mgame Privacy Policy

mgame ("we," "us," "our," "the Platform") is an online casino and sports betting platform operating at mgame.vu and serving players in the Philippines. mgame is the data controller for all personal information collected through the platform, its associated mobile application, and any related digital services.

This Privacy Policy applies to all registered users, prospective users who interact with the platform without completing registration, and visitors to the mgame website. By registering an account, depositing funds, or continuing to use the platform, you acknowledge that you have read and understood this Policy.

mgame collects personal data through direct input at registration, through your use of the platform, and through automated technical means. The categories of data we collect are set out below:

mgame uses your personal data for the following purposes:

• Account creation and management: To register your account, verify your identity, and maintain your account profile on the platform;
• Service delivery: To provide access to games, process deposits and withdrawals via GCash, Maya, BPI, BDO, and USDT, and deliver the gaming services described on the platform;
• Legal and regulatory compliance: To fulfil obligations under Philippine Anti-Money Laundering Act (AMLA), PAGCOR reporting requirements, and applicable data protection law, including the Data Privacy Act of 2012 (Republic Act No. 10173);
• Security and fraud prevention: To detect, investigate, and prevent unauthorised access, fraudulent activity, money laundering, and other conduct prohibited under our Terms and Conditions;
• Responsible gaming: To monitor gaming behaviour, enforce deposit and betting limits, action self-exclusion requests, and identify players who may be at risk of harm;
• Customer support: To respond to your enquiries, resolve disputes, and maintain records of support interactions;
• Platform improvements: To analyse usage patterns, optimise platform performance for Philippine mobile networks and devices, and improve the user experience;
• Marketing communications: To send you promotional communications where you have consented to receive them. You may withdraw marketing consent at any time via your account settings or by contacting support.

mgame processes your personal data under the following legal bases as recognised by the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations:

• Contractual necessity: Processing required to perform the contract between you and mgame (i.e., to operate your account, process payments, and deliver gaming services);
• Legal obligation: Processing required to comply with applicable laws, including AMLA, PAGCOR regulations, and tax reporting obligations;
• Legitimate interests: Processing necessary for mgame's legitimate interests in fraud prevention, platform security, and responsible gaming enforcement, where such interests are not overridden by your rights;
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications and optional personalisation features. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

mgame does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following circumstances:

• Payment processors: GCash (Mynt), Maya (PayMaya Philippines), BPI, BDO, Metrobank, and USDT wallet processors receive the minimum data necessary to authenticate and complete your transactions. These processors operate under their own data protection policies and applicable Philippine financial regulations;
• Identity verification providers: Third-party KYC and liveness-check providers process your identity documents and selfie data solely for the purpose of verifying your identity at mgame's instruction. Data is not retained by these providers beyond the verification event unless required by their regulatory obligations;
• Game providers: JILI, PG Soft, Pragmatic Play, Evolution, and other game studios receive your player session identifier (not your full personal details) to authenticate game sessions and maintain game state. Full identity data is not shared with game providers;
• Regulatory authorities: mgame is obligated to report certain transaction data to PAGCOR and to the Anti-Money Laundering Council (AMLC) where transactions meet reporting thresholds or where suspicious activity is identified. We may also be required to disclose data in response to a valid court order or law enforcement request;
• Professional advisers: Legal counsel, auditors, and accountants engaged by mgame may access personal data on a need-to-know basis subject to professional confidentiality obligations.

The mgame platform uses cookies and similar technologies to operate the platform, maintain your login session, detect fraud, and analyse platform usage. The types of cookies used are:

• Strictly necessary cookies: Required for core platform functionality including session management, login authentication, and security. These cannot be disabled without impairing your use of the platform;
• Functional cookies: Store your preferences such as language settings, preferred game lobby view, and last-visited game categories to improve your experience on return visits;
• Analytics cookies: Collect aggregated, anonymised data about how players navigate the platform, which games are most visited, and where performance issues occur. This data is used to improve the platform and is not used to identify individual players;
• Security cookies: Used to detect suspicious login patterns, bot activity, and other security threats. These cookies are strictly necessary and cannot be opt out of.

