Nuatar Privacy Policy

1. Introduction

Nuatar ("we," "us," or "our") operates the online gaming platform accessible at nuatar.net and through the Nuatar mobile application (collectively, the "Platform"). We are committed to protecting the privacy and personal data of every individual who interacts with the Platform, whether as a registered Member or as a visitor.

This Privacy Policy describes the types of personal information Nuatar collects, the purposes for which that information is used, the circumstances under which it may be shared with third parties, and the rights available to you as a data subject under applicable Philippine law.

By registering an Account on the Nuatar Platform or by continuing to use the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and contact Nuatar support to request account closure.

This Privacy Policy should be read together with the Nuatar Terms & Conditions, which govern your use of the Platform and are incorporated herein by reference.

2. Data Controller

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, Nuatar is the personal information controller responsible for the personal data collected through the Platform.

Nuatar is responsible for determining the purposes and means of processing personal data collected from Members and Platform visitors. Where Nuatar engages third-party service providers to process personal data on its behalf, those providers act as personal information processors and are bound by data processing agreements that require them to process data only in accordance with Nuatar's instructions and applicable law.

3. Data We Collect

Nuatar collects the following categories of personal data from Members and Platform visitors:

3.1 Identity Data

Full legal name, date of birth, nationality, and government-issued identification document details (e.g., PhilSys National ID number, passport number, driver's licence number, SSS ID, UMID, or voter's ID number) collected during the KYC verification process.

3.2 Contact Data

Email address, mobile phone number, and residential address provided during registration or KYC verification.

3.3 Financial Data

Payment method details necessary to process deposits and withdrawals, including GCash account identifiers, PayMaya account identifiers, and bank account details for BPI, BDO, and Metrobank transfers. Nuatar does not store full payment card numbers. Financial transaction records, including deposit amounts, withdrawal amounts, and transaction timestamps, are retained for regulatory compliance purposes.

3.4 Gaming Activity Data

Records of all wagers placed on the Platform, including game type, wager amount, outcome, timestamp, and session duration. Golden Bank loyalty points accrual and redemption history. Bonus and promotional offer participation records.

3.5 Technical Data

IP address, device type, operating system, browser type and version, screen resolution, time zone, and unique device identifiers collected automatically when you access the Platform. Session logs, login timestamps, and access records are also retained for security and fraud prevention purposes.

3.6 Communications Data

Records of communications between you and the Nuatar support team, including live chat transcripts, support ticket content, and any documents or information you voluntarily provide in the course of a support interaction.

3.7 Preference Data

Your marketing communication preferences, responsible gaming tool settings (including deposit limits, session time limits, and self-exclusion status), and any other preferences you configure through your Account settings.

Nuatar does not intentionally collect sensitive personal information beyond what is required for identity verification and regulatory compliance. Where the collection of sensitive data is unavoidable (for example, where a government-issued ID contains information about civil status or religion), that data is treated with the highest level of protection and is not used for any purpose other than identity verification.

4. How We Collect Data

Nuatar collects personal data through the following means:

• Direct collection: Information you provide when registering an Account, completing KYC verification, making a deposit or withdrawal, contacting support, or updating your Account settings.
• Automated collection: Technical data collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access the Platform via browser or mobile application.
• Third-party sources: Identity verification data obtained from KYC service providers and fraud screening services engaged by Nuatar to verify the accuracy of information you have provided. Payment transaction data received from payment processors in connection with deposit and withdrawal processing.
• Publicly available sources: In limited circumstances, Nuatar may supplement Member data with information from publicly available sources for the purpose of AML compliance and fraud prevention.

5. Purpose & Legal Basis for Processing

The table below sets out the purposes for which Nuatar processes personal data and the corresponding legal basis under the Philippine Data Privacy Act of 2012:

Where Nuatar relies on consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent for marketing communications does not affect your ability to use the Platform.

6. Data Sharing

6.1 Service Providers

Nuatar shares personal data with carefully selected third-party service providers who assist in the operation of the Platform. These include KYC and identity verification providers, payment processors (including GCash, PayMaya, BPI, BDO, and Metrobank), fraud detection and AML screening services, cloud infrastructure and hosting providers, and customer support platform providers. All service providers are bound by data processing agreements that restrict their use of personal data to the specific services they provide to Nuatar.

6.2 Regulatory and Law Enforcement Authorities

Nuatar may disclose personal data to regulatory authorities, law enforcement agencies, or other government bodies where required to do so by applicable law, court order, or regulatory directive. This includes disclosures required under Philippine AML regulations and gaming regulatory requirements.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Nuatar's business, personal data held by Nuatar may be transferred to the acquiring entity as part of that transaction. Nuatar will notify affected Members of any such transfer and the privacy practices of the acquiring entity prior to the transfer taking effect, to the extent permitted by applicable law.

6.4 No Sale of Personal Data

Nuatar does not sell, rent, lease, or otherwise transfer personal data to third parties for their own independent marketing or commercial purposes. Any data sharing is limited to the purposes described in this Privacy Policy.

7. Data Retention

Nuatar retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

• Account and KYC data: Retained for the duration of the Member's Account and for a minimum of five (5) years following account closure, in accordance with AML regulatory requirements.
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with applicable financial record-keeping requirements.
• Gaming activity records: Retained for a minimum of three (3) years from the date of the activity, or longer where required for regulatory compliance or dispute resolution purposes.
• Support communications: Retained for a minimum of two (2) years from the date of the last communication, or longer where the communication relates to an unresolved dispute or regulatory matter.
• Marketing preference records: Retained for the duration of the Member's Account and for one (1) year following account closure, to evidence consent and opt-out history.
• Technical and log data: Retained for a maximum of twelve (12) months from the date of collection, unless retention for a longer period is required for security investigation or regulatory compliance purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with Nuatar's data disposal procedures.

