ahh8 Privacy Policy —
Your Data, Protected and Respected

Introduction

This Privacy Policy ("Policy") describes how ahh8 ("ahh8," "we," "us," or "our"), operator of the online gaming platform at ahh8.net (the "Platform"), collects, uses, stores, discloses, and protects the personal information of registered users and visitors ("you" or "User") in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all issuances of the National Privacy Commission ("NPC").

ahh8 is also subject to applicable provisions of the Anti-Money Laundering Act (Republic Act No. 9160, as amended), the PAGCOR Regulatory Framework for online gaming operations, and Bangko Sentral ng Pilipinas (BSP) regulations governing electronic payment systems. This Policy reflects all obligations arising from those regulatory frameworks in so far as they relate to the processing of personal data.

By registering an account on ahh8, accessing the Platform, or submitting any personal information to us, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to the terms of this Policy, you should not use the Platform and should contact us to close your account.

Data Controller Information

For the purposes of the Data Privacy Act of 2012 and related NPC regulations, ahh8 acts as the Personal Information Controller ("PIC") in respect of the personal data collected through the Platform. As PIC, ahh8 determines the purposes and means of processing your personal information and is responsible for ensuring compliance with applicable data protection obligations.

ahh8 has appointed a Data Protection Officer ("DPO") as required under Section 21 of Republic Act No. 10173. The DPO is responsible for overseeing ahh8's data protection strategy, ensuring compliance with this Policy and applicable law, and serving as the primary point of contact for all privacy-related inquiries and data subject requests. The DPO can be contacted at [email protected].

Categories of Personal Data We Collect

ahh8 collects the following categories of personal data, depending on your interaction with the Platform:

How We Collect Personal Data

ahh8 collects personal data through the following means:

• Directly from you: When you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, participate in a promotion, or update your account settings.
• Automatically through the Platform: When you access the website or mobile platform, ahh8's systems automatically collect technical data including your IP address, device identifiers, browser type, operating system, and session activity logs for security and fraud prevention purposes.
• From payment providers: When you initiate a transaction via GCash, PayMaya, BPI, BDO, Metrobank, or UnionBank, those providers may share transaction confirmation data with ahh8 necessary to credit your account or process your withdrawal.
• From identity verification services: ahh8 may use accredited third-party eKYC providers to assist in verifying the authenticity of government-issued identification documents submitted during account verification.
• From regulatory authorities: PAGCOR, AMLC, and other Philippine government bodies may share information with ahh8 in connection with licensing compliance, suspicious transaction reporting, or law enforcement cooperation obligations.

Purposes of Processing Personal Data

ahh8 processes your personal data for the following specific, lawful purposes:

• Account Registration & Management: To create and maintain your player account, verify your identity and age (21+), and provide access to Platform services.
• Payment Processing: To process deposits and withdrawals via your registered GCash, PayMaya, or bank account, and to maintain accurate transaction records.
• Regulatory Compliance: To fulfill ahh8's obligations under the PAGCOR operating license, AMLC reporting requirements, and applicable Philippine law, including mandatory suspicious transaction reporting.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, account takeover, and other security threats to the Platform and to individual players.
• Responsible Gaming: To monitor gaming patterns for signs of problem gambling, to administer player-requested limits and self-exclusion tools, and to fulfill PAGCOR's responsible gaming requirements.
• Customer Support: To respond to inquiries, resolve disputes, and provide assistance through live chat, email, and other support channels.
• Marketing Communications: Where you have given explicit consent, to send you promotional offers, bonus notifications, and news about ahh8. You may withdraw this consent at any time by contacting support.
• Platform Improvement: To analyze aggregated, anonymized usage data to improve the performance, design, and game selection of the ahh8 platform.

ahh8 will not process your personal data for any purpose incompatible with those listed above without obtaining your prior explicit consent or unless required to do so by Philippine law.

Legal Basis for Processing

ahh8 processes personal data under the following legal bases as recognized by Republic Act No. 10173 and its Implementing Rules and Regulations:

• Consent: For marketing communications and optional data processing activities where your explicit consent has been obtained and recorded.
• Contractual Necessity: For processing required to perform ahh8's contractual obligations to you under the Terms and Conditions, including account services, payment processing, and game delivery.
• Legal Obligation: For processing required to comply with PAGCOR licensing conditions, AMLC reporting obligations, NPC registration requirements, and other applicable Philippine laws.
• Legitimate Interests: For fraud prevention, platform security monitoring, and responsible gaming analytics, where ahh8's legitimate interests are not overridden by your rights and freedoms as a data subject.

Data Sharing and Disclosure

ahh8 does not sell, rent, or trade your personal data to third parties for commercial purposes. We may share personal data with the following categories of recipients only to the extent necessary for the stated purposes:

• PAGCOR: As required under ahh8's operating license, including player data, transaction reporting, and responsible gaming records submitted in accordance with PAGCOR's regulatory reporting framework.
• Anti-Money Laundering Council (AMLC): Covered transaction reports and suspicious transaction reports as mandated by Republic Act No. 9160 and AMLC regulations.
• Payment Service Providers: GCash, PayMaya, BPI, BDO, Metrobank, and UnionBank receive the minimum personal data necessary to process your deposit or withdrawal transaction. These providers are subject to BSP regulation and their own privacy obligations.
• Identity Verification Providers: Accredited eKYC service providers who assist in verifying the authenticity and integrity of identity documents submitted during account verification, subject to data processing agreements.
• Technology Service Providers: Cloud infrastructure providers, cybersecurity firms, and platform technology partners who process personal data on ahh8's behalf under strict data processing agreements prohibiting independent use of data.
• Law Enforcement and Courts: Where required by a valid court order, subpoena, or lawful request from Philippine law enforcement authorities or the NPC.

