ace219 Privacy Policy

Introduction and Scope

1.1 ace219 is committed to protecting the privacy and personal data of every Filipino player who uses our platform. This Privacy Policy explains how ace219 — operating the online gaming platform at ace219.app — collects, uses, stores, discloses, and protects your personal information.

1.2 This Policy applies to all personal data processed by ace219 in connection with your use of the ace219 website, mobile experience, and all related gaming and betting services offered at ace219.app.

1.3 This Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the regulatory requirements imposed by the Philippine Amusement and Gaming Corporation (PAGCOR) under ace219's gaming licence.

1.4 By registering an account with ace219 or using any ace219 Service, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not consent, you must not register with or use the ace219 platform.

Identity of the Data Controller

2.1 For the purposes of the Data Privacy Act of 2012, the data controller responsible for your personal data is ace219, operating the online gaming platform at ace219.app, licensed and regulated by the Philippine Amusement and Gaming Corporation (PAGCOR).

2.2 ace219 has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Policy and with RA 10173. Contact details for the DPO are provided in Section 14 of this Policy.

Personal Data We Collect

3.1 ace219 collects the following categories of personal data from users of the platform:

(a) Registration and Identity Data:

• Full legal name as it appears on a valid Philippine government-issued ID;
• Date of birth (for mandatory age verification — 21+ as required by PAGCOR);
• Mobile number (Philippine mobile number, used as primary account identifier);
• Email address;
• Residential address (province, city/municipality, barangay);
• Gender (optional, for personalisation purposes).

(b) Identity Verification (KYC) Data:

• Government-issued ID type and number (e.g., SSS, PhilHealth, UMID, Philippine Passport, Driver's Licence);
• ID document image (front and back) submitted for KYC verification;
• Selfie photograph submitted for liveness/identity verification purposes.

(c) Financial Data:

• GCash account number associated with deposit/withdrawal transactions;
• PayMaya account number (where used);
• Bank account details for bank transfer transactions (BPI, BDO, Metrobank, UnionBank, etc.);
• Transaction history including deposit amounts, withdrawal amounts, dates, and payment references.

(d) Gaming Activity Data:

• Games played, wager amounts, game outcomes, and session duration;
• Sports betting selections and results;
• Bonus and promotion usage history;
• Responsible gaming settings configured by the user (deposit limits, session reminders, self-exclusion status).

(e) Technical and Device Data:

• IP address at time of registration and each login session;
• Device type, operating system, and browser type;
• Session timestamps and login history;
• Cookie identifiers and session tokens.

How We Collect Your Personal Data

4.1 ace219 collects personal data through the following means:

• Directly from you — when you register an account, complete KYC verification, make deposits or withdrawals, contact customer support, participate in promotions, or configure account settings;
• Automatically through platform use — via cookies, session tracking, and server log files as you navigate and use the ace219 platform;
• From third-party payment processors — GCash, PayMaya, and partner banks transmit transaction confirmation data to ace219 in connection with deposit and withdrawal processing;
• From identity verification providers — third-party KYC service providers engaged by ace219 to verify the authenticity of documents submitted by users during account verification;
• From regulatory authorities — PAGCOR and other Philippine regulatory bodies may share information relevant to licensing compliance.

Purposes and Legal Bases for Processing

5.1 ace219 processes your personal data for the following purposes, each supported by a lawful basis under RA 10173:

• Account registration and management — necessary for the performance of the contract between you and ace219;
• Age verification (21+) — legal obligation under PAGCOR regulations and Philippine law restricting online gaming to persons aged 21 and above;
• Identity verification (KYC) — legal obligation under PAGCOR licensing requirements and the Anti-Money Laundering Act (RA 9160, as amended);
• Payment processing — necessary for the performance of the contract; facilitation of deposits and withdrawals via GCash, PayMaya, and partner banks;
• Fraud prevention and security — legitimate interest of ace219 in protecting the platform and its users from fraud, money laundering, and account compromise;
• Responsible gaming compliance — legal obligation to implement and enforce responsible gaming tools required by PAGCOR, including self-exclusion and deposit limit enforcement;
• Customer support — legitimate interest and contractual necessity in providing assistance to registered users;
• Marketing communications — with your consent, ace219 may send promotional communications about bonuses, new games, and special offers to your registered mobile number or email address. You may withdraw consent at any time;
• Regulatory reporting — legal obligation to submit required reports to PAGCOR and other Philippine regulatory authorities.

Disclosure of Personal Data to Third Parties

6.1 ace219 does not sell, rent, or otherwise commercialise your personal data. ace219 discloses personal data only in the following circumstances:

• Payment processors: GCash (G-Xchange Inc.), PayMaya Philippines Inc., BPI, BDO, Metrobank, and other Philippine financial institutions engaged to process deposits and withdrawals;
• KYC / identity verification providers: Third-party identity verification services engaged to perform document authentication and liveness checks during account verification;
• Game software providers: Licensed game content providers whose games are hosted on the ace219 platform may receive pseudonymised gameplay data for technical operation and RNG certification purposes;
• PAGCOR and Philippine regulatory authorities: As required by ace219's gaming licence and applicable Philippine law, including mandatory reporting under the Anti-Money Laundering Act;
• Law enforcement agencies: Where required by valid Philippine legal process, court order, or applicable law;
• Fraud prevention networks: Industry fraud prevention bodies to which ace219 may be required to report suspicious activity under PAGCOR regulations.

