Pula Puti Privacy Policy — How We Protect Your Data

1. Introduction

Pula Puti ("the Platform", "we", "us", "our") is committed to protecting the personal data of our players and platform users. We understand that entrusting us with your information is a matter of real importance — not just a legal formality — and we take that responsibility seriously.

This Privacy Policy explains how Pula Puti collects, uses, stores, shares, and protects personal data in connection with your use of our online casino, sports betting services, and all related features. It also explains your rights under the Data Privacy Act of the Philippines (Republic Act No. 10173, also known as the DPA) and how to exercise them.

This policy applies alongside our Terms and Conditions and our Responsible Gaming Policy. If there is any conflict between those documents and this Privacy Policy on a matter of data privacy, this Privacy Policy takes precedence.

2. Who We Are — Data Controller

For the purposes of the Data Privacy Act of 2012 and its Implementing Rules and Regulations, Pula Puti acts as the Personal Information Controller (PIC) in respect of personal data collected through and processed on the Pula Puti platform.

Pula Puti operates under a current licence issued by the Philippine Amusement and Gaming Corporation (PAGCOR). As a PAGCOR-licensed operator, Pula Puti is subject to regulatory oversight that includes obligations related to player data, anti-money laundering (AML), and know-your-customer (KYC) compliance.

For all privacy-related inquiries, data subject requests, and concerns, you may contact Pula Puti's designated Data Protection Officer (DPO) at privacy@pulaputi.net or through the contact details provided in Section 16 of this policy.

3. Personal Data We Collect

Pula Puti collects the following categories of personal data. We collect only what is necessary for the purposes described in this policy and do not collect excessive or irrelevant information.

4. How We Collect Your Data

Pula Puti collects personal data through the following means:

• Direct Collection: Information you provide when registering your account, completing identity verification, making deposits or withdrawals, contacting customer support, or participating in promotions.
• Automated Technical Collection: Data collected automatically when you access the platform — including IP addresses, device identifiers, browser information, session data, and cookies. See Section 10 for details on cookies.
• Third-Party Verification Services: Identity and document verification providers may supply additional data points as part of the KYC process, including results of identity document authenticity checks.
• Payment Providers: Philippine payment processors (GCash, Maya, InstaPay, etc.) provide transaction confirmation data necessary to credit or debit your Pula Puti account balance.
• Regulatory Sources: PAGCOR and other regulatory bodies may provide data relevant to compliance obligations, such as self-exclusion lists.

5. Why We Use Your Personal Data

Pula Puti uses your personal data only for specific, legitimate purposes. We do not process personal data beyond what is necessary for those purposes. The key purposes are:

• Account Management: Creating and maintaining your Pula Puti account, enabling login, and managing account settings.
• Identity and Age Verification: Confirming your identity and verifying that you meet the minimum age requirement of 18 years, as required by PAGCOR regulations.
• Transaction Processing: Processing deposits to and withdrawals from your Pula Puti account via GCash, Maya, and other Philippine payment methods.
• Regulatory Compliance: Meeting our obligations under PAGCOR's licensing conditions, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act, including record-keeping, reporting, and audit requirements.
• Platform Security and Fraud Prevention: Detecting, investigating, and preventing fraud, account takeover attempts, bonus abuse, and other prohibited activities on the platform.
• Responsible Gaming: Monitoring gaming activity to identify patterns that may indicate problem gambling behaviour and to enforce responsible gaming tools such as self-exclusion.
• Customer Support: Responding to your support requests, resolving disputes, and providing account assistance.
• Platform Improvement: Analysing aggregate and anonymised usage data to improve the Pula Puti platform, game selection, and user experience.
• Marketing Communications: Sending you information about Pula Puti promotions, bonuses, and new features — but only where you have provided valid consent or where a legitimate interest basis applies. You can opt out at any time (see Section 13).

