spinplus
Privacy Policy

This Privacy Policy applies to all personal data processed by spinplus — the online gaming platform operated at spinplus.vu — in connection with the registration, maintenance, and closure of player Accounts, the provision of gaming and betting services, and the operation of the spinplus website and associated interfaces.

The data controller for personal data processed under this Policy is the legal entity that holds the PAGCOR license and operates the spinplus platform ("spinplus," "we," "us," or "our"). Contact information for the spinplus Data Protection Officer (DPO) is provided in Section 14.

This Policy applies to:

• All registered spinplus Account holders who are Philippine residents;
• Visitors to the spinplus website at spinplus.vu who have not yet registered an Account;
• Any individual whose personal data is submitted to spinplus in connection with an Account registration or KYC verification process.

This Policy does not apply to the data practices of third-party game providers, payment processors, or other service partners whose services you may access through spinplus. Those parties have their own privacy policies that govern their data handling independently.

spinplus collects the following categories of personal data from players and website visitors:

spinplus collects personal data through the following means:

• Direct submission: Data you provide when creating a spinplus Account, completing KYC verification, making deposits or withdrawals, or contacting spinplus support;
• Automated collection: Technical data collected automatically when you visit the spinplus website or use the platform, including device identifiers, IP addresses, and session metadata through server logs and analytics tools;
• Payment processors: Transaction confirmation data received from GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency processors when you initiate deposits or withdrawals;
• Third-party verification services: Identity verification results from KYC processing partners authorized to verify Philippine government-issued identification documents;
• Cookies and similar technologies: Browser cookies, session tokens, and local storage used to maintain your login session and platform preferences (see Section 9).

spinplus does not purchase personal data from data brokers or compile player profiles from external social media sources. The data we hold about you is data you have provided directly or that has been generated by your activity on the spinplus platform.

spinplus processes personal data on the following legal bases and for the following purposes:

spinplus does not sell, rent, or trade your personal data to third parties for their independent commercial purposes under any circumstances.

spinplus shares personal data with third parties only in the following limited circumstances:

• PAGCOR and Philippine regulatory authorities: Mandatory disclosure of player data as required by PAGCOR licensing conditions, AML reporting obligations under RA 9160, and any lawful order from a Philippine government authority or court of competent jurisdiction;
• KYC verification partners: Identity and document data shared with authorized identity verification service providers for the sole purpose of completing age and identity verification. These partners are contractually prohibited from using spinplus player data for any other purpose;
• Payment processors: Transaction data shared with GCash, PayMaya, BPI, BDO, Metrobank, and cryptocurrency payment processors as necessary to process deposits and withdrawals. Each processor operates under its own privacy policy;
• Game providers: Limited session data (game type, wager amounts, outcomes) shared with certified game providers as necessary for game delivery, dispute resolution, and certified RNG operation;
• Technology service providers: Technical and operational data shared with cloud hosting, cybersecurity, and analytics vendors under strict data processing agreements that prohibit independent use of spinplus player data;
• Legal proceedings: Personal data may be disclosed to law enforcement or legal representatives where spinplus is required to do so by applicable Philippine law or in defense of legal claims.

6.1 Mandatory KYC. spinplus is required under PAGCOR licensing conditions and Republic Act No. 9160 (Anti-Money Laundering Act) to verify the identity and age of all Account holders before processing withdrawal transactions. KYC data collected includes government ID documents, selfie photographs where required, and proof of payment method ownership.

6.2 KYC Data Handling. KYC documents submitted to spinplus are processed by authorized identity verification personnel and technology, stored in an encrypted and access-controlled environment, and used exclusively for the purposes of regulatory compliance, fraud prevention, and dispute resolution. KYC documents are not viewable by spinplus customer support agents beyond those specifically authorized for verification functions.

6.3 AML Monitoring. As required by Philippine anti-money laundering regulations, spinplus monitors account activity for patterns indicative of money laundering or terrorist financing. This monitoring is conducted using automated systems and human review where triggered. Suspicious activity reports are submitted to the Anti-Money Laundering Council (AMLC) as required by law. Players are not routinely notified of AML monitoring; such notification is prohibited by law in active investigation contexts.

