panalo
Privacy Policy

panalo is committed to protecting the personal data of its players, employees, and business partners. This Policy has been prepared in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and applicable issuances of the National Privacy Commission ("NPC") of the Philippines.

This Policy applies to all personal data collected and processed by panalo in the course of operating its online gaming platform, including data collected during registration, account management, financial transactions, customer support interactions, and gameplay activity. It applies regardless of whether you access the platform via a web browser, the panalo mobile application, or any other authorized interface.

This Policy does not apply to third-party websites, services, or platforms that may be accessible through links on the panalo platform. panalo is not responsible for the privacy practices of third-party operators. We encourage you to review the privacy policies of any third-party services you access.

For the purposes of the Data Privacy Act of 2012 and this Policy, panalo acts as the Personal Information Controller in respect of personal data collected through the panalo platform. panalo is a Philippine-based online gaming operator licensed by the Philippine Amusement and Gaming Corporation (PAGCOR).

panalo has appointed a Data Protection Officer ("DPO") in accordance with NPC requirements. Queries, complaints, and requests relating to the exercise of data subject rights may be directed to panalo's DPO via the contact channels described in Section 14 of this Policy.

The following table describes the categories of personal data that panalo collects and processes, together with the context in which each category is collected:

panalo does not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or health data, except where health-related information is voluntarily provided by a player in the context of a responsible gaming request or self-exclusion.

panalo collects personal data through the following methods:

4.1 Direct Collection

You provide data directly to panalo when you register an account, complete KYC verification, make deposits or withdrawal requests, contact customer support, participate in promotions, or update your account settings.

4.2 Automated Collection

When you access the panalo platform — whether on web or mobile — our systems automatically collect technical data including your IP address, device identifiers, browser type, operating system, session duration, pages visited, and game activity. This data is collected using server logs, cookies, and similar tracking technologies as described in Section 11.

4.3 Third-Party Collection

In certain circumstances, panalo may receive personal data from third parties, including:

• Payment processors (GCash, Maya, BPI, BDO, Metrobank) confirming the status and reference numbers of financial transactions.
• Identity verification service providers confirming the validity of government-issued identification documents submitted during KYC.
• PAGCOR or other regulatory authorities, in the context of compliance investigations or regulatory reporting obligations.
• Fraud detection and anti-money laundering screening services, which may provide risk signals related to identified patterns of suspicious behavior.

panalo processes your personal data on one or more of the following lawful bases as recognized under the Data Privacy Act of 2012:

• Consent: Where you have provided clear, informed, and voluntary consent to the processing, such as when opting in to marketing communications.
• Contractual Necessity: Where processing is necessary to perform the contract between you and panalo — specifically, to provide you with access to the platform, process deposits and withdrawals, and deliver gaming services as described in our Terms & Conditions.
• Legal Obligation: Where processing is required to comply with applicable Philippine law, including obligations under the Anti-Money Laundering Act (RA 9160), PAGCOR licensing conditions, the Data Privacy Act, and Bureau of Internal Revenue requirements.
• Legitimate Interests: Where processing is necessary for panalo's legitimate business interests — including fraud prevention, platform security, abuse detection, and service improvement — provided those interests are not overridden by your rights and freedoms.
• Vital Interests: In exceptional circumstances, where processing is necessary to protect life or prevent serious harm, including referral to emergency or welfare services in connection with a responsible gaming crisis.

panalo uses the personal data it collects for the following specific and declared purposes:

6.1 Account Management and Service Delivery

To create and maintain your panalo account; to verify your identity and age (you must be at least 21 years old) during registration and KYC; to process deposits and withdrawals via GCash, Maya, and other approved Philippine payment channels; to provide access to the full game library; and to communicate account status, transaction confirmations, and security alerts.

6.2 Regulatory Compliance

To fulfill panalo's obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act, the Data Privacy Act, and all other applicable Philippine laws and regulations. This includes maintaining transaction records for the periods required by law, conducting AML/CTF due diligence, and reporting to regulatory authorities as required.

6.3 Fraud Prevention and Security

To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and unauthorized platform access. To monitor login patterns and flag anomalous activity that may indicate Account compromise.

6.4 Responsible Gaming

To administer and enforce responsible gaming tools set by you, including deposit limits, session timers, cooling-off periods, and self-exclusion. To identify patterns of play that may indicate problem gambling and to proactively reach out where our responsible gaming procedures require us to do so.

6.5 Customer Support

To respond to your queries, complaints, and support requests; to maintain records of support interactions for quality assurance and dispute resolution; and to improve the quality and responsiveness of our support services.

6.6 Platform Improvement

To analyze aggregated and anonymized platform usage data to improve game selection, user interface design, payment process efficiency, and overall player experience. Individual player profiles are not used for this purpose — only anonymized, non-identifiable aggregated data.

6.7 Marketing Communications

Where you have provided explicit consent, to send you information about panalo promotions, new games, and platform updates via your registered mobile number or email address. You may withdraw consent to marketing communications at any time by notifying panalo support. Withdrawal of marketing consent does not affect the lawfulness of prior processing or your right to continue using the platform.

panalo does not sell, rent, or trade your personal data to any third party. Personal data is shared with third parties only in the following limited circumstances, and only to the minimum extent necessary for each purpose:

7.1 Service Providers (Personal Information Processors)

panalo engages third-party service providers — acting as Personal Information Processors under the DPA — to support platform operations. These include payment processing partners (GCash, Maya, bank partners), identity verification providers, cloud hosting and data storage providers, and customer support software vendors. All processors are contractually bound to process data only on panalo's instructions and to maintain security standards consistent with this Policy.

7.2 Game Content Providers

Live casino and certain RNG game providers may receive limited technical data (such as a player session identifier or anonymized player reference) necessary to deliver seamless gameplay. No directly identifying personal data (such as your full name, mobile number, or ID details) is transmitted to game providers.

7.3 Regulatory and Legal Authorities

panalo will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, the Bureau of Internal Revenue, or any other competent Philippine authority when required to do so by applicable law, court order, or valid regulatory direction. In such cases, panalo will disclose only the data specifically required by the relevant legal obligation.

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of panalo's business, personal data held by panalo may be transferred to the acquiring entity as part of that transaction. In such circumstances, panalo will ensure that any acquiring entity is bound by obligations consistent with this Policy and will provide advance notice to affected players to the extent permitted by law.

panalo retains personal data for as long as is necessary to fulfill the declared processing purposes, and in compliance with mandatory retention periods imposed by applicable law. The following retention periods apply:

• Account and Identity Data: Retained for the duration of the active Account relationship, plus five (5) years following account closure, in compliance with PAGCOR licensing requirements and AML recordkeeping obligations under RA 9160.
• Financial Transaction Data: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act and Bureau of Internal Revenue regulations.
• KYC Verification Documents: Retained for five (5) years following account closure or the end of the customer relationship, whichever is later.
• Customer Support Records: Retained for three (3) years from the date of the support interaction, for dispute resolution and quality assurance purposes.
• Gameplay and Betting Records: Retained for five (5) years for regulatory compliance and dispute resolution.
• Marketing Consent Records: Retained for three (3) years from the date of consent or last interaction, whichever is later, to evidence compliance with consent obligations.
• Technical and Log Data: Retained for twelve (12) months from the date of collection, unless a longer period is required in connection with an active fraud investigation or regulatory inquiry.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized using industry-standard methods such that it can no longer be attributed to an identifiable individual.

panalo implements a comprehensive set of technical and organizational security measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your device and panalo's servers is encrypted using TLS 1.2 or higher (256-bit SSL). This applies to all platform interactions including login, deposits, withdrawals, and live chat.
• Encryption at Rest: Personal data stored in panalo's databases and cloud infrastructure is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data held by panalo is restricted to personnel who require it to perform their specific job functions. All internal access is subject to role-based access controls, multi-factor authentication, and regular access reviews.
• Two-Factor Authentication: Player accounts are protected by optional two-factor authentication. panalo automatically applies step-up authentication for logins from new or unrecognized devices.
• Intrusion Detection: panalo's infrastructure is monitored 24/7 by automated intrusion detection and anomaly identification systems. Alerts are reviewed by our security team in real time.
• Penetration Testing: panalo conducts regular independent security assessments and penetration testing of the platform. Critical vulnerabilities identified are remediated on a priority basis.
• Employee Training: All panalo personnel with access to personal data receive mandatory data privacy and security training upon onboarding and at regular intervals thereafter.

Notwithstanding these measures, no data transmission over the internet or data storage system is completely immune from breach. In the event of a personal data breach that is likely to result in serious harm to data subjects, panalo will comply with its NPC breach notification obligations and will notify affected players without undue delay.

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by panalo. These rights may be exercised by contacting panalo's Data Protection Officer via the channels described in Section 14.

10.1 Right to Access

You have the right to request a copy of the personal data panalo holds about you, along with information about the purposes for which it is processed, the categories of data held, and any third parties to whom it has been disclosed.

10.2 Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data held about you. Where feasible, you may update certain information directly through your Account Settings. For changes to identity or financial data, verification may be required.

10.3 Right to Erasure

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn and there is no other legal basis for processing, or where processing is unlawful. Note that this right is subject to panalo's legal retention obligations — panalo may not be able to delete data that must be retained under AML, PAGCOR, or tax regulations.

10.4 Right to Object

You have the right to object to the processing of your personal data where panalo relies on legitimate interests as the lawful basis. You also have an absolute right to object to the processing of your data for direct marketing purposes, which panalo will honor without requiring justification.

10.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that such data be transferred to another controller where technically feasible.

10.6 Right to Lodge a Complaint

If you believe panalo has processed your personal data in a manner inconsistent with the Data Privacy Act of 2012, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC). panalo encourages you to contact us first to allow us to address your concern directly before escalating to the NPC.

panalo uses cookies and similar tracking technologies to operate the platform, authenticate sessions, remember your preferences, detect fraud, and analyze aggregate usage patterns. The following categories of cookies are used:

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies, security tokens, and load-balancing cookies. These cannot be disabled without affecting platform functionality.
• Functional Cookies: Used to remember your preferences such as language settings, preferred game categories, and whether you have previously dismissed certain notifications.
• Analytical Cookies: Used to collect anonymized, aggregated data about how players interact with the platform — including pages visited, session duration, and error occurrences — to improve the platform experience. This data is not used to identify individual players.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, including bot detection, multi-account identification, and session hijacking prevention.

panalo does not use third-party advertising cookies or allow advertising networks to place cookies on the platform. You may manage cookie preferences through your browser settings. Note that disabling certain cookies may impair the functionality of the panalo platform.

The panalo platform is strictly restricted to individuals who are at least twenty-one (21) years of age at the time of registration, as required by PAGCOR regulations applicable to all online gaming operators in the Philippines. panalo does not knowingly collect or process personal data relating to individuals under the age of 21.

Where panalo discovers or is notified that an Account has been registered by or used by an individual under the age of 21, all personal data associated with that Account will be deleted (subject to any mandatory regulatory retention obligations), the Account will be immediately closed, and any funds held in the Account will be handled in accordance with PAGCOR guidelines.

If you are a parent or guardian and believe that a person under 21 may have registered on the panalo platform, please contact us immediately via Live Chat or at the email address provided in Section 14.

panalo reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Where a material amendment is made, panalo will notify registered players via their registered email address or via an in-platform notification at least seven (7) calendar days before the amended Policy takes effect.

The "Last Updated" date at the top of this Policy reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how panalo manages your personal data. Continued use of the platform after the effective date of an amended Policy constitutes acceptance of the revised terms.

For all inquiries, requests, or complaints relating to this Privacy Policy or the processing of your personal data by panalo, please contact our Data Protection Officer through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the panalo platform. Start a conversation and type "Data Privacy" to be routed to the appropriate team. Average first response: under 5 minutes.
• Email: [email protected] — please include "Data Privacy Request" in the subject line. (Displayed as plain text; not a clickable link.)

Requests to exercise data subject rights will be acknowledged within five (5) business days and substantively resolved within thirty (30) calendar days. If you are not satisfied with panalo's response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines (NPC) in accordance with NPC Circular No. 16-03.