sugal Privacy Policy

sugal ("we," "us," or "our") operates the online gaming platform accessible at sugal.org. This Privacy Policy describes how sugal collects, uses, stores, shares, and protects the personal information of users ("you" or "your") who access or use the sugal platform, including its website, mobile interface, and all associated services.

This Privacy Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC) of the Philippines. By registering an account or using any sugal service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

This Privacy Policy should be read together with sugal's Terms & Conditions, which govern your overall use of the platform. In the event of any conflict between this Privacy Policy and the Terms & Conditions on matters relating to data privacy, this Privacy Policy shall prevail.

sugal collects personal data from you in several ways — directly when you register and use the platform, automatically through your device and browser, and occasionally from third-party sources for verification purposes. The categories of personal data we collect include:

sugal does not collect sensitive personal information beyond what is strictly required for identity verification and regulatory compliance. We do not collect data relating to your racial or ethnic origin, political opinions, religious beliefs, or health information unless specifically required by applicable law or regulation.

sugal uses the personal data we collect for the following specific purposes. We process your data only where we have a valid legal basis to do so, as described in Section 4 of this Privacy Policy.

sugal will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by applicable Philippine law.

Under the Philippine Data Privacy Act of 2012, sugal processes your personal data on the following legal bases:

• Contractual Necessity: Processing is necessary to perform the contract between you and sugal — specifically, to operate your account, process transactions, and deliver gaming services.
• Legal Obligation: Processing is required to comply with applicable Philippine laws and regulations, including PAGCOR licensing requirements, Anti-Money Laundering Act (AMLA) obligations, and NPC data privacy requirements.
• Legitimate Interests: Processing is necessary for sugal's legitimate interests, including fraud prevention, platform security, responsible gaming monitoring, and improving our services — provided these interests are not overridden by your rights and freedoms.
• Consent: For certain processing activities — such as sending you promotional communications and marketing offers — sugal relies on your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time by updating your communication preferences in your account settings or by contacting our support team.

sugal does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may, however, share your personal data with the following categories of recipients where necessary and lawful:

• Payment Service Providers: GCash, Maya, and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) receive the financial data necessary to process your deposits and withdrawals. These providers are bound by their own privacy policies and applicable Philippine financial regulations.
• Identity Verification Partners: Third-party KYC and identity verification service providers may process your identity documents and biometric data solely for the purpose of verifying your identity in compliance with PAGCOR and AMLA requirements.
• Game Content Providers: Third-party game studios and software providers may receive anonymized or pseudonymized gaming session data for the purpose of game performance monitoring and improvement.
• Regulatory Authorities: sugal may be required to disclose your personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), or other Philippine government agencies in response to lawful requests, court orders, or regulatory requirements.
• Professional Advisors: Lawyers, auditors, and other professional advisors engaged by sugal may access your data on a need-to-know basis and are bound by professional confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of sugal's business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

All third parties with whom sugal shares personal data are required to implement appropriate technical and organizational security measures and to process your data only in accordance with sugal's instructions and applicable Philippine law.

sugal uses cookies and similar tracking technologies to enhance your experience on the platform, analyze usage patterns, and deliver relevant content. A cookie is a small text file placed on your device when you visit the sugal website. The types of cookies we use include:

• Strictly Necessary Cookies: These cookies are essential for the sugal platform to function correctly. They enable core features such as account login, session management, and security. These cookies cannot be disabled.
• Performance & Analytics Cookies: These cookies collect anonymized information about how users interact with the sugal platform — such as which pages are visited most frequently and how long users spend on each page. This data helps us improve the platform's performance and usability.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and responsible gaming limits — so you don't have to re-enter them each time you visit.
• Marketing & Targeting Cookies: With your consent, these cookies track your browsing activity to deliver personalized promotional content and offers relevant to your gaming preferences on the sugal platform.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the sugal platform. For more information on managing cookies, refer to your browser's help documentation.

sugal retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, sugal will securely delete or anonymize your personal data in accordance with its data disposal procedures. Where anonymization is not technically feasible, the data will be securely destroyed.

sugal implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. Our security framework includes:

• SSL/TLS Encryption: All data transmitted between your device and the sugal platform is encrypted using industry-standard SSL/TLS protocols. Look for the padlock icon in your browser's address bar when using sugal.org.
• Data Encryption at Rest: Sensitive personal data stored on sugal's servers — including identity documents and financial information — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. sugal employees and contractors are granted access only to the data necessary to perform their specific job functions.
• Two-Factor Authentication (2FA): sugal supports SMS OTP-based 2FA for all registered user accounts and enforces 2FA for all internal staff accessing personal data systems.
• Regular Security Audits: sugal conducts regular internal and third-party security audits, penetration testing, and vulnerability assessments to identify and remediate potential security risks.
• Incident Response: sugal maintains a documented data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, sugal will notify the National Privacy Commission and affected users within the timeframes prescribed by the Data Privacy Act.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by sugal. You may exercise any of these rights by contacting our Data Protection Officer (DPO) using the contact details provided in Section 13.

• Right to Be Informed: You have the right to be informed of how your personal data is being collected, processed, and used — which is the primary purpose of this Privacy Policy.
• Right to Access: You have the right to request a copy of the personal data sugal holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request the correction of any inaccurate, incomplete, or outdated personal data we hold about you.
• Right to Erasure or Blocking: You have the right to request the deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, or where processing is unlawful — subject to sugal's legal retention obligations.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on sugal's legitimate interests.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to request its transfer to another data controller where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines if you believe sugal has violated your data privacy rights.

sugal will respond to all valid data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, in which case we will notify you of the extension and the reasons for it.

The sugal platform is strictly intended for adults aged 21 years and above, in accordance with Philippine law and PAGCOR regulations governing online gambling. sugal does not knowingly collect, process, or store personal data from individuals under the age of 21.

If sugal becomes aware that personal data has been collected from a person under 21 years of age, we will take immediate steps to delete that data and close the associated account. All funds deposited by an underage user will be returned to the verified payment source where possible, subject to applicable legal requirements.

If you are a parent or guardian and believe that your child under the age of 21 has registered on the sugal platform or provided personal data to sugal, please contact our support team immediately so that we can investigate and take appropriate action.

The sugal platform may contain links to third-party websites, services, or resources for informational or operational purposes. This Privacy Policy applies solely to the sugal platform and does not extend to any third-party websites or services that may be accessible via links on the sugal platform.

sugal has no control over the content, privacy practices, or data processing activities of third-party websites. We strongly encourage you to review the privacy policies of any third-party websites you visit. sugal is not responsible for the privacy practices or the content of any third-party sites.

sugal reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, or regulatory requirements. When we make material changes to this Privacy Policy, we will notify registered users via email or a prominent notice on the sugal platform prior to the changes taking effect.

The date of the most recent revision is always displayed at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how sugal is protecting your personal data. Your continued use of the sugal platform after any amendments have been posted constitutes your acknowledgment of the updated Privacy Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or sugal's data processing practices, please contact our Data Protection Officer (DPO) using the details below. All privacy-related inquiries are handled with strict confidentiality.

You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. The NPC can be reached through its official government channels.