6. Legal Basis for Processing

Under the Data Privacy Act of the Philippines, Pula Puti processes your personal data based on the following legal grounds:

• Contractual Necessity: Processing required to perform the contract between you and Pula Puti — including account creation, game access, and payment processing.
• Legal Obligation: Processing required to comply with PAGCOR licence conditions, AMLA obligations, KYC requirements, and other applicable Philippine laws.
• Consent: For certain processing activities — including marketing communications and the use of non-essential cookies — Pula Puti relies on your freely given, informed, and specific consent. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.
• Legitimate Interests: For purposes such as fraud prevention, platform security, and aggregate analytics — where Pula Puti's legitimate interests are not overridden by your privacy rights and expectations.

7. Who We Share Your Data With

Pula Puti does not sell your personal data. We share data only as necessary to operate the platform and meet our regulatory obligations. Data shared with third parties is governed by written data processing agreements that require those parties to handle your data in accordance with the Data Privacy Act.

Categories of Recipients

• PAGCOR and Regulatory Bodies: Pula Puti is required to submit player activity data, suspicious transaction reports, and other compliance information to PAGCOR and the Anti-Money Laundering Council (AMLC) as part of our licensing obligations.
• Payment Processors: Philippine payment providers including GCash, Maya, InstaPay, PESONet, and partner banks receive the financial data necessary to process your deposits and withdrawals.
• Identity Verification Providers: Third-party KYC and document verification services receive identity document images and data necessary to complete the verification process. These providers operate under strict data processing agreements and are not permitted to retain or use your data beyond the verification purpose.
• IT and Cloud Infrastructure Providers: Data hosting and technical infrastructure providers that support the operation of the Pula Puti platform. These providers access data only as necessary to maintain platform operations.
• Game Content Providers: Licensed game software providers may receive anonymised game-play session data for purposes of technical game performance monitoring.
• Law Enforcement: Where required by a valid legal order, court order, or regulatory demand from a Philippine authority, Pula Puti may disclose personal data to law enforcement or government agencies.

All third parties with whom Pula Puti shares personal data are required to implement appropriate technical and organisational security measures consistent with the Data Privacy Act.

8. Data Storage and Security

Pula Puti stores your personal data on secure servers with appropriate physical and digital access controls. We implement the following security measures to protect your personal information:

• Encryption in Transit: All data transmitted between your device and Pula Puti's servers is encrypted using TLS 1.2 or higher with 256-bit encryption.
• Encryption at Rest: Sensitive personal data — including financial account details and identity verification documents — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within Pula Puti is restricted to personnel who need it to perform their specific job functions. Access is managed through role-based permissions and monitored through audit logs.
• Intrusion Detection: Pula Puti's infrastructure is monitored continuously for suspicious activity, unauthorised access attempts, and anomalous data patterns.
• Regular Security Audits: Pula Puti engages independent security firms to conduct regular penetration testing and vulnerability assessments of its platform infrastructure.
• Staff Training: All Pula Puti personnel with access to personal data receive regular training on data privacy obligations under Philippine law and our internal data handling policies.

While Pula Puti implements robust security measures, no online platform can guarantee absolute security. You also play an important role in keeping your account secure — use a strong, unique password and enable two-factor authentication where available.

9. Data Retention

Pula Puti retains your personal data for as long as is necessary to fulfil the purposes described in this policy and to comply with legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Retained for the full duration of your Pula Puti account and for a minimum of 5 years after account closure, as required by PAGCOR licence conditions and AMLA regulations.
• Transaction Records: Financial transaction records are retained for a minimum of 5 years from the date of the transaction, consistent with Philippine AML requirements.
• Identity Verification Documents: Retained for a minimum of 5 years from submission, as required by KYC and AML regulations.
• Communications Data: Support chat logs and email correspondence are retained for 2 years from the date of the interaction, or longer where relevant to an ongoing dispute or regulatory inquiry.
• Marketing Consent Records: Records of marketing consent are retained for 3 years from the date of consent or its withdrawal, to demonstrate compliance with data privacy law.