6.4 Retention of KYC Records. KYC and AML-related records are retained for the periods specified in Section 7, consistent with the minimum retention requirements of RA 9160 and PAGCOR licensing conditions.

spinplus retains personal data for no longer than is necessary for the purposes for which it was collected, subject to the following minimum retention periods required by law:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized such that it can no longer be associated with any identifiable individual. Anonymized aggregate data may be retained indefinitely for statistical analysis.

spinplus implements technical and organizational security measures appropriate to the risk level of the personal data processed, consistent with the standards required by the National Privacy Commission (NPC) under RA 10173. These measures include but are not limited to:

• Transport encryption: All data transmitted between your device and spinplus servers is encrypted using TLS 1.2 or higher (256-bit SSL);
• Data at rest encryption: Sensitive personal data including KYC documents, financial records, and account credentials are encrypted at rest using industry-standard encryption algorithms;
• Access controls: Access to personal data is restricted to spinplus personnel and authorized service providers on a need-to-know basis. All access is logged and subject to periodic audit;
• Password security: User passwords are stored as one-way cryptographic hashes — spinplus cannot retrieve your plain-text password. Account authentication uses OTP verification as an additional security layer;
• Intrusion detection: spinplus operates automated intrusion detection and anomaly monitoring systems that flag unauthorized access attempts for immediate investigation;
• Penetration testing: spinplus infrastructure undergoes periodic third-party security assessments to identify and remediate vulnerabilities before they can be exploited.

The spinplus website uses cookies and similar browser storage technologies to operate essential platform functions and to understand how Filipino players use the platform. The following types of cookies are used:

• Essential cookies: Session authentication tokens required to maintain your login state across pages. Without these cookies, the spinplus platform cannot function. They are deleted when you close your browser or explicitly log out;
• Preference cookies: Store your platform preferences such as language settings, game filter selections, and responsible gaming configuration to persist across sessions;
• Analytics cookies: Collect anonymized or pseudonymized data about how visitors navigate the spinplus website, which pages are visited most frequently, and where technical errors occur. This data is used to improve the platform experience for Filipino players;
• Security cookies: Used to detect and prevent fraudulent login attempts, bot activity, and session hijacking.

spinplus does not use third-party advertising cookies or tracking technologies for the purpose of serving targeted advertising to spinplus players on external websites. You may configure your browser to refuse cookies; note that refusing essential cookies will prevent you from logging in to your spinplus Account.

As a Filipino data subject under Republic Act No. 10173 (Data Privacy Act of 2012), you have the following rights with respect to your personal data held by spinplus. To exercise any of these rights, contact the spinplus Data Protection Officer using the contact information in Section 14. spinplus will respond to all rights requests within thirty (30) days unless the volume or complexity of the request requires an extension, in which case you will be notified.

The spinplus platform is strictly for use by individuals aged 21 and above who are Philippine residents. spinplus does not knowingly collect personal data from individuals under the age of 21. The spinplus Account registration process includes an age declaration requirement, and KYC verification is required before withdrawal processing to confirm that all Account holders meet the minimum age requirement.

If spinplus becomes aware that personal data has been collected from an individual under the age of 21, that Account will be immediately suspended, the data collected will be deleted or returned to the extent practicable, and the matter will be reported to PAGCOR consistent with spinplus's regulatory obligations. If you are a parent or guardian and believe that an individual under 21 has accessed the spinplus platform, please contact the spinplus Data Protection Officer at the contact details in Section 14 immediately.

In the event of a personal data breach that poses a real risk to the rights and freedoms of affected spinplus players, spinplus will take the following actions in accordance with the notification requirements of RA 10173 and NPC regulations:

• Internal containment: spinplus's security incident response team will work to contain and mitigate the breach as rapidly as practicable from the point of discovery;
• NPC notification: spinplus will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of a reportable breach, as required by NPC Circular No. 16-03;
• Affected data subject notification: spinplus will notify affected players whose personal data has been compromised within a reasonable timeframe following NPC notification, providing details of the nature of the breach, the data categories affected, and the steps players can take to protect themselves;
• Post-incident review: Following containment, spinplus will conduct a root cause analysis and implement measures to prevent recurrence, with findings documented and retained for audit purposes.

spinplus may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or regulatory requirements. The most current version of this Policy will always be available at spinplus.vu/privacy-policy, with the effective date displayed prominently at the top of the page.

Where changes to this Policy are material — meaning they substantially affect how we collect or use your personal data, or reduce the rights available to you — spinplus will notify registered Account holders via SMS to their registered Philippine mobile number at least fourteen (14) days prior to the effective date of the changes.

Your continued use of the spinplus platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated Policy. If you do not agree with material changes to this Policy, you have the right to close your Account and request deletion of your data in accordance with Section 10.

spinplus has appointed a Data Protection Officer (DPO) in compliance with Republic Act No. 10173. The DPO is responsible for overseeing spinplus's compliance with this Privacy Policy and applicable Philippine data protection law. For any privacy-related queries, rights requests, or complaints, contact: