Privacy Policy — vipl

vipl ("we," "our," or "us") operates the online gaming platform accessible at vipl.bet, providing casino games, live dealer tables, slots, bingo, and fishing games to players in the Philippines. This Privacy Policy describes how vipl collects, processes, stores, shares, and protects the personal data of individuals who access or use the vipl platform ("you" or "Player").

This Privacy Policy applies to all personal data processed by vipl in connection with:

• Registration and maintenance of a vipl Player account;
• Deposits, withdrawals, and financial transactions processed through the vipl platform;
• Participation in any Game, promotion, or loyalty program offered by vipl;
• Communications between you and vipl's customer support team;
• Your use of the vipl website, any associated mobile interface, or any vipl application.

By registering an account on vipl, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Privacy Policy, you should not register an account or continue using the vipl platform.

For the purposes of the Data Privacy Act of 2012 and this Privacy Policy, vipl is the personal information controller responsible for the personal data collected through the vipl platform. vipl has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with Philippine data protection law and this Privacy Policy.

You may contact vipl's Data Protection Officer in relation to any privacy matter by writing to the contact details set out in Section 16 of this Privacy Policy.

vipl collects personal data from Players through several channels, including account registration, identity verification, payment processing, and use of the platform. The categories of personal data we collect are described in the table below.

vipl does not collect sensitive personal information (as defined under the Data Privacy Act) beyond what is strictly necessary for identity verification and age verification purposes. vipl does not collect biometric data beyond a selfie photograph used for identity matching during the KYC process.

vipl processes your personal data for the following purposes:

1. Account Creation and Management: To register your vipl account, verify your identity and age, maintain your account in good standing, and communicate with you regarding account-related matters;
2. Payment Processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, and other accepted Philippine payment channels;
3. Platform Operation: To provide access to Games, record game outcomes, maintain accurate account balances, and deliver promotions and bonuses to which you are entitled;
4. Regulatory Compliance: To fulfill vipl's obligations under PAGCOR regulations, the Data Privacy Act, anti-money laundering laws (AMLA), and other applicable Philippine legislation, including the verification of player age and identity;
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized account access, and other prohibited activities on the platform;
6. Responsible Gaming: To monitor gaming activity for signs of problem gambling, apply responsible gaming limits you have set on your account, and fulfill vipl's obligations under applicable responsible gaming standards;
7. Customer Support: To respond to your inquiries, complaints, and feedback, and to maintain records of communications for quality assurance purposes;
8. Marketing Communications: Where you have provided consent, to send you promotional offers, new game announcements, bonus notifications, and other marketing communications by SMS, email, or push notification;
9. Platform Improvement: To analyze aggregated and anonymized usage data for the purpose of improving the vipl platform, game selection, and user experience.

vipl processes your personal data on the following legal bases as recognized under the Data Privacy Act of 2012 of the Philippines:

• Consent: For marketing communications and any optional processing activities, where you have provided your express, freely given, specific, and informed consent;
• Contractual Necessity: For processing necessary to perform the contract between you and vipl, including account management, game provision, and payment processing;
• Legal Obligation: For processing required to comply with a legal obligation to which vipl is subject, including PAGCOR compliance, AML obligations, and data breach notification requirements;
• Legitimate Interests: For processing necessary for vipl's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and analytics — provided those interests are not overridden by your fundamental rights and freedoms.

vipl does not sell your personal data to any third party. vipl may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Processors: GCash (G-Xchange Inc.), PayMaya Philippines, BPI, BDO, Metrobank, and other payment service providers, for the purpose of processing deposits and withdrawals in Philippine Pesos;
• Identity Verification Providers: Third-party KYC service providers that assist vipl in verifying the identity and age of Players during account registration and for large withdrawal verifications;
• Game Software Providers: Licensed game developers and aggregators whose software powers the Games on the vipl platform, for the purpose of game session management and outcome recording;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government authorities, where disclosure is required by law or regulatory directive;
• Legal and Professional Advisors: Lawyers, accountants, auditors, and other professional advisors engaged by vipl, subject to professional confidentiality obligations;
• Technology Service Providers: Cloud hosting, cybersecurity, and platform infrastructure providers that support the operation of the vipl platform, subject to contractual data protection obligations.

All third parties with whom vipl shares personal data are required to process that data only for specified purposes and in accordance with vipl's instructions and applicable Philippine data protection law.

vipl uses cookies and similar tracking technologies on the vipl.bet website to provide and improve the platform experience. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for platform operation. These cookies enable login sessions, maintain your account security, and support core platform functionality. They cannot be disabled without affecting platform usability;
• Functional Cookies: Remember your preferences such as language settings, preferred game categories, and display settings to improve your experience on return visits;
• Analytics Cookies: Collect anonymized data about how Players use the platform — such as pages visited and time spent — to help vipl improve platform performance and user experience;
• Security Cookies: Support vipl's fraud detection and platform security systems, including flagging unusual login patterns and verifying that sessions are legitimate.

vipl does not use third-party advertising or behavioral targeting cookies. You may control cookie preferences through your browser settings. Note that disabling strictly necessary cookies may impair your ability to use the vipl platform.

vipl retains personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to the following retention periods:

• Account Data and Transaction Records: Retained for a minimum of five (5) years following the closure of your vipl account, as required by PAGCOR regulations and applicable Philippine anti-money laundering legislation (AMLA);
• Identity Verification Documents: Retained for a minimum of five (5) years following the closure of your account or the last verified identity check, whichever is later;
• Customer Support Communications: Retained for a period of two (2) years from the date of the last communication, for quality assurance and dispute resolution purposes;
• Technical Logs: IP address logs and session data are retained for a maximum of twelve (12) months unless a longer retention period is required in connection with a fraud investigation or regulatory inquiry;
• Marketing Data: Retained until you withdraw consent for marketing communications, at which point marketing data will be suppressed or deleted within thirty (30) days.

At the expiry of the applicable retention period, vipl will securely delete or anonymize your personal data in accordance with industry-standard data destruction practices.

vipl implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include:

1. 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and the vipl platform;
2. Encryption of sensitive personal data at rest in vipl's databases, including identity documents and payment reference data;
3. Role-based access controls limiting vipl staff access to personal data on a strict need-to-know basis;
4. Multi-factor authentication for all internal vipl systems that process personal data;
5. Regular penetration testing and vulnerability assessments of vipl's platform infrastructure;
6. Continuous monitoring of platform access logs for anomalous activity indicative of unauthorized access or data breach;
7. Staff training on data protection obligations and information security best practices.

vipl's primary platform infrastructure is operated from locations within or serving the Asia-Pacific region. Some of vipl's third-party service providers — including game software providers and cloud infrastructure providers — may process data in jurisdictions outside the Philippines.

Where vipl transfers personal data to processors or sub-processors outside the Philippines, vipl ensures that such transfers are subject to:

• Data processing agreements requiring the recipient to apply data protection standards equivalent to those under Philippine law;
• Transfer to jurisdictions recognized by the National Privacy Commission as providing an adequate level of data protection; or
• Other safeguards approved under the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

You may request further information about specific international transfers and the safeguards in place by contacting vipl's Data Protection Officer as set out in Section 16.

Under the Data Privacy Act of 2012 of the Philippines, you have the following rights in relation to your personal data processed by vipl:

1. Right to be Informed: The right to be informed whether personal data pertaining to you shall be, are being, or have been processed;
2. Right of Access: The right to request a copy of the personal data vipl holds about you, along with information about how it is processed;
3. Right to Rectification: The right to request correction of inaccurate or incomplete personal data held by vipl;
4. Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to vipl's regulatory retention obligations;
5. Right to Object: The right to object to processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
6. Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format;
7. Right to Damages: The right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data;
8. Right to File a Complaint: The right to file a complaint before the National Privacy Commission if you believe vipl has not complied with its data protection obligations.

To exercise any of the above rights, please contact vipl's Data Protection Officer using the contact details in Section 16. vipl will respond to all verified data subject requests within thirty (30) days of receipt. Some rights are subject to exemptions under applicable law — vipl will inform you if an exemption applies to your specific request.

If you are a parent or guardian and believe that a minor has registered on the vipl platform or provided personal data to vipl without your knowledge, please contact vipl's support team immediately using the contact details in Section 16. vipl will investigate and take prompt action.

vipl may send you promotional communications — including bonus offers, new game announcements, and seasonal promotions — by SMS to your registered Philippine mobile number, by email, or by push notification, where you have opted in to receive such communications.

You may update your marketing communication preferences at any time by:

• Updating your notification preferences in your vipl account settings;
• Following the unsubscribe instructions included in any marketing email sent by vipl;
• Contacting vipl's support team and requesting that your marketing preferences be updated.

Please note that even if you opt out of marketing communications, vipl will continue to send you transactional communications related to your account — such as deposit confirmations, withdrawal notifications, and account security alerts — as these are necessary for the operation of your vipl account and cannot be opted out of while your account remains active.

The vipl platform does not contain links to third-party websites. This Privacy Policy applies solely to personal data collected and processed by vipl in connection with the operation of the vipl.bet platform. vipl is not responsible for the data practices of any third-party entities, including payment processors and game providers, whose own privacy policies govern data collected in the course of their own operations.

vipl reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable Philippine law, regulatory guidance from the National Privacy Commission, or vipl's data processing practices. Where amendments are material, vipl will notify registered Players via the contact information on their account with reasonable advance notice before the amended Policy takes effect.

The current version of this Privacy Policy is always accessible on the vipl.bet website. The "Last Updated" date at the top of this document indicates when the most recent revision was made. Your continued use of the vipl platform following the effective date of an amended Privacy Policy constitutes your acknowledgment of the updated terms.

vipl encourages Players to review this Privacy Policy periodically to stay informed about how vipl protects their personal data.

For all data privacy inquiries, data subject rights requests, or concerns relating to vipl's handling of your personal data, please contact vipl's Data Protection Officer:

vipl will acknowledge receipt of all data subject rights requests within five (5) business days and will respond substantively within thirty (30) days as required by the Data Privacy Act of 2012. Where a request is complex or vipl needs to extend the response period, we will inform you of the reason and expected completion date.

If you are not satisfied with vipl's response to a privacy concern or data rights request, you have the right to file a complaint with the National Privacy Commission of the Philippines (NPC), which is the regulatory body responsible for enforcing the Data Privacy Act of 2012. Information about filing a complaint with the NPC is available on the NPC's official website.