ace66 Privacy
Policy

ace66 is the Philippines' premier online casino and sports betting platform, serving Filipino players across Metro Manila, Cebu, Davao, Iloilo, Quezon City, Makati, and throughout the archipelago. As a platform operating under Philippine regulatory standards, ace66 is committed to processing personal data lawfully, transparently, and only for legitimate purposes directly connected to the delivery of our gaming services.

This Policy applies to all personal data processed by ace66 in connection with your use of the Platform, regardless of whether you access it via a web browser on desktop or mobile. It covers data collected directly from you, data generated through your use of the Platform, and data received from third-party service providers where applicable under this Policy.

ace66 collects the following categories of personal data in the course of providing our services to you. We collect only what is necessary for the specific purposes identified in this Policy, in accordance with the principle of data minimisation under RA 10173.

ace66 collects personal data through the following means, all of which are disclosed to you at the point of collection:

• Direct Submission — Data you actively provide during account registration, KYC document upload, deposit and withdrawal requests, contact form submissions, and live chat or email communications with ace66 support.
• Automated Collection — Technical and behavioural data collected automatically as you use the Platform, including via cookies, web beacons, server logs, and similar technologies as described in Section 7 of this Policy.
• Payment Processors — Transaction confirmation data shared with ace66 by your chosen payment provider (GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, GrabPay, or 7-Eleven CLiQQ) solely for the purpose of confirming the completion of a deposit or withdrawal.
• KYC Verification Partners — Where ace66 uses a third-party identity verification service to assist with document authentication, that service may return a verification result to ace66. ace66 does not receive or store the raw biometric data processed by such partners.
• Regulatory Sources — In certain circumstances required by PAGCOR or AMLA compliance obligations, ace66 may receive or cross-reference data from regulatory databases or watchlists.

ace66 processes your personal data only for specific, legitimate purposes directly related to the provision, maintenance, and improvement of the Platform. We do not process personal data in ways that are incompatible with the purposes disclosed at the time of collection. The primary purposes for which ace66 processes your data include:

• Creating and managing your ace66 player account, including verifying your identity and confirming your eligibility to use the Platform.
• Processing deposits and withdrawals through your chosen Philippine payment method and maintaining accurate financial records in Philippine Peso (PHP).
• Complying with PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and KYC obligations applicable to online gaming operators in the Philippines.
• Delivering and personalising your gaming experience, including recommending games, applying promotional offers, and maintaining your platform preferences.
• Operating and enforcing ace66's responsible gaming programme, including administering deposit limits, cooling-off periods, and self-exclusion requests made by or on behalf of players.
• Detecting, investigating, and preventing fraudulent activity, cheating, collusion, money laundering, and other prohibited conduct on the Platform.
• Sending you account-related communications, including transaction confirmations, security alerts, and policy update notifications.
• Responding to your customer support inquiries, resolving disputes, and maintaining records of interactions for quality assurance purposes.
• With your explicit consent only: sending promotional communications about ace66 bonuses, new games, and special offers via email or SMS.

Under the Data Privacy Act of 2012, ace66 must have a lawful basis for processing your personal data. The legal bases on which ace66 relies are:

• Consent — Processing for direct marketing communications is based on your explicit consent provided during registration or via your account notification preferences. You may withdraw this consent at any time through your account settings without affecting the lawfulness of prior processing.
• Contractual Necessity — The majority of processing activities — including account creation, payment processing, and delivering gaming services — are necessary for the performance of the contract between you and ace66 as set out in the Terms and Conditions.
• Legal Obligation — Certain processing activities, particularly KYC identity verification, AML transaction monitoring, and regulatory reporting, are required by Philippine law including RA 9160 (AMLA), RA 10365, and PAGCOR's regulatory framework.
• Legitimate Interest — Processing for fraud prevention, platform security, responsible gaming monitoring, and internal analytics is carried out on the basis of ace66's legitimate interests, provided those interests are not overridden by your rights and interests as a data subject.

ace66 does not sell, rent, or otherwise commercialise your personal data. We share personal data only in the limited circumstances described below, and only to the extent strictly necessary for the stated purpose:

• Payment Processors — GCash, Maya, BPI, BDO, Metrobank, and other approved Philippine payment providers receive only the transaction data necessary to process your deposit or withdrawal request.
• KYC & AML Compliance Providers — Third-party identity verification and sanctions screening services assist ace66 in meeting its regulatory obligations. These providers act as data processors under written agreements that require them to handle your data only on ace66's documented instructions.
• Game Content Providers — Licensed game providers whose titles are available on the ace66 Platform may receive a pseudonymised player identifier and session data necessary to deliver the game experience and calculate results. These providers do not receive your full identity data.
• Regulatory & Law Enforcement Authorities — ace66 is legally obligated to disclose personal data and transaction records to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or Philippine law enforcement agencies where required by law, court order, or lawful regulatory direction.
• Professional Advisers — Lawyers, auditors, and compliance consultants engaged by ace66 may access personal data on a strictly need-to-know basis, subject to professional confidentiality obligations.

