sz77 Privacy Policy

This Privacy Policy ("Policy") is issued by sz77 ("sz77", "we", "us", "our") and describes how sz77 collects, processes, stores, uses, discloses, and protects the personal information of individuals ("you", "User", "Player") who access or use the sz77 online gaming platform available at sz77.win and any associated mobile-optimised pages or services.

This Policy applies to all personal data processing activities conducted by sz77 in connection with the operation of the sz77 platform, including account registration, identity verification, payment processing, gameplay, responsible gaming compliance, marketing communications, and customer support. It covers personal data collected through the sz77 website, live chat, email communications, and customer support channels.

This Policy is designed to comply with the requirements of Republic Act 10173 — the Philippine Data Privacy Act of 2012 ("DPA") — and its Implementing Rules and Regulations ("IRR"), as administered by the National Privacy Commission of the Philippines ("NPC"). Where sz77 processes personal data of individuals located outside the Philippines, additional or supplementary data protection obligations may apply.

For the purposes of the Philippine Data Privacy Act of 2012, sz77 is the Personal Information Controller (PIC) in respect of all personal data collected and processed through the sz77 platform. As PIC, sz77 determines the purposes and means of processing your personal data and is accountable for ensuring that processing is carried out lawfully, fairly, and securely.

sz77 has designated a Data Protection Officer (DPO) responsible for overseeing data protection compliance, handling data subject requests, and managing the sz77 data privacy management programme in accordance with NPC Circular 16-01 and related issuances. The DPO can be contacted at the address set out in Section 15 of this Policy.

sz77 collects the following categories of personal data, depending on your interaction with the platform:

sz77 does not intentionally collect special categories of sensitive personal information — such as racial or ethnic origin, political opinions, religious beliefs, health data (other than for responsible gaming purposes), or biometric data — unless you voluntarily provide such information or it is strictly required for regulatory compliance.

sz77 collects personal data through the following means:

• Direct Collection: Data you provide when registering an account, completing KYC verification forms, making deposits or withdrawals, updating account settings, contacting customer support, or participating in promotions;
• Automated Collection: Technical and usage data collected automatically when you visit or interact with the sz77 platform, via cookies, web beacons, server logs, and similar tracking technologies (see Section 8);
• Third-Party Sources: Identity verification data from PAGCOR-compliant KYC service providers; transaction data from payment processors (GCash/GXchange Inc., Maya/Voyager Innovations); fraud detection signals from cybersecurity partners; and publicly available sources for AML screening purposes;
• Regulatory Sources: Data received from PAGCOR, the Anti-Money Laundering Council (AMLC), or other Philippine government authorities in connection with lawful requests or compliance obligations.

Under the Philippine Data Privacy Act, sz77 processes your personal data on one or more of the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the sz77 Terms & Conditions, including operating your account, processing transactions, and delivering gaming services;
• Legal Obligation: Processing necessary to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160 as amended), the Data Privacy Act (RA 10173), and other applicable Philippine laws and regulations;
• Legitimate Interest: Processing for fraud prevention, platform security, responsible gaming monitoring, internal analytics, and service improvement, where such interests are not overridden by your data protection rights;
• Consent: For marketing communications and non-essential cookies and analytics, where your explicit, informed, and freely given consent has been obtained. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

sz77 processes your personal data for the following specific, explicit, and legitimate purposes:

• Account Management: Creating, maintaining, verifying, and closing your sz77 player account; authenticating your identity at login; managing account preferences and settings;
• Gaming Services Delivery: Enabling your participation in casino games, sports betting, bingo, fish shooting, and other platform features; recording game outcomes and transaction histories;
• Payment Processing: Processing deposits via GCash, Maya, BPI, BDO, Metrobank, and other supported Philippine payment channels; processing withdrawal requests; reconciling financial records;
• KYC & Identity Verification: Verifying your identity and age (21+) as required under PAGCOR licensing conditions and Philippine AML obligations;
• Regulatory Compliance: Meeting AML reporting obligations under RA 9160; responding to lawful requests from PAGCOR, AMLC, and other Philippine authorities; maintaining records as required by law;
• Fraud Prevention & Security: Detecting and preventing fraudulent accounts, unauthorised access, collusion, bonus abuse, and other prohibited conduct; maintaining platform integrity;
• Responsible Gaming: Monitoring gaming activity for indicators of problem gambling; enforcing deposit limits, self-exclusion, and cooling-off periods; maintaining responsible gaming records as required by PAGCOR;
• Customer Support: Responding to queries, complaints, and account issues submitted via live chat, email, or support tickets;
• Platform Improvement: Analysing aggregated and anonymised usage data to improve platform performance, user experience, and game offerings;
• Marketing Communications: Sending promotional offers, bonus notifications, and platform news to players who have opted in — subject to your communication preferences and consent.

sz77 does not sell, rent, or trade your personal information. We share personal data with third parties only in the limited circumstances described below:

• Payment Service Providers: GCash (GXchange Inc.), Maya (Voyager Innovations Inc.), BPI, BDO, Metrobank, and other licensed Philippine payment processors receive transaction data necessary to execute your deposits and withdrawals. These providers are independent data controllers subject to their own privacy policies and Bangko Sentral ng Pilipinas (BSP) oversight;
• KYC & AML Service Providers: Identity verification and anti-money laundering screening platforms operating under strict data processing agreements and Philippine data protection obligations;
• Game Content Providers: Third-party game studios whose titles are hosted on the sz77 platform receive anonymised gameplay session data necessary to deliver their games — they do not receive your identity or payment information;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities where disclosure is required by law, court order, or regulatory direction;
• IT & Platform Service Providers: Cloud infrastructure, cybersecurity, customer support software, and analytics vendors operating under data processing agreements that bind them to sz77's data protection standards;
• Professional Advisers: Legal, accounting, and compliance advisers under obligations of confidentiality where disclosure is necessary to obtain professional advice or in connection with legal proceedings.

All third-party data processors engaged by sz77 are contractually required to process personal data only on sz77's documented instructions, to maintain appropriate technical and organisational security measures, and to comply with the Philippine Data Privacy Act and any other applicable data protection laws.

sz77 uses cookies and similar tracking technologies on the sz77.win platform. Cookies are small text files placed on your device that help the platform function correctly, remember your preferences, maintain your login session, and generate aggregated usage analytics.

sz77 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for platform operation — including maintaining your login session, processing financial transactions, and applying responsible gaming controls. These cannot be disabled without impairing platform functionality;
• Functional Cookies: Remember your preferences such as language settings, display options, and last-visited game categories to improve your experience across sessions;
• Analytics Cookies: Collect aggregated, anonymised data on how users navigate the sz77 platform — pages visited, session duration, feature usage — to improve platform design and performance. These are not used to identify individual users;
• Security Cookies: Support fraud detection and prevention mechanisms, device fingerprinting for suspicious login detection, and CSRF protection.

You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the sz77 platform, including logging in and processing transactions. sz77 does not use third-party advertising or tracking cookies that share your data with external advertising networks.

sz77 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law, whichever period is longer. The following indicative retention periods apply:

• Account Data (active accounts): Retained for the duration of the account relationship and for a minimum of five (5) years following account closure, as required under PAGCOR licensing conditions and AML record-keeping obligations;
• KYC & Identity Verification Documents: Retained for a minimum of five (5) years from the date of the most recent transaction or account closure, as mandated under RA 9160 (AMLA) and its amendments;
• Financial Transaction Records: Minimum five (5) years from the date of each transaction, consistent with AMLC record-keeping requirements;
• Customer Support Records: Three (3) years from the date of the most recent support interaction, unless longer retention is required for ongoing disputes or legal proceedings;
• Marketing Data (consented): Until you withdraw your marketing consent or request deletion, subject to any overriding legal retention obligation;
• Security Logs and Technical Data: Up to twelve (12) months from generation, unless retained as evidence in connection with suspected fraud, security incidents, or active investigations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to a specific individual.

sz77 implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and sz77 servers is encrypted using TLS/SSL 256-bit encryption, consistent with the standards applied by Philippine banks and PAGCOR-regulated operators;
• Encryption at Rest: Sensitive personal data stored on sz77 servers — including identity documents, financial data, and passwords — is encrypted at rest using industry-standard AES-256 cryptography;
• Access Controls: Personal data is accessible only to sz77 staff and authorised service providers who have a legitimate operational need. Role-based access controls and multi-factor authentication are applied to all administrative systems;
• Password Security: Player passwords are stored as one-way cryptographic hashes — sz77 staff cannot read or recover your password, only reset it;
• Intrusion Detection: sz77 operates continuous network monitoring and intrusion detection systems. Suspicious activity triggers automated alerts and manual investigation;
• Third-Party Penetration Testing: The sz77 platform undergoes regular security assessments, including third-party penetration testing, to identify and remediate vulnerabilities;
• Incident Response: sz77 maintains a documented data breach response procedure aligned with NPC Circular 16-03 requirements, including notification to the NPC and affected data subjects within the timeframes prescribed by the DPA.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by sz77. These rights are exercisable by submitting a verified written request to sz77's Data Protection Officer at the contact details in Section 15.

sz77 will respond to verified data subject requests within fifteen (15) business days of receipt. Where a request is complex or numerous, this period may be extended by up to thirty (30) additional days, with notification to you of the extension and reasons thereof. sz77 does not charge fees for standard data subject requests.

sz77 implements age verification checks during the account registration process and as part of KYC procedures. Where sz77 discovers or has reasonable grounds to believe that an account has been registered by or for an individual under 21 years of age, sz77 will immediately suspend the account, notify the appropriate PAGCOR authority, and securely delete or quarantine any personal data collected in connection with that account to the extent consistent with applicable legal obligations.

If you believe that a minor has accessed the sz77 platform or provided personal data, please contact sz77's Data Protection Officer immediately at the details provided in Section 15.

sz77's primary operations and data infrastructure are based in the Philippines. Certain third-party service providers engaged by sz77 — including cloud hosting infrastructure, cybersecurity partners, and game content providers — may process personal data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, sz77 ensures that appropriate safeguards are in place in accordance with Section 21 of the Philippine Data Privacy Act and relevant NPC issuances. Such safeguards include:

• Standard contractual clauses prescribed by or acceptable to the National Privacy Commission;
• Binding corporate rules where the recipient is part of a group with an approved BCR programme;
• Transfer to jurisdictions recognised by the NPC as providing an adequate level of data protection.

You may request information about the specific safeguards applied to any cross-border transfer of your personal data by contacting sz77's Data Protection Officer.

sz77 reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, NPC guidance, platform features, or data processing practices. The "Effective Date" and "Last Updated" date at the top of this page will be revised to reflect any changes.

Where amendments are material — meaning they significantly affect your privacy rights or the manner in which sz77 processes your personal data — sz77 will provide advance notice to registered account holders via the email address on file before the amended Policy takes effect. For non-material clarifications or corrections, the updated Policy takes effect upon publication.

Your continued use of the sz77 platform following the effective date of any Policy amendment constitutes your acknowledgement of the updated Policy. We encourage you to periodically review this page to remain informed of how sz77 manages your personal information.

For any privacy-related queries, to exercise your data subject rights, or to raise a concern about how sz77 handles your personal information, please contact the sz77 Data Protection Officer:

Data Protection Officer, sz77
Email: [email protected]
Platform: sz77.win
Operating Jurisdiction: Republic of the Philippines, under PAGCOR authority

sz77's DPO will acknowledge your query within three (3) business days and provide a substantive response within fifteen (15) business days of receipt of a verified request.