account management, game operation, deposits, withdrawals, and customer support;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AMLA reporting requirements, National Privacy Commission obligations, and other applicable Philippine law;
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement, where such interests are not overridden by the player's privacy rights;
• Consent: Processing for marketing communications and optional analytics features, where explicit and freely given consent has been obtained and where withdrawal of consent does not affect the provision of core services.

Purposes of Data Processing

22pub processes your personal data for the following specific purposes:

• Creating, verifying, and managing your 22pub account;
• Processing deposits and withdrawals through GCash, PayMaya, BPI, BDO, Metrobank, and other supported payment channels;
• Conducting mandatory identity and age verification (KYC) in compliance with PAGCOR requirements and Philippine law, including verification that all players are at least 21 years old;
• Detecting, investigating, and preventing fraudulent activity, money laundering, unauthorized account access, and other prohibited conduct;
• Monitoring gaming activity for responsible gaming purposes, including identification of problem gambling indicators and application of player-set or operator-imposed limits;
• Maintaining records required under PAGCOR's licensing conditions and the Anti-Money Laundering Act;
• Providing customer support and resolving disputes;
• Communicating account-related notifications (balance updates, transaction confirmations, security alerts);
• Sending promotional communications where you have provided consent, and managing opt-out requests;
• Improving platform performance, user experience, and game content through aggregate analytics.

Data Sharing & Disclosure

22pub does not sell, rent, or trade personal data to third parties for commercial purposes. We share personal data only in the following limited circumstances:

• Payment service providers: GCash, PayMaya, BPI, BDO, Metrobank, and Visa/Mastercard processing partners receive the minimum data necessary to execute deposits and withdrawals;
• KYC and identity verification providers: Third-party identity verification services process government-issued ID data to confirm player identity and age for PAGCOR compliance;
• Game content providers: Licensed game providers (including Ezugi and other integrated studios) may receive pseudonymized session and wager data to operate and audit game functionality;
• Regulatory authorities: PAGCOR and other Philippine government agencies (including the Anti-Money Laundering Council where required) may receive data as required by law or licensing obligation;
• Law enforcement: Philippine law enforcement authorities may receive data pursuant to a valid court order, subpoena, or other lawful process;
• Professional advisors: Legal, audit, and compliance advisors engaged by 22pub may access data under strict confidentiality obligations as necessary to provide their services.

Cookies & Tracking Technologies

22pub uses cookies and similar tracking technologies to operate and improve the Platform. The following types of cookies may be placed on your device when you access the 22pub platform:

• Strictly necessary cookies: Required to operate core platform functionality — including session management, login authentication, and security features. These cannot be disabled without impairing your use of the Platform;
• Functional cookies: Store your preferences (e.g., language, game display settings) to improve your experience between sessions;
• Analytics cookies: Collect aggregate and anonymized usage data (page visits, session duration, navigation patterns) to help us improve platform performance and content;
• Security cookies: Used to detect and prevent fraudulent activity, bot traffic, and account misuse.

22pub does not use third-party advertising or cross-site tracking cookies on its Platform. You may manage cookie preferences through your browser settings; however, disabling strictly necessary cookies will affect your ability to use the Platform. Detailed instructions for managing cookies are available in your browser's help section.

Data Retention

22pub retains personal data for as long as is necessary to fulfill the purposes for which it was collected, including any regulatory retention obligations. Specific retention periods are as follows:

• Account and KYC records: Retained for a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and AMLA obligations;
• Financial transaction records: Retained for a minimum of five (5) years from the date of each transaction, consistent with AMLA record-keeping requirements;
• Game and betting history: Retained for a minimum of three (3) years from the date of each session for regulatory audit, dispute resolution, and responsible gaming monitoring purposes;
• Customer support records: Retained for a period of two (2) years from the date of the interaction, or longer if the subject of an ongoing dispute or legal proceedings;
• Marketing consent records: Retained for the duration of your consent and for one (1) year thereafter as evidence of consent management.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymized in accordance with 22pub's data destruction procedures, except where further retention is required by law.