When personal data is no longer required for any legitimate purpose and no legal retention obligation applies, Pula Puti will securely delete or anonymise the data.

10. Cookies and Tracking Technologies

Pula Puti uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device when you visit the platform.

Types of Cookies Used

• Essential Cookies: Required for the platform to function — including session authentication, account login state, and security tokens. These cannot be disabled without breaking core platform functionality.
• Functional Cookies: Remember your preferences such as language settings, game lobby filters, and notification preferences to personalise your experience.
• Analytics Cookies: Collect anonymised data about how players use the platform — page visits, session duration, feature usage — to help Pula Puti improve the platform. These require your consent and can be disabled.
• Security Cookies: Used to detect and prevent fraudulent activity, including account takeover attempts and suspicious login patterns.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using Pula Puti's core gaming and betting features. For browsers on mobile, check the privacy or settings section of your specific browser app.

11. Your Rights as a Data Subject

Under the Data Privacy Act of the Philippines (RA 10173), you have the following rights in respect of your personal data held by Pula Puti:

To exercise any of these rights, contact Pula Puti's Data Protection Officer at privacy@pulaputi.net with your full name, registered mobile number, and a description of your request. Pula Puti will acknowledge your request within 72 hours and provide a substantive response within 15 business days.

12. Children's Privacy

Pula Puti is strictly for adults aged 18 years and above. We do not knowingly collect personal data from individuals under the age of 18. If we discover that an account has been created by a minor, the account will be immediately suspended, all data will be deleted, and any funds will be handled in accordance with PAGCOR regulations.

If you believe a minor may have registered on Pula Puti, please contact support@pulaputi.net immediately so we can investigate and take appropriate action.

13. Marketing Communications

Pula Puti may send you information about platform promotions, bonuses, new game releases, and sporting event specials by SMS, push notification, or email — but only where you have provided consent to receive such communications, or where a legitimate interest basis applies in the context of an existing player relationship.

You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email sent by Pula Puti.
• Adjusting your notification preferences in your Pula Puti account settings.
• Contacting support@pulaputi.net or privacy@pulaputi.net with an opt-out request.

Opting out of marketing communications will not affect transactional communications — including account security alerts, deposit and withdrawal confirmations, and support responses — which are necessary for the operation of your account.

14. Data Breach Notification

In the event of a personal data breach that is likely to pose a real risk of serious harm to affected data subjects, Pula Puti will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, as required by the Data Privacy Act and its Implementing Rules.

Where a breach is likely to result in serious harm to you as an individual data subject — such as identity theft, financial loss, or reputational damage — Pula Puti will also notify you directly without undue delay. The notification will include a description of the nature of the breach, the categories of data affected, the likely consequences, and the measures Pula Puti is taking to address it.

15. Changes to This Privacy Policy

Pula Puti may update this Privacy Policy from time to time to reflect changes in our data practices, operational changes, or changes in Philippine law. When material changes are made, we will notify registered players through platform notifications and/or email to the registered address at least 14 days before the changes take effect.

The updated Privacy Policy will always be available at pulaputi.net/privacy-policy. Continued use of the Pula Puti platform after the effective date of any update constitutes acceptance of the revised policy. If you do not agree with a material change, you should stop using the platform and request account closure.

16. Contact Our Data Protection Officer

Pula Puti has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act and responding to data subject requests. You can contact our DPO through the following channels:

• Email — Data Privacy Requests: privacy@pulaputi.net
• Email — General Support: support@pulaputi.net
• Live Chat: Available 24/7 from within your Pula Puti account

Please include your full name, registered mobile number, and a clear description of your request when contacting us about a data privacy matter. Pula Puti acknowledges all data subject requests within 72 hours and aims to resolve them within 15 business days.

If you are not satisfied with Pula Puti's response to a data privacy request or complaint, you have the right to lodge a formal complaint with the National Privacy Commission of the Philippines. Information about the NPC complaint process is available through the NPC's official government channels.