You can manage non-essential cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality including the ability to maintain a login session across page loads.

mgame retains your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for a minimum of five (5) years following account closure, as required by AMLA and PAGCOR record-keeping obligations;
• Transaction and financial data: Retained for a minimum of five (5) years following each transaction, in accordance with AMLA record-keeping requirements and PAGCOR reporting obligations;
• Gaming session data: Retained for a minimum of three (3) years for dispute resolution and responsible gaming monitoring purposes;
• Support communications: Retained for two (2) years following resolution of the relevant matter;
• Marketing consent records: Retained until withdrawal of consent plus one (1) year thereafter as evidence of prior consent.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

mgame implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• End-to-end encryption (TLS 1.2 or higher) for all data transmitted between your device and the mgame platform;
• Encryption at rest for all databases containing personal and financial data;
• Role-based access controls restricting personal data access to personnel who require it to perform their duties;
• Two-Factor Authentication for all administrative access to systems containing personal data;
• Regular security audits and penetration testing conducted by independent third-party security firms;
• Incident response procedures enabling rapid detection, containment, and notification in the event of a data breach.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, mgame will notify the National Privacy Commission (NPC) of the Philippines and affected data subjects in accordance with the notification requirements of Republic Act No. 10173.

Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights with respect to your personal data held by mgame:

• Right to be informed: To be notified of the fact and manner of collection and processing of your personal data, as set out in this Policy;
• Right of access: To obtain a copy of the personal data we hold about you and information about how it is processed;
• Right to rectification: To have inaccurate or incomplete personal data corrected. For identity-verified data, corrections may require submission of updated documentation;
• Right to erasure: To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations that may require us to retain certain data regardless of your request;
• Right to object: To object to processing of your personal data for direct marketing purposes. Objection to marketing will be actioned immediately and permanently;
• Right to data portability: To receive your personal data in a structured, commonly used, machine-readable format where processing is based on your consent or a contract;
• Right to withdraw consent: To withdraw consent for consent-based processing at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact the mgame Data Protection Officer at the contact details in Section 14. mgame will respond to rights requests within thirty (30) calendar days of receipt. Where a request is complex or numerous, mgame may extend this period by a further sixty (60) days with prior notification.

If you are a parent or guardian and believe that your child has registered an mgame account, please contact mgame support immediately at the details provided in Section 14. We will investigate and take appropriate action without delay.

Some of the third-party service providers used by mgame — including game studios, cloud infrastructure providers, and identity verification services — may process data outside the Philippines. Where personal data is transferred to recipients in jurisdictions not recognised as providing an adequate level of data protection, mgame ensures that appropriate safeguards are in place, such as standard contractual clauses or equivalent data transfer agreements, in accordance with the requirements of Republic Act No. 10173 and NPC guidance.

Your financial transaction data processed via Philippine payment providers (GCash, Maya, BPI, BDO) is processed and stored within Philippines-based systems subject to Bangko Sentral ng Pilipinas (BSP) and relevant Philippine financial regulations.

The mgame platform does not contain links to external third-party websites within its main interface. However, game providers whose titles are hosted within the mgame platform operate their own game servers and may collect limited technical data (such as session identifiers and bet data) as part of game delivery. mgame's contracts with all game providers include data processing obligations consistent with this Privacy Policy.

mgame is not responsible for the privacy practices of third-party payment providers when you interact with their own platforms or applications (e.g., the GCash app on your phone). We encourage you to review the privacy policies of GCash, Maya, and your banking apps independently.

mgame reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory guidance, or platform practices. Material changes will be communicated to registered users via email to the registered email address or via a prominent notice on the platform no fewer than fourteen (14) days before the changes take effect.

The current version of the Privacy Policy is always accessible at mgame.vu/privacy-policy. The date at the top of the Policy indicates when it was last updated. Your continued use of the platform following the effective date of any amendment constitutes your acceptance of the updated Policy.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the mgame Data Protection Officer:

• Email: support at mgame.vu
• Live Chat: Available 24/7 from the mgame platform support section

mgame will acknowledge all privacy-related requests within 72 hours and respond substantively within thirty (30) calendar days.

If you are not satisfied with mgame's response to your privacy request or complaint, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the supervisory authority for data protection matters in the Philippines and can be contacted through the official NPC website and offices.