International Data Transfers

The majority of ahh8's data processing operations are performed within the Philippines. In cases where personal data is transferred to or processed by service providers located outside the Philippines — for example, international cloud infrastructure providers or game software vendors — ahh8 ensures that such transfers comply with Section 21 of Republic Act No. 10173 and NPC Circular 16-03.

International data transfers from ahh8 are conducted only where: (a) the receiving country or organization provides an adequate level of data protection as recognized by the NPC; (b) appropriate contractual safeguards, including NPC-compliant standard contractual clauses, are in place; or (c) the transfer is necessary for the performance of your account contract or for compliance with a legal obligation.

Player data is never transferred internationally for marketing, data brokerage, or analytics purposes without explicit consent.

Data Retention

ahh8 retains personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law and regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC-approved data disposal procedures. Anonymized, aggregated data that cannot reasonably identify any individual may be retained for platform analytics beyond these periods.

Cookies and Similar Technologies

ahh8 uses cookies and similar session tracking technologies on the Platform. Cookies are small text files stored on your device that help us deliver a secure and functional gaming experience. The following types of cookies are used on ahh8:

• Strictly Necessary Cookies: Essential for Platform functionality, including maintaining your authenticated session, enforcing security controls, and processing transactions. These cannot be disabled without preventing Platform access.
• Performance Cookies: Collect anonymized data on how players use the Platform — pages visited, time spent, error messages — to help ahh8 improve performance and identify technical issues. No personally identifiable information is collected through these cookies.
• Functional Cookies: Remember your preferences such as language settings, display preferences, and responsible gaming settings to personalize your experience on return visits.

ahh8 does not use third-party advertising cookies, social media tracking pixels, or any cross-site behavioral tracking technologies on the Platform. You may manage cookie preferences through your browser settings at any time, noting that disabling strictly necessary cookies will affect Platform functionality.

Your Rights as a Data Subject

Under the Data Privacy Act of 2012 (Republic Act No. 10173) and NPC regulations, you have the following rights in respect of your personal data held by ahh8:

Processing of Data Relating to Minors

The ahh8 Platform is strictly intended for adults aged twenty-one (21) years and above in accordance with PAGCOR regulations and Philippine gambling law. ahh8 does not knowingly collect personal data from individuals under the age of 21.

All account registrations on ahh8 are subject to mandatory age verification as part of the KYC process. If ahh8 becomes aware that an individual under 21 years of age has submitted personal data or registered an account, we will immediately suspend the account, delete the personal data, and report the incident to PAGCOR as required by our operating license. Suspected cases of underage access to the Platform may also be referred to relevant Philippine child protection authorities.

Data Security Measures

ahh8 implements technical and organizational security measures appropriate to the nature, scope, and context of the personal data processed, in accordance with Section 20 of Republic Act No. 10173 and NPC Circular 16-01 on Security of Personal Data. These measures include:

• Encryption in Transit: All data transmitted between your device and ahh8's servers is encrypted using TLS 1.2 or higher (256-bit SSL). No personal or financial data is transmitted in plain text.
• Encryption at Rest: Sensitive personal data stored in ahh8's databases, including KYC documents and financial identifiers, is encrypted at rest using AES-256 encryption.
• Access Controls: Strict role-based access controls limit employee access to personal data to those with a demonstrated operational need. Administrative access to production systems requires multi-factor authentication.
• Security Audits: ahh8 undergoes regular independent security assessments, including penetration testing and vulnerability scanning, conducted by accredited cybersecurity firms.
• Incident Response: ahh8 maintains a documented personal data breach response plan. In the event of a breach likely to result in harm to affected individuals, ahh8 will notify the NPC within 72 hours and affected individuals without undue delay, in accordance with NPC Circular 16-03.
• Staff Training: All ahh8 personnel who handle personal data receive regular data privacy training covering their obligations under RA 10173 and ahh8's internal privacy policies.

Changes to This Privacy Policy

ahh8 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements. The current version of this Policy, with its effective date, is always available at ahh8.net/privacy-policy.

Where changes are material — meaning they significantly affect your rights or ahh8's data processing activities — we will provide reasonable prior notice via email to your registered address or through a prominent notice on the Platform before the changes take effect. Continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

For non-material changes such as typographical corrections, clarifications that do not alter the substance of existing provisions, or updates to contact details, no advance notice is required and the updated Policy takes effect immediately upon publication.

Contact Us & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by ahh8, please contact our Data Protection Officer through any of the following channels:

ahh8's DPO will acknowledge all privacy requests within seventy-two (72) hours and provide a substantive response within fifteen (15) business days. Complex requests involving data retrieval from multiple systems or requiring legal review may take longer; you will be informed of any extension within the initial 15-day response period.