ace66 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your login session, and analyse aggregate usage patterns to improve the user experience. The following categories of cookies are used on the ace66 Platform:

• Strictly Necessary Cookies — Essential for the Platform to function. These include session authentication tokens that keep you logged in during a gaming session. They cannot be disabled without breaking core Platform functionality.
• Functional Cookies — Remember your preferences such as language settings, preferred payment method display, and responsible gaming reminder intervals. These persist between sessions to provide a consistent experience.
• Analytics Cookies — Collect anonymised, aggregated data about how players navigate the Platform — which pages are visited most, where users drop off, and how features are used. This data helps ace66 improve the Platform experience for all Filipino players.
• Security Cookies — Support fraud detection and platform security functions, including detecting unusual login patterns, IP anomalies, and suspicious session behaviour that may indicate account compromise.

You may configure your browser to block or delete cookies; however, disabling strictly necessary cookies will prevent you from accessing your ace66 account. For detailed cookie management instructions specific to your browser or device, refer to your browser's help documentation. ace66 does not use third-party advertising or retargeting cookies.

ace66 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including for satisfying any legal, accounting, regulatory, or reporting requirements. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, as required by PAGCOR licensing conditions and Philippine AML regulations.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction in compliance with RA 9160 (AMLA) and its amendments.
• KYC Documents: Retained for five (5) years after account closure or the last transaction, whichever is later, in line with PAGCOR KYC retention requirements.
• Support Communications: Retained for three (3) years from the date of the interaction for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for the duration of consent and for two (2) years following withdrawal of consent as evidence of prior lawful processing.
• Technical & Session Logs: Retained for ninety (90) days for security monitoring purposes, after which they are automatically purged or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted, destroyed, or anonymised so that it can no longer be attributed to an identifiable individual.

ace66 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security framework includes:

• 256-bit SSL/TLS encryption for all data transmitted between your device and ace66's servers.
• AES-256 encryption for sensitive data at rest, including identity documents and financial records stored in our databases.
• Multi-factor authentication (MFA) options available to all registered ace66 players to protect against unauthorised account access.
• Role-based access controls ensuring that ace66 staff can access personal data only to the extent required by their specific job function.
• Regular independent security audits and penetration testing of the Platform's infrastructure, conducted by qualified third-party cybersecurity professionals.
• Automated anomaly detection systems that flag and investigate unusual access patterns, login attempts, or transaction behaviours in real time.
• Data breach response procedures compliant with the NPC's mandatory breach notification requirements under RA 10173, including notification to affected data subjects within 72 hours of discovery where required.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data processed by ace66. To exercise any of these rights, contact ace66's Data Protection Officer as described in Section 14:

ace66 will respond to all verified data subject requests within fifteen (15) working days of receipt. In complex cases, we may extend this period by a further fifteen (15) working days, in which case we will notify you of the extension and the reason for it. We do not charge a fee for exercising your rights under RA 10173, except in cases of manifestly unfounded or excessive requests.

ace66 is strictly an adult gaming platform. In compliance with PAGCOR regulations and Philippine law, participation in any gambling activity on the ace66 Platform is limited to individuals who are 21 years of age or older. ace66 does not knowingly collect, process, or retain personal data from individuals below the age of 21.

If you have reason to believe that a minor has registered an account on the ace66 Platform, please contact our Data Protection Officer immediately at [email protected] so that we can take prompt corrective action.

In the course of operating the ace66 Platform, certain personal data may be transferred to, stored in, or processed by systems located outside of the Philippines — for example, where a game content provider or cloud infrastructure provider operates data centres in other jurisdictions. Where such transfers occur, ace66 ensures that:

• The recipient country provides an adequate level of data protection as assessed by the National Privacy Commission, or
• Appropriate safeguards are in place, including contractual clauses that require the overseas recipient to apply data protection standards equivalent to those mandated by RA 10173, or
• The transfer is necessary for the performance of a contract with you, such as delivering a game from an overseas-hosted game server.

ace66 does not transfer your government-issued identity documents or financial account details to overseas recipients except where strictly required by our KYC compliance obligations or where you have given explicit consent to such a transfer.

ace66 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, PAGCOR regulatory requirements, or the features available on the Platform. When we make material changes to this Policy, we will notify you by:

• Posting a prominent notice on the ace66 Platform at the time of login for a period of not less than thirty (30) days following the effective date of the updated Policy.
• Sending an email notification to the registered email address associated with your ace66 account.
• Updating the "Effective Date" and version number displayed at the top of this page.

Your continued use of the ace66 Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you should cease using the Platform and contact our Data Protection Officer to request closure of your account and deletion of your personal data, subject to our legal retention obligations.

ace66 has appointed a Data Protection Officer (DPO) in accordance with Section 21 of the Data Privacy Act of 2012. If you have any questions about this Privacy Policy, wish to exercise your rights as a data subject, or need to report a potential data breach or privacy concern, you may reach our DPO through the following channels:

When submitting a data subject request, please include your full name, registered ace66 username, the email address associated with your account, and a clear description of your request. ace66 may need to verify your identity before processing your request to ensure we disclose or modify data only to the account holder.