idd888 Privacy Policy – How We Handle Your Personal Data

idd888 ("idd888," "we," "us," or "our") is the data controller responsible for personal data collected through the idd888 online gaming platform accessible at idd888.one. idd888 operates under a license issued by the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to Philippine law, including Republic Act No. 10173 (Data Privacy Act of 2012, or "DPA") and its Implementing Rules and Regulations.

As a PAGCOR-licensed operator, idd888 is required to maintain a designated Data Protection Officer (DPO) responsible for overseeing compliance with the DPA and serving as the point of contact for data subjects exercising their privacy rights. The DPO may be reached at the contact details provided in Section 14 of this Policy.

This Privacy Policy applies to all personal data processed by idd888 in connection with the registration, operation, and management of player accounts, the provision of gaming services, payment processing, customer support interactions, and all other activities conducted through or in relation to idd888.one.

idd888 collects the following categories of personal data, depending on your interaction with the Platform:

idd888 does not collect sensitive personal information (as defined under RA 10173) beyond what is strictly necessary for identity verification and legally mandated anti-money laundering due diligence. In particular, idd888 does not collect racial or ethnic origin, political opinions, religious beliefs, or genetic data.

idd888 collects personal data through the following means:

• Direct provision by you. Information you submit during account registration, KYC verification, deposit or withdrawal requests, support inquiries, or when setting responsible gaming preferences.
• Automated technical collection. Data collected automatically when you access idd888.one, including IP addresses, browser information, device identifiers, and session activity logs. This collection is facilitated through server logs, session management systems, and first-party cookies.
• Third-party payment processors. When you make a deposit via GCash, Maya, BPI, BDO, Metrobank, Coins.ph, or USDT, limited transaction reference data is shared between the payment processor and idd888 to confirm and reconcile the transaction. idd888 does not receive your full banking credentials or payment PIN from these processors.
• Game providers. Certified game providers supplying content to idd888 (including JILI, PG Soft, Evolution, Pragmatic Live, Microgaming, Fachai) may transmit aggregated game session and wagering data to idd888 for account crediting, dispute resolution, and regulatory reporting. These providers operate under data processing agreements with idd888.
• Fraud prevention and KYC services. idd888 may use third-party identity verification and fraud prevention services to assist with KYC compliance. These services process identity document images and biometric selfie data on idd888's behalf under strict data processing agreements.

idd888 processes personal data for the following purposes:

1. Account creation and management. To register your idd888 account, verify your identity, maintain your player profile, and provide access to the Platform's services.
2. Regulatory compliance (KYC / AML). To fulfill PAGCOR-mandated Know Your Customer requirements and comply with the Anti-Money Laundering Act (RA 9160) and its amendments, including filing of covered transaction reports (CTRs) and suspicious transaction reports (STRs) where legally required.
3. Payment processing. To process deposits, credit winnings to your account, and execute withdrawal requests to your verified payment methods.
4. Platform security and fraud prevention. To detect and prevent unauthorized account access, identify suspicious wagering patterns, investigate potential fraud, and protect the integrity of idd888's systems and all player accounts.
5. Customer support. To respond to inquiries, resolve disputes, process complaints, and provide assistance with account-related issues.
6. Responsible gaming. To maintain your responsible gaming settings, monitor for indicators of problem gambling in accordance with PAGCOR responsible gaming requirements, and deliver self-exclusion services where requested.
7. Platform improvement and analytics. To analyze aggregate usage patterns, optimize game performance, and improve the idd888 platform experience. Analytics are conducted on anonymized or pseudonymized data wherever possible.
8. Marketing communications (with consent). To send promotional offers, bonus notifications, and product updates to players who have affirmatively opted in to such communications. You may withdraw consent at any time by contacting idd888 support.
9. Legal obligations. To comply with court orders, regulatory directives from PAGCOR, subpoenas, and other legally compelled disclosures.

Under the Data Privacy Act of 2012, idd888 relies on the following legal grounds for processing personal data:

• Contractual necessity. Processing required to register and maintain your idd888 account and deliver the gaming services you have requested.
• Legal obligation. Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act, the Cybercrime Prevention Act, and other applicable Philippine statutes and regulations.
• Legitimate interests. Processing necessary to protect idd888's platform security, prevent fraud, manage operational risk, and conduct analytics — where such interests do not override your privacy rights.
• Consent. Processing for optional marketing communications, non-essential cookies, and any other processing that is not covered by the grounds above. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

idd888 does not sell your personal data. Data is shared only in the following circumstances and only to the extent necessary for the stated purpose:

All third-party service providers who process personal data on idd888's behalf are bound by data processing agreements that prohibit them from using your data for their own purposes and require them to maintain appropriate security measures.

idd888 retains personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable law. The following retention periods apply:

The 10-year retention periods for KYC and financial records reflect the minimum retention requirements under Republic Act No. 9160 (Anti-Money Laundering Act). Upon expiry of applicable retention periods, personal data is securely deleted or anonymized.

idd888 implements appropriate technical and organizational security measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption in transit. All data transmitted between your browser or device and idd888 servers is encrypted using TLS 1.3. No personal data travels over the network in plain text.
• Encryption at rest. Databases containing personal data are encrypted at rest using AES-256 or equivalent industry-standard encryption. Encryption keys are managed separately from encrypted data.
• Access controls. Access to personal data is restricted to idd888 personnel and authorized service providers with a legitimate operational need. Role-based access controls ensure that staff can access only the minimum data required for their function.
• Audit logging. All access to personal data records is logged. Logs are reviewed regularly for anomalous activity and retained in accordance with idd888's security audit policy.
• Pseudonymization. Where feasible, data used for analytics and platform improvement is pseudonymized to reduce privacy risk.
• Two-factor authentication. Internal system access for idd888 staff requires multi-factor authentication. Players are encouraged to enable 2FA on their accounts for additional account security.
• Vulnerability management. idd888 conducts regular security assessments and patches identified vulnerabilities in accordance with a defined vulnerability management process.
• Breach response procedure. idd888 maintains a documented data breach response plan. In the event of a breach posing a real risk of serious harm, idd888 will notify the National Privacy Commission within 72 hours and affected individuals as required by NPC Circular 16-03.

idd888.one uses cookies and similar technologies to operate and improve the Platform. The following cookie categories are in use:

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to and using idd888. Disabling analytics cookies will not affect your ability to use the Platform.

As a data subject under Republic Act No. 10173, you hold the following rights with respect to your personal data processed by idd888. These rights may be exercised by contacting idd888's Data Protection Officer using the details in Section 14.

idd888 will respond to rights requests within thirty (30) calendar days of receipt. Where a request requires additional verification or is complex, the response period may be extended by a further thirty (30) days with prior notice. idd888 does not charge a fee for rights requests unless they are manifestly unfounded or excessive.

The idd888 platform is strictly restricted to individuals aged 21 years and above. idd888 does not knowingly collect or process personal data from individuals below the age of 21. This is both a PAGCOR-mandated requirement and a commitment idd888 makes as part of its responsible gaming obligations.

If idd888 becomes aware that personal data has been collected from an individual who is under 21 years of age, it will immediately delete that data and close the associated account. Any deposits made by an underage account holder will be returned (less any applicable processing fees) to the verified original payment source.

If you are a parent or guardian and believe your child has registered an idd888 account without authorization, please contact idd888 support immediately at [email protected] so the account can be investigated and closed promptly.

The idd888 platform may contain references to third-party services, including payment processors and game providers, that operate under their own privacy policies. idd888 is not responsible for the privacy practices of these third parties and does not control their data collection or use.

When you interact with a third-party payment method — such as GCash, Maya, or your bank's internet banking portal — you are subject to that provider's privacy policy and terms of service in addition to idd888's. idd888 recommends reviewing the privacy policies of any third-party service you use in connection with your idd888 account.

idd888 does not link to external third-party websites from idd888.one for advertising or affiliate purposes. Any links on the Platform that are not to idd888's own internal pages are limited to payment processor interfaces necessary for completing transactions.

idd888 reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, platform operations, or data processing practices. Material changes will be communicated to registered players via the email address on file and/or via a prominent notice on idd888.one at least seven (7) days prior to the effective date of the change.

Your continued use of the idd888 platform following the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy. The "Last Updated" date at the top of this page will be revised upon each amendment.

Prior versions of the idd888 Privacy Policy are available upon request by contacting the Data Protection Officer. All prior versions are superseded by the current version in their entirety.

To exercise any of your rights under the Data Privacy Act, submit a privacy complaint, request a copy of your data, or ask questions about this Privacy Policy, please contact idd888's Data Protection Officer through the following channels:

• Email: [email protected] — Subject line: "Privacy Rights Request" or "DPO Inquiry"
• Live Chat: Available 24 hours a day, 7 days a week through the idd888 Platform at /idd888-login
• Response Time: idd888 aims to acknowledge all privacy requests within three (3) business days and to resolve them within thirty (30) calendar days.

If you are not satisfied with idd888's response to a privacy complaint, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (privacy.gov.ph). idd888 is registered with the NPC as a personal information controller as required by the Data Privacy Act.