8. Data Security

Nuatar implements a comprehensive set of technical and organisational security measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and the Nuatar Platform;
• AES-256 encryption for sensitive data stored at rest, including identity documents and financial data;
• Role-based access controls limiting access to personal data to authorised Nuatar personnel on a need-to-know basis;
• Multi-factor authentication requirements for internal systems that process Member personal data;
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure;
• Incident response procedures for the detection, investigation, and notification of personal data breaches in accordance with applicable law.

While Nuatar takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. Nuatar cannot guarantee the absolute security of data transmitted to or from the Platform. You are responsible for maintaining the security of your Account credentials and for notifying Nuatar immediately if you suspect any unauthorised access to your Account.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Nuatar will notify the National Privacy Commission and affected Members in accordance with the requirements of the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations.

9. Your Rights as a Data Subject

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by Nuatar:

• Right to be informed: The right to be informed of the fact that your personal data is being collected and processed, and the purposes for which it is being processed — which is the primary purpose of this Privacy Policy.
• Right of access: The right to request a copy of the personal data Nuatar holds about you, together with information about how it is being processed.
• Right to rectification: The right to request correction of any inaccurate or incomplete personal data Nuatar holds about you.
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to Nuatar's legal and regulatory retention obligations.
• Right to object: The right to object to the processing of your personal data where Nuatar relies on legitimate interests as the legal basis for processing, and where your interests, rights, and freedoms override those legitimate interests.
• Right to data portability: The right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to withdraw consent: Where processing is based on your consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission of the Philippines if you believe that Nuatar has processed your personal data in violation of applicable law.

To exercise any of the above rights, please contact the Nuatar support team. Nuatar will respond to all data subject requests within thirty (30) calendar days of receipt, or within such extended period as permitted by applicable law where the request is complex or numerous.

Please note that certain rights are subject to limitations and exceptions under applicable law. For example, Nuatar may be unable to delete personal data that it is required to retain for regulatory compliance purposes, even upon request.

10. Cookies & Tracking Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device when you visit the Nuatar Platform. They allow the Platform to recognise your device, remember your preferences, maintain your session, and collect analytical data about how the Platform is used. Similar technologies, including web beacons, pixel tags, and local storage objects, may also be used for comparable purposes.

10.2 Types of Cookies Used

• Strictly necessary cookies: Required for the Platform to function correctly. These include session authentication cookies and security tokens. These cookies cannot be disabled without affecting Platform functionality.
• Functional cookies: Used to remember your preferences and settings, such as your preferred language and responsible gaming tool configurations.
• Analytical cookies: Used to collect aggregated, anonymised data about how Members use the Platform, enabling Nuatar to identify areas for improvement. This data does not identify individual Members.
• Marketing cookies: Used only where you have opted in to receive personalised promotional communications. These cookies help Nuatar deliver relevant offers based on your gaming activity and preferences.

10.3 Managing Cookies

You can manage your cookie preferences through the cookie settings panel available on the Platform. You may also configure your browser to block or delete cookies; however, disabling strictly necessary cookies will impair your ability to use the Platform. Note that blocking analytical or marketing cookies does not affect your ability to access gaming services on the Platform.

11. Minors

The Nuatar Platform is strictly intended for individuals who are at least twenty-one (21) years of age. Nuatar does not knowingly collect personal data from individuals under the age of 21. The minimum age requirement is enforced through mandatory KYC verification prior to enabling real-money gaming functionality.

If Nuatar becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted promptly and the associated Account will be suspended. If you believe that a minor has registered an Account on the Nuatar Platform, please contact Nuatar support immediately.

12. Cross-Border Data Transfers

In the course of providing the Platform and its associated services, personal data collected by Nuatar may be transferred to, stored in, or processed in countries other than the Philippines, including countries where Nuatar's cloud infrastructure providers or third-party service providers are located.

Where personal data is transferred outside the Philippines, Nuatar ensures that appropriate safeguards are in place to protect that data in accordance with the requirements of the Philippine Data Privacy Act of 2012. These safeguards include contractual data transfer agreements with receiving parties that impose data protection obligations equivalent to those applicable under Philippine law.

By using the Nuatar Platform, you consent to the transfer of your personal data to countries outside the Philippines where necessary for the provision of Platform services, subject to the safeguards described above.

13. Policy Amendments

Nuatar reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or Nuatar's data processing practices. Where amendments are material, Nuatar will provide reasonable advance notice to Members via the Platform or by email to the registered address on file.

The "Last Updated" date at the top of this page indicates when the Policy was most recently revised. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with any amendment, you should cease using the Platform and contact Nuatar support to request account closure.

Nuatar encourages you to review this Privacy Policy periodically to stay informed about how your personal data is being protected and used.

14. Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or Nuatar's handling of your personal data, please contact the Nuatar Data Privacy team. Support is available 24 hours a day, seven days a week, via live chat on the Platform.

You may also reach the Nuatar support team by email. The support email address is displayed below for your reference:

14.1 Complaints to the National Privacy Commission

If you are not satisfied with Nuatar's response to your privacy concern or data subject request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). The NPC is the independent government body responsible for administering and enforcing the Philippine Data Privacy Act of 2012. Information about how to file a complaint with the NPC is available on the NPC's official website.

Nuatar encourages Members to contact us directly in the first instance so that we have the opportunity to address your concern before escalation to the NPC.