6.2 All third-party processors engaged by ace219 are contractually obligated to process personal data only for the specific purpose for which it was disclosed and in accordance with RA 10173 and applicable data protection laws.

International Data Transfers

7.1 ace219 operates primarily within the Republic of the Philippines. Where personal data is transferred to service providers located outside the Philippines — for example, cloud infrastructure providers or game content platforms — ace219 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under RA 10173.

7.2 Such safeguards include contractual clauses requiring the recipient to implement data protection standards consistent with Philippine law and, where applicable, seeking the approval of the National Privacy Commission where required by the Implementing Rules of RA 10173.

Data Retention

8.1 ace219 retains personal data only for as long as is necessary to fulfil the purposes described in this Policy or as required by applicable Philippine law.

8.2 Specifically:

• Account and KYC data: Retained for a minimum of five (5) years following account closure, as required by PAGCOR record-keeping obligations and the Anti-Money Laundering Act;
• Transaction records: Retained for a minimum of five (5) years in accordance with the Anti-Money Laundering Act (RA 9160, as amended) and PAGCOR requirements;
• Gaming activity data: Retained for the duration of the account and for five (5) years following closure;
• Technical and device data: Retained for up to twelve (12) months for security monitoring and fraud detection purposes, after which it is anonymised or deleted;
• Marketing consent records: Retained for the duration of the account and for three (3) years following withdrawal of consent.

8.3 Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised such that it can no longer be used to identify you.

Cookies and Tracking Technologies

9.1 ace219 uses cookies and similar tracking technologies on the platform. The categories of cookies in use are as follows:

• Strictly Necessary Cookies: Required for the operation of the ace219 platform, including maintaining your login session, storing your security token, and enabling basic platform functionality. These cookies cannot be disabled without preventing access to the platform.
• Performance and Analytics Cookies: Used to collect anonymised data about how users navigate the ace219 platform. This data helps us identify technical errors, optimise loading performance, and improve the user experience for Filipino players.
• Functionality Cookies: Used to remember your preferences, such as your preferred language settings and responsible gaming configuration.

9.2 ace219 does not use third-party advertising cookies or behavioural tracking technologies that build profiles of your activity across third-party websites.

9.3 You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the ace219 platform.

Security Measures

10.1 ace219 implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit SSL/TLS encryption for all data in transit between your device and ace219 servers;
• Encryption of sensitive data fields (passwords, payment details) at rest using industry-standard algorithms;
• Role-based access controls limiting internal access to personal data to authorised personnel only;
• SMS OTP two-factor authentication for account login from new or unrecognised devices;
• Automated fraud detection and anomaly monitoring systems;
• Regular security assessments and penetration testing of platform infrastructure;
• Incident response procedures aligned with the breach notification requirements of RA 10173 and the National Privacy Commission's guidelines.

10.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ace219 will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by law.

Your Rights as a Data Subject

11.1 Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by ace219:

• Right to be Informed: You have the right to be informed of how ace219 processes your personal data, as described in this Policy;
• Right to Access: You may request a copy of the personal data ace219 holds about you at any time;
• Right to Rectification: You may request correction of any inaccurate, outdated, or incomplete personal data we hold about you;
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to any legal retention obligations ace219 is required to comply with;
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. Withdrawal of consent for marketing will not affect the lawfulness of processing carried out prior to withdrawal;
• Right to Data Portability: You may request that ace219 provide your personal data in a structured, commonly used, and machine-readable format;
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph) if you believe ace219's processing of your personal data violates RA 10173.

11.2 To exercise any of these rights, please contact ace219's Data Protection Officer using the contact details in Section 14. ace219 will respond to valid requests within 15 business days of receipt.

Children's Privacy

12.1 The ace219 platform is strictly restricted to persons aged 21 years and above in accordance with PAGCOR regulations. ace219 does not knowingly collect personal data from individuals under the age of 21.

12.2 If ace219 becomes aware that personal data has been collected from a person under the age of 21, such account will be closed immediately and all personal data associated with it will be deleted, subject to any mandatory retention obligations under applicable Philippine law.

12.3 If you are a parent or guardian and believe a person under 21 in your care has registered with ace219, please contact our support team immediately at the email address provided in Section 14.

Amendments to This Privacy Policy

13.1 ace219 reserves the right to update or amend this Privacy Policy at any time. When material changes are made, ace219 will notify registered users by email to their registered address and/or by displaying a prominent notice on the ace219 platform at least 14 days before the changes take effect.

13.2 The effective date at the top of this Policy will be updated to reflect the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how ace219 protects your personal data.

13.3 Your continued use of the ace219 platform following the effective date of any amended Policy constitutes your acceptance of the amended terms.

Contact and Data Protection Officer

14.1 For any questions, concerns, or requests relating to this Privacy Policy or to the personal data ace219 holds about you, please contact our Data Protection Officer:

14.2 You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines at any time.