Data Security

22pub implements a comprehensive suite of technical and organizational security measures to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. Key measures include:

• 256-bit SSL/TLS encryption for all data transmitted between players and the Platform;
• Encrypted storage of sensitive personal information, including KYC document images and financial account details;
• Role-based access controls limiting internal staff access to personal data on a need-to-know basis;
• Multi-factor authentication requirements for all internal systems containing personal data;
• Regular third-party security audits and vulnerability assessments;
• Documented incident response procedures for personal data breaches, including timely notification to the National Privacy Commission where required by the DPA.

Your Rights Under the Data Privacy Act

As a data subject under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by 22pub:

To exercise any of these rights, please contact the 22pub Data Protection Officer as set out in Section 16. We will respond to rights requests within fifteen (15) calendar days of receipt. Complex requests may take longer, and we will notify you if an extension is required.

Please note that certain rights are subject to limitations under the DPA where processing is required for compliance with legal obligations (including PAGCOR and AMLA requirements) or for the establishment, exercise, or defense of legal claims.

Children's Privacy and Age Restrictions

If 22pub becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete that data and permanently close the associated account. If you believe that 22pub has inadvertently collected data from an underage individual, please contact us immediately at [email protected].

Third-Party Links & Services

The 22pub Platform may contain references to or integrations with third-party services, such as licensed game providers and payment processors. This Privacy Policy applies solely to personal data processed by 22pub directly. It does not govern the privacy practices of third-party game studios, payment processors, or other service providers, each of which is subject to its own privacy documentation.

22pub is not responsible for the privacy practices or data security measures of third-party partners. If you have concerns about how a third-party service provider handles your data, you should review that provider's privacy documentation directly. 22pub selects third-party partners who are required to comply with applicable Philippine data privacy laws and applicable contractual data protection obligations.

International Data Transfers

Certain 22pub service providers — including game content providers and technical infrastructure partners — may be located outside the Philippines. Where personal data is transferred outside the Philippines, 22pub ensures that appropriate safeguards are in place to protect such data in accordance with the Data Privacy Act of 2012 and the National Privacy Commission's guidelines on cross-border data transfers.

Such safeguards may include: contractual data processing agreements incorporating standard data protection clauses recognized by the NPC; transfers only to jurisdictions with comparable data protection frameworks as determined by 22pub's compliance assessment; and enhanced security requirements imposed on receiving parties as a condition of the transfer.

Updates to This Privacy Policy

22pub reviews and updates this Privacy Policy periodically to reflect changes in our data processing practices, legal requirements, or Platform services. Material changes to this Policy will be communicated to registered players via their registered email address at least seven (7) days before the revised policy takes effect, except where more immediate changes are required by law or regulatory instruction.

The effective date of the current version of this Policy is displayed at the top of this document. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Policy. If you do not agree with any changes, you may close your account by contacting 22pub customer support.

We encourage you to review this Policy periodically to remain informed about how 22pub handles your personal data. All previous versions of this Policy are available upon request from the 22pub Data Protection Officer.

Contact & Data Protection Officer

For any questions, concerns, rights requests, or complaints relating to this Privacy Policy or 22pub's handling of your personal data, please contact the 22pub Data Protection Officer using the following details:

• Email: [email protected] — please include "Privacy Request" in the subject line
• Response Time: We acknowledge all privacy enquiries within two (2) business days and provide a substantive response within fifteen (15) calendar days
• Operating Hours: Monday to Sunday, 8:00 AM – 10:00 PM Philippine Standard Time (PST)

If you are not satisfied with 22pub's response to your privacy concern, you have the right to escalate your complaint to the National Privacy Commission of the Philippines, which may be contacted through official NPC channels.

For related information, please also review our Terms & Conditions and our Responsible Gaming policy, which are available on this Platform.